diff --git a/public/docs-static/img/manage/team/idp-sync/entra-id-scim-sync/attribute-mapping.png b/public/docs-static/img/manage/team/idp-sync/entra-id-scim-sync/attribute-mapping.png deleted file mode 100644 index b64b540c..00000000 Binary files a/public/docs-static/img/manage/team/idp-sync/entra-id-scim-sync/attribute-mapping.png and /dev/null differ diff --git a/public/docs-static/img/manage/team/idp-sync/entra-id-scim-sync/entra-application-created.png b/public/docs-static/img/manage/team/idp-sync/entra-id-scim-sync/entra-application-created.png deleted file mode 100644 index 95e48010..00000000 Binary files a/public/docs-static/img/manage/team/idp-sync/entra-id-scim-sync/entra-application-created.png and /dev/null differ diff --git a/public/docs-static/img/manage/team/idp-sync/entra-id-scim-sync/entra-application-form.png b/public/docs-static/img/manage/team/idp-sync/entra-id-scim-sync/entra-application-form.png deleted file mode 100644 index 7e9708c6..00000000 Binary files a/public/docs-static/img/manage/team/idp-sync/entra-id-scim-sync/entra-application-form.png and /dev/null differ diff --git a/public/docs-static/img/manage/team/idp-sync/entra-id-scim-sync/entra-assign-users-and-groups.png b/public/docs-static/img/manage/team/idp-sync/entra-id-scim-sync/entra-assign-users-and-groups.png deleted file mode 100644 index 1bb8042c..00000000 Binary files a/public/docs-static/img/manage/team/idp-sync/entra-id-scim-sync/entra-assign-users-and-groups.png and /dev/null differ diff --git a/public/docs-static/img/manage/team/idp-sync/entra-id-scim-sync/entra-assign-users-groups.png b/public/docs-static/img/manage/team/idp-sync/entra-id-scim-sync/entra-assign-users-groups.png deleted file mode 100644 index ed6827d4..00000000 Binary files a/public/docs-static/img/manage/team/idp-sync/entra-id-scim-sync/entra-assign-users-groups.png and /dev/null differ diff --git a/public/docs-static/img/manage/team/idp-sync/entra-id-scim-sync/entra-configure-attribute-mapping.png b/public/docs-static/img/manage/team/idp-sync/entra-id-scim-sync/entra-configure-attribute-mapping.png deleted file mode 100644 index 73fd36f0..00000000 Binary files a/public/docs-static/img/manage/team/idp-sync/entra-id-scim-sync/entra-configure-attribute-mapping.png and /dev/null differ diff --git a/public/docs-static/img/manage/team/idp-sync/entra-id-scim-sync/entra-connection-success.png b/public/docs-static/img/manage/team/idp-sync/entra-id-scim-sync/entra-connection-success.png deleted file mode 100644 index eeb0925e..00000000 Binary files a/public/docs-static/img/manage/team/idp-sync/entra-id-scim-sync/entra-connection-success.png and /dev/null differ diff --git a/public/docs-static/img/manage/team/idp-sync/entra-id-scim-sync/entra-enable-provisioning.png b/public/docs-static/img/manage/team/idp-sync/entra-id-scim-sync/entra-enable-provisioning.png deleted file mode 100644 index 1a59a823..00000000 Binary files a/public/docs-static/img/manage/team/idp-sync/entra-id-scim-sync/entra-enable-provisioning.png and /dev/null differ diff --git a/public/docs-static/img/manage/team/idp-sync/entra-id-scim-sync/entra-enterprise-applications.png b/public/docs-static/img/manage/team/idp-sync/entra-id-scim-sync/entra-enterprise-applications.png deleted file mode 100644 index a3bf8515..00000000 Binary files a/public/docs-static/img/manage/team/idp-sync/entra-id-scim-sync/entra-enterprise-applications.png and /dev/null differ diff --git a/public/docs-static/img/manage/team/idp-sync/entra-id-scim-sync/entra-group-attribute-mapping-updated.png b/public/docs-static/img/manage/team/idp-sync/entra-id-scim-sync/entra-group-attribute-mapping-updated.png deleted file mode 100644 index dd93245f..00000000 Binary files a/public/docs-static/img/manage/team/idp-sync/entra-id-scim-sync/entra-group-attribute-mapping-updated.png and /dev/null differ diff --git a/public/docs-static/img/manage/team/idp-sync/entra-id-scim-sync/entra-new-application.png b/public/docs-static/img/manage/team/idp-sync/entra-id-scim-sync/entra-new-application.png deleted file mode 100644 index 275326bd..00000000 Binary files a/public/docs-static/img/manage/team/idp-sync/entra-id-scim-sync/entra-new-application.png and /dev/null differ diff --git a/public/docs-static/img/manage/team/idp-sync/entra-id-scim-sync/entra-provisioning-get-started.png