New Device Onboarding Experience with EntraID Identity Federation

[shawnsong]

Hi Folks,

Last time I shared a post about integrating JumpCloud’s UEM capabilities with an Okta environment by setting up the identity federation, shall we do one for EntraID?

Sure we do 😁, I will follow the same formula as well.  

Let’s dive in!

Considerations & Prerequisites

• (Recommended) Setting up cloud directory integration will allow performing the user management tasks, such as updating user attributes, creating new users, suspending users, and changing passwords in JumpCloud.
• I will focus on the scenario of syncing the password from EntraID to the device,hence in this case JumpCloud must act as a password authority in this setup - users need to reset their passwords in order to kick-off the password sync. 
• Ensure the JumpCloud agent is installed on all devices. (Apple MDM is optional at this stage for macOS).
• Set the default user state like this:
• Configure EntraID SCIM provisioning to JumpCloud. 
• Establish an EntraID identity federation with JumpCloud. 
• (Optional) Create a user group to host the EntraID federation users. You can automate the group memberships via JumpCloud’s Dynamic Groups feature like this:
• Last but not least, create a routing policy to direct the in-scope users. 

Now it’s all set, let’s dive into a few scenarios to see how it looks from a user perspective. 

Scenario 1 - Onboarding a new user

First, create a new user in Azure AD

• Make sure the account is enabled, and set a non-temporary password.
• (Optional) Do a custom attribute-mapping in EntraID if you want to stick with the `CostCenter` value for dynamic groups.
• Now, allow the users to set their password via a JumpCloud activation email:
  • You can do it in bulk like this:
    • Or, you can schedule the activation if you are making future onboarding preparation.  
  • Now we are all set, and the user should have a green checkmark like this indicating we are good to go!
  • If you have setup JumpCloud <> EntraID directory integration as suggested, JumpCloud will sync the user password not only to the device, but also back to EntraID moving forward. User passwords are consistently aligned and managed from this point. 

Next, User self-provisioning on the device.

MacOS

Windows

Scenario 2 - Taking over the existing user on the device.

(Piggy-backing the same steps from my Okta post, they are exactly the same.)

• Full steps and details you may find here. In our case, just edit the provisioned user like this:
• Then, binding the user to device, Okta password will be channeled to the device via JumpCloud Password Sync:

Scenario 3 - When users change their password on device.

In this setup, users will be able to leverage on the native JumpCloud app (available on both Mac & Win) to change their passwords on device, and the new password will sync seamlessly between the device and EntraID.  

• On Windows, after the password change, users can seamlessly stick with the same Windows Hello PIN (or biometric) for login.

• On MacOS, user will need to input the previous password in order to regain access to keychain:

  

 

Scenario 4 - Suspending the user.

When it comes to offboarding the user, you can suspend the user (or delete which is not recommended for the first action.) on JumpCloud admin console. 

• The user session will be ended from the device instantly, the account will be disabled (not deleted). 
• On Windows, you won’t be able to see the user at the login screen
• On MacOS, it looks like this.
• And on Windows, it will look like this:

That’s it (for now)! Thanks for reading this far as always, and feel free to comment below if you have any questions/feedback. 

Catch up on the next one 😀!