Cisco+ Secure Connect - IdP Azure AD SAML Configuration

Overview

Security Assertion Markup Language (SAML) authentication may be configured for Active Directory (AD) integration, providing individual user and group-based identities for policy enforcement.

Deployment

Go to Secure Connect -> MONITOR -> Users, select your identity provider, click Start under "Bring Your ID Provider".

This will take you to the Umbrella Dashboard.  In this quickstart, you use the Azure Active Directory Admin Center to add an enterprise application (Cisco Umbrella) to your Azure Active Directory (Azure AD) tenant. You will configure Cisco Umbrella as a SAML based SSO provider.

To complete the Azure configuration, you first need to download the Umbrella metadata file

Step  1           On Cisco Umbrella, navigate to Deployments->Configuration->SAML Configuration and click Add

Step  2           Select Azure as your Identity Provide (IdP) and click Next

Step  3           On the resulting screen, select Download the Umbrella Metatdata file and leave this screen open.  You will pick up configuration from this point later.

Step  4           Go to the Azure Active Directory Admin Center and sign in

Step  5           In the left menu, select Enterprise applications. The All applications pane opens and displays a list of the applications in your Azure AD tenant.

Step  6           In the Enterprise applications pane, select New Application.

Step  7           Select Create your own application and enter a name that you want to use to recognize the instance of the application. For example, SAML for Cisco Umbrella for RAS.

 

Step  8           Select Integrate any other application you don’t find in the gallery (non-gallery)

Step  9           Select Create

Step  10        In the resulting Overview screen, select Assign users and groups

 

Step  11        On the resulting screen, select Add user/group

 

Step  12        On the resulting Add Assignment pane, select None Selected under Users and groups.

Search for and select the user that you want to assign to the application. For example, user1@yourdomain.com.

Step  13        Select Select.

Step  14        On the Add Assignment pane, select Assign at the bottom of the pane.

Enable Single-Sign On 

Now that you’ve selected your users, in the Manage section of the left menu select Single sign-on to open Single sign-on pane for editing

Step  15        Select the SAML tile to continue

Step  16        On the resulting screen, select Upload metadata file.  This is the xml file that you downloaded from Cisco Umbrella from step 3.

Step  17        Once the upload is successful, click Save on the resulting Basic SAML Configuration pane

Step  18        Scroll down to the SAML Signing Certificate section and download the Federation Metadata XML

Step  19        Now upload this Azure metadata xml file to Cisco Umbrella ( where you left off at Step 3 above) and click Next

Step  20        From the Re-Authenticate Users drop-down list, choose how often Umbrella re-authenticates users: Never, Daily, Weekly, or Monthly

Step  21        Click Save. 

Step  22        To verify that the integration is successful, press the Test Configuration button

 

A success looks like this:

 

If you receive a failure, go back to Azure and click the Test button and follow the resolution guidance provided.

Next Steps
see Cisco+ Secure Connect Azure SCIM Integration