b/public/docs-static/img/manage/team/idp-sync/entra-id-scim-sync/entra-provisioning-get-started.png deleted file mode 100644 index 6176e396..00000000 Binary files a/public/docs-static/img/manage/team/idp-sync/entra-id-scim-sync/entra-provisioning-get-started.png and /dev/null differ diff --git a/public/docs-static/img/manage/team/idp-sync/entra-id-scim-sync/entra-regenerate-auth-token.png b/public/docs-static/img/manage/team/idp-sync/entra-id-scim-sync/entra-regenerate-auth-token.png deleted file mode 100644 index fd0070f1..00000000 Binary files a/public/docs-static/img/manage/team/idp-sync/entra-id-scim-sync/entra-regenerate-auth-token.png and /dev/null differ diff --git a/public/docs-static/img/manage/team/idp-sync/entra-id-scim-sync/entra-run-provisioning.png b/public/docs-static/img/manage/team/idp-sync/entra-id-scim-sync/entra-run-provisioning.png deleted file mode 100644 index 66571f6d..00000000 Binary files a/public/docs-static/img/manage/team/idp-sync/entra-id-scim-sync/entra-run-provisioning.png and /dev/null differ diff --git a/public/docs-static/img/manage/team/idp-sync/entra-id-scim-sync/entra-scim-getting-started.png b/public/docs-static/img/manage/team/idp-sync/entra-id-scim-sync/entra-scim-getting-started.png deleted file mode 100644 index f45dd852..00000000 Binary files a/public/docs-static/img/manage/team/idp-sync/entra-id-scim-sync/entra-scim-getting-started.png and /dev/null differ diff --git a/public/docs-static/img/manage/team/idp-sync/entra-id-scim-sync/entra-user-attribute-mapping-updated.png b/public/docs-static/img/manage/team/idp-sync/entra-id-scim-sync/entra-user-attribute-mapping-updated.png deleted file mode 100644 index b1f8ade0..00000000 Binary files a/public/docs-static/img/manage/team/idp-sync/entra-id-scim-sync/entra-user-attribute-mapping-updated.png and /dev/null differ diff --git a/public/docs-static/img/manage/team/idp-sync/entra-id-scim-sync/entra-user-attribute-mapping.png b/public/docs-static/img/manage/team/idp-sync/entra-id-scim-sync/entra-user-attribute-mapping.png deleted file mode 100644 index be8c7d85..00000000 Binary files a/public/docs-static/img/manage/team/idp-sync/entra-id-scim-sync/entra-user-attribute-mapping.png and /dev/null differ diff --git a/public/docs-static/img/manage/team/idp-sync/entra-id-scim-sync/entra-user-prefix.png b/public/docs-static/img/manage/team/idp-sync/entra-id-scim-sync/entra-user-prefix.png deleted file mode 100644 index f52e89d8..00000000 Binary files a/public/docs-static/img/manage/team/idp-sync/entra-id-scim-sync/entra-user-prefix.png and /dev/null differ diff --git a/public/docs-static/img/manage/team/idp-sync/microsoft-entra-id-sync/add-client-secret.png b/public/docs-static/img/manage/team/idp-sync/microsoft-entra-id-sync/add-client-secret.png deleted file mode 100644 index 66f79d93..00000000 Binary files a/public/docs-static/img/manage/team/idp-sync/microsoft-entra-id-sync/add-client-secret.png and /dev/null differ diff --git a/public/docs-static/img/manage/team/idp-sync/microsoft-entra-id-sync/api-permissions-menu.png b/public/docs-static/img/manage/team/idp-sync/microsoft-entra-id-sync/api-permissions-menu.png deleted file mode 100644 index 436379ae..00000000 Binary files a/public/docs-static/img/manage/team/idp-sync/microsoft-entra-id-sync/api-permissions-menu.png and /dev/null differ diff --git a/public/docs-static/img/manage/team/idp-sync/microsoft-entra-id-sync/api-permissions-screen.png b/public/docs-static/img/manage/team/idp-sync/microsoft-entra-id-sync/api-permissions-screen.png deleted file mode 100644 index 17a8a015..00000000 Binary files a/public/docs-static/img/manage/team/idp-sync/microsoft-entra-id-sync/api-permissions-screen.png and /dev/null differ diff --git a/public/docs-static/img/manage/team/idp-sync/microsoft-entra-id-sync/app-registration.png b/public/docs-static/img/manage/team/idp-sync/microsoft-entra-id-sync/app-registration.png deleted file mode 100644 index e1c7f73c..00000000 Binary files a/public/docs-static/img/manage/team/idp-sync/microsoft-entra-id-sync/app-registration.png and /dev/null differ diff --git a/public/docs-static/img/manage/team/idp-sync/microsoft-entra-id-sync/application-permissions-graph.png b/public/docs-static/img/manage/team/idp-sync/microsoft-entra-id-sync/application-permissions-graph.png deleted file mode 100644 index c4fb24f3..00000000 Binary files a/public/docs-static/img/manage/team/idp-sync/microsoft-entra-id-sync/application-permissions-graph.png and /dev/null differ diff --git a/public/docs-static/img/manage/team/idp-sync/microsoft-entra-id-sync/connect-to-entra.png b/public/docs-static/img/manage/team/idp-sync/microsoft-entra-id-sync/connect-to-entra.png deleted file mode 100644 index 67d693e2..00000000 Binary files a/public/docs-static/img/manage/team/idp-sync/microsoft-entra-id-sync/connect-to-entra.png and /dev/null differ diff --git a/public/docs-static/img/manage/team/idp-sync/microsoft-entra-id-sync/connect-with-entra.png b/public/docs-static/img/manage/team/idp-sync/microsoft-entra-id-sync/connect-with-entra.png deleted file mode 100644 index a1e06f72..00000000 Binary files a/public/docs-static/img/manage/team/idp-sync/microsoft-entra-id-sync/connect-with-entra.png and /dev/null differ diff --git a/public/docs-static/img/manage/team/idp-sync/microsoft-entra-id-sync/copy-client-secret.png b/public/docs-static/img/manage/team/idp-sync/microsoft-entra-id-sync/copy-client-secret.png deleted file mode 100644 index 299dd367..00000000 Binary files a/public/docs-static/img/manage/team/idp-sync/microsoft-entra-id-sync/copy-client-secret.png and /dev/null differ diff --git a/public/docs-static/img/manage/team/idp-sync/microsoft-entra-id-sync/netbird-api-perms.png b/public/docs-static/img/manage/team/idp-sync/microsoft-entra-id-sync/netbird-api-perms.png deleted file mode 100644 index e6d6a6f1..00000000 Binary files a/public/docs-static/img/manage/team/idp-sync/microsoft-entra-id-sync/netbird-api-perms.png and /dev/null differ diff --git a/public/docs-static/img/manage/team/idp-sync/microsoft-entra-id-sync/qlNlfgV.png b/public/docs-static/img/manage/team/idp-sync/microsoft-entra-id-sync/qlNlfgV.png deleted file mode 100644 index 78ce1c7a..00000000 Binary files a/public/docs-static/img/manage/team/idp-sync/microsoft-entra-id-sync/qlNlfgV.png and /dev/null differ diff --git a/public/docs-static/img/manage/team/idp-sync/microsoft-entra-id-sync/register-app.png b/public/docs-static/img/manage/team/idp-sync/microsoft-entra-id-sync/register-app.png deleted file mode 100644 index 919fbd36..00000000 Binary files a/public/docs-static/img/manage/team/idp-sync/microsoft-entra-id-sync/register-app.png and /dev/null differ diff --git a/public/docs-static/img/manage/team/idp-sync/microsoft-entra-id-sync/request-api-permissions.png b/public/docs-static/img/manage/team/idp-sync/microsoft-entra-id-sync/request-api-permissions.png deleted file mode 100644 index 5d7b582f..00000000 Binary files a/public/docs-static/img/manage/team/idp-sync/microsoft-entra-id-sync/request-api-permissions.png and /dev/null differ diff --git a/public/docs-static/img/manage/team/idp-sync/microsoft-entra-id-sync/roles.png b/public/docs-static/img/manage/team/idp-sync/microsoft-entra-id-sync/roles.png deleted file mode 100644 index 391075fa..00000000 Binary files a/public/docs-static/img/manage/team/idp-sync/microsoft-entra-id-sync/roles.png and /dev/null differ diff --git a/public/docs-static/img/manage/team/idp-sync/microsoft-entra-id-sync/select-group-read-all.png b/public/docs-static/img/manage/team/idp-sync/microsoft-entra-id-sync/select-group-read-all.png deleted file mode 100644 index f2b4a47c..00000000 Binary files a/public/docs-static/img/manage/team/idp-sync/microsoft-entra-id-sync/select-group-read-all.png and /dev/null differ diff --git a/public/docs-static/img/manage/team/idp-sync/microsoft-entra-id-sync/user-group-filter.png b/public/docs-static/img/manage/team/idp-sync/microsoft-entra-id-sync/user-group-filter.png deleted file mode 100644 index b6a2e58a..00000000 Binary files a/public/docs-static/img/manage/team/idp-sync/microsoft-entra-id-sync/user-group-filter.png and /dev/null differ diff --git a/src/pages/manage/team/idp-sync/embedded/microsoft-entra-id-scim-sync.mdx b/src/pages/manage/team/idp-sync/embedded/microsoft-entra-id-scim-sync.mdx index a1091c3e..9ed225f5 100644 --- a/src/pages/manage/team/idp-sync/embedded/microsoft-entra-id-scim-sync.mdx +++ b/src/pages/manage/team/idp-sync/embedded/microsoft-entra-id-scim-sync.mdx @@ -27,13 +27,11 @@ To enable SCIM synchronization in NetBird, navigate to `Integrations > Identity Select your **Microsoft Entra ID** identity provider connector for this integration and click **Continue** to proceed.

- select-identity-provider + The connector picker with the Microsoft Entra ID identity provider selected

This will open a pop-up window featuring a user-friendly wizard, guiding you through the synchronization process between NetBird and Entra ID. -Microsoft Entra ID SCIM Getting Started Wizard - ## Prerequisites Before you begin the integration process, ensure you have the necessary admin permissions in Microsoft Entra ID. You need an Azure user account with at least one of these roles: @@ -45,44 +43,29 @@ Before you begin the integration process, ensure you have the necessary admin pe ## Configure SCIM Provisioning in Microsoft Entra ID Click on the `Get Started` button to initiate the integration process. -A new wizard screen will appear, offering step-by-step instructions for creating and configuring your Microsoft Entra ID application. To simplify the process, the wizard also provides quick-copy buttons for essential information: +A new wizard screen will appear, offering step-by-step instructions for creating and configuring your Microsoft Entra ID application. To simplify the process, the wizard also provides quick-copy buttons for the values you will enter in Entra ID, including the SCIM Token Key. -Microsoft Entra ID SCIM Configuration Setup +The NetBird SCIM setup wizard step with quick-copy buttons for the values needed in Entra ID If you already have a NetBird Enterprise Application in Entra ID with provisioning available, you can configure SCIM on it directly without creating a new one. The App Registration used by the legacy NetBird API integration is a different application type and cannot be reused for SCIM. -In the [Azure portal](https://portal.azure.com), navigate to `Azure Active Directory` → `Enterprise applications`. - -Microsoft Entra ID Enterprise Applications - -Click `New application` to create a new enterprise application. - -Microsoft Entra ID New Application Creation - -Click `Create your own application`. +In the [Azure portal](https://portal.azure.com), navigate to `Azure Active Directory` → `Enterprise applications`. Click `New application`, then `Create your own application`. Fill out the application form with the following details: * **What's the name of your app?**: `NetBird SCIM` * **What are you looking to do with your application?**: Select `Integrate any other application you don't find in the gallery (Non-gallery)` -Microsoft Entra ID Application Form - Click `Create`. -Microsoft Entra ID Application Created Successfully - ### Enable Provisioning On the NetBird dashboard click the Continue → button. A new wizard screen will appear, offering step-by-step instructions for enabling provisioning. -Microsoft Entra ID Enable Provisioning Setup Once the application is created, click `Manage`, then click `Provisioning`. -Microsoft Entra ID Provisioning Get Started - Under the `Create configuration` section, click `connect your application`. Fill out the `New provisioning configuration` form with the following details: @@ -101,28 +84,22 @@ Fill out the `New provisioning configuration` form with the following details: See [Microsoft's SCIM compatibility documentation](https://learn.microsoft.com/en-us/entra/identity/app-provisioning/application-provisioning-config-problem-scim-compatibility#flags-to-alter-the-scim-behavior) for more details. -Microsoft Entra ID Connect Application Configuration +The Entra ID New provisioning configuration form with Bearer authentication, the NetBird Tenant URL, and the Secret token Click `Test Connection` to verify the SCIM connection. If the connection is successful, click `Create` to save the configuration. -Microsoft Entra ID Connection Success - ### Configure Attribute Mapping On the NetBird dashboard click the Continue → button. A new wizard screen will appear, offering step-by-step instructions for configuring attribute mapping. -Microsoft Entra ID Configure Attribute Mapping - After creating the provisioning configuration, you need to configure the attribute mappings for both groups and users. Navigate to the `Attribute mapping` section. -Microsoft Entra ID Attribute Mapping - #### Group Attribute Mapping Select the `Groups` tab to configure the group attribute mapping. -Microsoft Entra ID Group Attribute Mapping +The Groups attribute mapping list in Entra ID with the externalId row to delete In the attribute mappings list, locate the `externalId` row and click `Delete`. @@ -130,14 +107,10 @@ NetBird matches synchronized groups by `displayName`. Removing the `externalId` Click `Save` to apply the updated group attribute mapping configuration. -Microsoft Entra ID Group Attribute Mapping After Deletion - #### User Attribute Mapping Select the `Users` tab to configure the user attribute mapping. -Microsoft Entra ID Default User Attribute Mapping - The default Entra mapping includes around 20 user attributes. NetBird only consumes the attributes listed below. Removing the unused mappings keeps the provisioning logs clean and avoids mapping errors for attributes NetBird does not accept. @@ -154,8 +127,7 @@ Remove all attribute mappings except for the following: Click `Save` to apply the updated user attribute mapping configuration. -Microsoft Entra ID Updated User Attribute Mapping - +The Users attribute mapping reduced to the seven attributes NetBird consumes In the attribute mappings list, locate the `externalId` row and click `Edit`. @@ -163,12 +135,10 @@ Change the **Source attribute** from `mailNickname` to `objectId`. `externalId` is the stable identifier NetBird uses to link a SCIM user record to its Entra user. The Entra default of `mailNickname` is not guaranteed to be set on every user, is not guaranteed to be unique in the directory, and can change. `objectId` is the immutable Entra GUID and is the correct stable identifier. This ensures NetBird continues to recognize the same user across email address or display name changes. -Microsoft Entra ID Edit External ID Attribute +Editing the externalId mapping with the Source attribute set to objectId Click `Ok` to save the change, then click `Save` to apply the final user attribute mapping configuration. -Microsoft Entra ID Final User Attribute Mapping - ### Why this mapping prevents duplicate users Set `externalId` to `objectId` **before** the first sync. Getting this wrong is the most common cause of duplicate user accounts, so it is worth understanding why. @@ -191,9 +161,6 @@ Because the match is on `objectId` and not on email, the two accounts can show t On the NetBird dashboard click the Continue → button. A new wizard screen will appear, offering step-by-step instructions for assigning users and groups. -Microsoft Entra ID Assign Users and Groups - - To enable SCIM synchronization of users and groups to NetBird, you need to assign them to the NetBird enterprise application. In the Azure portal, navigate to your NetBird enterprise application: @@ -203,18 +170,13 @@ In the Azure portal, navigate to your NetBird enterprise application: * Select the users and groups you want to synchronize to NetBird * Click `Assign` to save the assignments -Microsoft Entra ID Assign Users and Groups Interface - ## Start Provisioning On the NetBird dashboard click the Continue → button. A new wizard screen will appear, offering step-by-step instructions for starting the provisioning. -Microsoft Entra ID Run Provisioning - - After assigning users and groups, navigate back to the provisioning configuration, click `Overview`, then click the `Start provisioning` button to enable automatic synchronization. The first sync will begin shortly after provisioning is started. -Microsoft Entra ID Provisioning Started +The provisioning Overview page in Entra ID after clicking Start provisioning Once started, Microsoft Entra ID will automatically synchronize the assigned users and groups to NetBird. @@ -243,20 +205,17 @@ have been successfully synchronized by navigating to `Team > Users` in your NetB You can access some configuration settings inside the NetBird Dashboard. E.g. if you want to regenerate the authentication token or want to filter users and groups based on a specific prefix. Simply go to the Integrations page and click the settings icon of your integration. -Microsoft Entra ID SCIM Configuration Options +The enabled Entra ID SCIM integration on the NetBird Integrations page with its settings icon ### Regenerate Auth Token If your authentication token has expired or you need to update it, click **Regenerate Auth Token** in the configuration window to generate a new token. -Microsoft Entra ID Regenerate Authentication Token - - ### Groups to be synchronized By default, all groups assigned to the NetBird application in Entra will be synchronized. If you want to synchronize only assigned groups that start with a specific prefix, you can specify them in the filter. Keep in mind that the prefix matching is case-sensitive. -Microsoft Entra ID Group Prefix Filter +The group prefix filter in the NetBird SCIM integration settings Click `Continue` to proceed to the next step. @@ -264,4 +223,3 @@ Click `Continue` to proceed to the next step. By default, all users from the groups assigned to the NetBird application in Entra will be synchronized. If you want to further filter and synchronize only users from specific assigned groups, you can specify those group names in the filter. The group name matching is case-sensitive. -Microsoft Entra ID User Prefix Filter diff --git a/src/pages/manage/team/idp-sync/embedded/microsoft-entra-id-sync.mdx b/src/pages/manage/team/idp-sync/embedded/microsoft-entra-id-sync.mdx index 4eb8fea6..7cb16a80 100644 --- a/src/pages/manage/team/idp-sync/embedded/microsoft-entra-id-sync.mdx +++ b/src/pages/manage/team/idp-sync/embedded/microsoft-entra-id-sync.mdx @@ -23,12 +23,12 @@ Navigate to `Integrations` in the left menu to access the `Identity Provider` in Select your **Microsoft Entra ID** identity provider connector for this integration and click **Continue** to proceed.

- select-identity-provider + The connector picker with the Microsoft Entra ID identity provider selected

This will open a pop-up window featuring a user-friendly wizard, guiding you through the synchronization process between NetBird and Azure AD. -![NetBird Get Started IdP](/docs-static/img/manage/team/idp-sync/microsoft-entra-id-sync/entra-req-permissions.png) +![The Entra ID (API) card on the NetBird Identity Provider Sync tab](/docs-static/img/manage/team/idp-sync/microsoft-entra-id-sync/entra-req-permissions.png) ## Prerequisites @@ -46,8 +46,6 @@ To check your permissions: * Expand the `Manage` tab and click on `Roles and administrators` in the left menu. * Look for your username and verify if you're assigned any of the above roles. -![EntraID Roles](/docs-static/img/manage/team/idp-sync/microsoft-entra-id-sync/roles.png) - If you don't have the required permissions, contact your Azure AD administrator to grant you the appropriate role before proceeding with the NetBird integration. ## Create and Configure a Microsoft Entra ID Application for NetBird Integration @@ -61,21 +59,13 @@ A new wizard screen will appear, offering step-by-step instructions for creating * Redirect Type * Redirect URI -![NetBird Create Application](/docs-static/img/manage/team/idp-sync/microsoft-entra-id-sync/connect-to-entra.png) +For convenience, click on [Azure Active Directory](https://portal.azure.com/#view/Microsoft_AAD_IAM/ActiveDirectoryMenuBlade/~/Overview) (step 1). That will open the Azure dashboard. Navigate to `App registrations` in the left menu and then click `+New registration`. -For convenience, click on [Azure Active Directory](https://portal.azure.com/#view/Microsoft_AAD_IAM/ActiveDirectoryMenuBlade/~/Overview) (step 1). That will open the Azure dashboard. Navigate to `App registrations` in the left menu and then click `+New registration` as indicated below: - -![EntraID App Registration](/docs-static/img/manage/team/idp-sync/microsoft-entra-id-sync/app-registration.png) - -Fill in the required information: - -![EntraID Register an App](/docs-static/img/manage/team/idp-sync/microsoft-entra-id-sync/register-app.png) - -After entering all required information, click the `Register` button at the bottom of the form to finalize the application registration process. +Fill in the registration form with the name, supported account type, and redirect URI shown in the NetBird wizard, using its copy buttons. Then click the `Register` button at the bottom of the form to finalize the application registration process. Upon successful registration, you'll be redirected to a confirmation screen similar to the following: -![EntraID App Registered](/docs-static/img/manage/team/idp-sync/microsoft-entra-id-sync/netbird-app-azure.png) +![The registered NetBird app overview in Entra ID showing the Application (client) ID and Directory (tenant) ID](/docs-static/img/manage/team/idp-sync/microsoft-entra-id-sync/netbird-app-azure.png) Copy and securely store the generated `Application (client) ID` and `Directory (tenant) ID` as you will need them shortly. @@ -83,23 +73,13 @@ Copy and securely store the generated `Application (client) ID` and `Directory ( On the NetBird dashboard click the `Continue →` button. A new wizard screen will appear, this time, offering step-by-step instructions for setting up API permissions. -![NetBird Add API Permissions](/docs-static/img/manage/team/idp-sync/microsoft-entra-id-sync/connect-with-entra.png) - -Back to Azure, in the `App registrations` screen, click on `Manage` in the left menu to expand it and then click on `API permissions`: - -![EntraID API Permissions](/docs-static/img/manage/team/idp-sync/microsoft-entra-id-sync/api-permissions-menu.png) +Back to Azure, in the `App registrations` screen, click on `Manage` in the left menu to expand it and then click on `API permissions`. Look for the `+ Add a permission` button, located near the top of the permissions list and click on it. -![EntraID API Permissions Screen](/docs-static/img/manage/team/idp-sync/microsoft-entra-id-sync/api-permissions-screen.png) - A new pop-up window will appear, asking you to select an API. Click on `Microsoft Graph`. -![EntraID Microsoft Graph](/docs-static/img/manage/team/idp-sync/microsoft-entra-id-sync/request-api-permissions.png) - -On the next screen, click on the `Application permissions` button, which will let you select the appropriate permissions for NetBird to function correctly with your Microsoft Entra ID environment. - -![EntraID Request API Permissions](/docs-static/img/manage/team/idp-sync/microsoft-entra-id-sync/application-permissions-graph.png) +On the next screen, click on the `Application permissions` button (not `Delegated permissions`), which will let you select the appropriate permissions for NetBird to function correctly with your Microsoft Entra ID environment. To assign user permissions: @@ -107,39 +87,31 @@ To assign user permissions: * In the search results, click on the `User` tab to expand it and view the available permissions. * Click on the checkbox to select and enable the `User.Read.All` permission. -![EntraID UserReadAll](/docs-static/img/manage/team/idp-sync/microsoft-entra-id-sync/request-api-perms.png) +![The Microsoft Graph application permissions picker with User.Read.All selected](/docs-static/img/manage/team/idp-sync/microsoft-entra-id-sync/request-api-perms.png) The `User.Read.All` permission allows NetBird to read the full set of profile properties, group memberships, and reports of the signed-in user and other users in your organization. -Next, repeat the procedure. This time, search for `Group.Read.All` and click on the checkbox to enable it as shown below: - -![EntraID GroupReadAll](/docs-static/img/manage/team/idp-sync/microsoft-entra-id-sync/select-group-read-all.png) +Next, repeat the procedure. This time, search for `Group.Read.All`, expand the `Group` tab, and enable it the same way. Once done, click the `Add permissions` button. You will see a few warnings: -![EntraID API Permissions Warnings](/docs-static/img/manage/team/idp-sync/microsoft-entra-id-sync/needed-netbird-api-perms.png) +![The API permissions list with User.Read.All and Group.Read.All showing a Not granted warning next to the Grant admin consent button](/docs-static/img/manage/team/idp-sync/microsoft-entra-id-sync/needed-netbird-api-perms.png) Locate the `Grant admin consent for [Your Organization Name]` button (you'll find it next to `+Add a permission` button). Click on it to grant the required permissions. A confirmation dialog will appear, asking you to verify this action. Review the permissions listed in the dialog and click `Yes` to confirm. Wait for the process to complete, this may take a few seconds. -Once finished, the status of the permissions should change to `Granted for [Your Organization Name]`. Verify that all selected permissions now show a green checkmark, indicating they've been successfully granted: - -![EntraID API Permissions Granted](/docs-static/img/manage/team/idp-sync/microsoft-entra-id-sync/netbird-api-perms.png) +Once finished, the status of the permissions should change to `Granted for [Your Organization Name]`. Verify that all selected permissions now show a green checkmark, indicating they've been successfully granted. ## Create a Client Secret for Secure NetBird-Entra ID Authentication Back to the NetBird dashboard, click the `Continue →` button. A new wizard screen will appear, showing instructions for generating a client secret in Entra ID. -![NetBird Generate Client Secret](/docs-static/img/manage/team/idp-sync/microsoft-entra-id-sync/copy-client-secret.png) - -On Azure, click on the `Certificates & secrets` button in the left menu to open the management page. Click on `+New client secret` as shown below. Choose an expiration time that suits your security needs and click the `Add` button. - -![EntraID Add a Client Secret](/docs-static/img/manage/team/idp-sync/microsoft-entra-id-sync/add-client-secret.png) +On Azure, click on the `Certificates & secrets` button in the left menu to open the management page. Click on `+New client secret`. Choose an expiration time that suits your security needs and click the `Add` button. A new client secret will be generated and displayed on the screen. Copy and securely store the `Value` field immediately, as you will needed in the next step. -![EntraID Client Secret Value](/docs-static/img/manage/team/idp-sync/microsoft-entra-id-sync/certs-secrets.png) +![The new client secret in Entra ID with the Value column to copy](/docs-static/img/manage/team/idp-sync/microsoft-entra-id-sync/certs-secrets.png) ## Enter Application ID and Directory ID in NetBird @@ -147,7 +119,7 @@ Paste the secret `Value` from the previous step into NetBird and click the `Cont Paste the values and click the `Continue →` button. -![NetBird Application ID and Directory](/docs-static/img/manage/team/idp-sync/microsoft-entra-id-sync/entra-copy-ids.png) +![The NetBird wizard step asking for the Application (client) ID and Directory (tenant) ID](/docs-static/img/manage/team/idp-sync/microsoft-entra-id-sync/entra-copy-ids.png) ## Choose Groups to Synchronize from Entra ID At this stage, NetBird is set to synchronize all groups from your Microsoft Entra ID by default. You have two options: @@ -155,7 +127,7 @@ At this stage, NetBird is set to synchronize all groups from your Microsoft Entr * If you want to synchronize all groups, simply click the `Continue →` button. * To synchronize only specific groups, click the `+ Add group filter` button, which will open a new panel where you can set criteria to include or exclude groups. -![NetBird Group Sync](/docs-static/img/manage/team/idp-sync/microsoft-entra-id-sync/add-group-filter.png) +![The NetBird group synchronization step with the Add group filter button](/docs-static/img/manage/team/idp-sync/microsoft-entra-id-sync/add-group-filter.png) ## Choose Users to Synchronize from Entra ID After configuring group synchronization, you'll now set up user synchronization. Similar than before, NetBird is configured to synchronize all users from your Microsoft Entra ID by default. @@ -167,8 +139,6 @@ After configuring group synchronization, you'll now set up user synchronization. You can modify these synchronization settings later if necessary. -![NetBird Users Sync](/docs-static/img/manage/team/idp-sync/microsoft-entra-id-sync/user-group-filter.png) - After configuring user and group synchronization, the setup wizard will finalize the process and you'll automatically return to the main Identity Provider screen. On this screen, you'll see two key indicators of successful integration: @@ -186,14 +156,12 @@ These indicators confirm that: You can manually trigger a sync or adjust settings by clicking on the Microsoft Entra ID section in the Identity Provider screen -![NetBird Identity Provider Synchronized](/docs-static/img/manage/team/idp-sync/microsoft-entra-id-sync/idp-synced.png) +![The Identity Provider Sync tab with the Entra ID integration enabled and marked as synced](/docs-static/img/manage/team/idp-sync/microsoft-entra-id-sync/idp-synced.png) ## Verify the Integration To verify the synchronization, navigate to `Teams > Users` in the left menu. You should see all the users and groups from your Microsoft Entra ID environment listed in the NetBird dashboard. -![NetBird Checking Integration](/docs-static/img/manage/team/idp-sync/microsoft-entra-id-sync/qlNlfgV.png) - You can now proceed to configure [access control policies](/manage/access-control/manage-network-access#creating-policies) using the synchronized groups to allow or deny access to the synchronized users. diff --git a/src/pages/manage/team/idp-sync/microsoft-entra-id-scim-sync.mdx b/src/pages/manage/team/idp-sync/microsoft-entra-id-scim-sync.mdx index 0f1976d4..32d133c0 100644 --- a/src/pages/manage/team/idp-sync/microsoft-entra-id-scim-sync.mdx +++ b/src/pages/manage/team/idp-sync/microsoft-entra-id-scim-sync.mdx @@ -31,7 +31,7 @@ Before you begin the integration process, ensure you have the necessary admin pe To enable SCIM synchronization in NetBird, navigate to `Integrations > Identity Provider Sync` in your NetBird dashboard. -Microsoft Entra ID SCIM Integration Connection +The Connect Entra ID (SCIM) button on the NetBird Identity Provider Sync tab Before starting the Entra ID SCIM integration you will need to be logged in via Microsoft Login.
@@ -41,50 +41,32 @@ To enable SCIM synchronization in NetBird, navigate to `Integrations > Identity Click the `Connect Microsoft Entra ID` button to begin the configuration process. This action will trigger a pop-up window that will present you with a user-friendly wizard, guiding you through the synchronization process between NetBird and Entra ID. -Microsoft Entra ID SCIM Getting Started Wizard - - ## Configure SCIM Provisioning in Microsoft Entra ID Click on the `Get Started` button to initiate the integration process. -A new wizard screen will appear, offering step-by-step instructions for creating and configuring your Microsoft Entra ID application. To simplify the process, the wizard also provides quick-copy buttons for essential information: +A new wizard screen will appear, offering step-by-step instructions for creating and configuring your Microsoft Entra ID application. To simplify the process, the wizard also provides quick-copy buttons for the values you will enter in Entra ID, including the SCIM Token Key. -Microsoft Entra ID SCIM Configuration Setup +The NetBird SCIM setup wizard step with quick-copy buttons for the values needed in Entra ID If you already have a NetBird Enterprise Application in Entra ID with provisioning available, you can configure SCIM on it directly without creating a new one. The App Registration used by the legacy NetBird API integration is a different application type and cannot be reused for SCIM. -In the [Azure portal](https://portal.azure.com), navigate to `Azure Active Directory` → `Enterprise applications`. - -Microsoft Entra ID Enterprise Applications - -Click `New application` to create a new enterprise application. - -Microsoft Entra ID New Application Creation - -Click `Create your own application`. +In the [Azure portal](https://portal.azure.com), navigate to `Azure Active Directory` → `Enterprise applications`. Click `New application`, then `Create your own application`. Fill out the application form with the following details: * **What's the name of your app?**: `NetBird SCIM` * **What are you looking to do with your application?**: Select `Integrate any other application you don't find in the gallery (Non-gallery)` -Microsoft Entra ID Application Form - Click `Create`. -Microsoft Entra ID Application Created Successfully - ### Enable Provisioning On the NetBird dashboard click the Continue → button. A new wizard screen will appear, offering step-by-step instructions for enabling provisioning. -Microsoft Entra ID Enable Provisioning Setup Once the application is created, click `Manage`, then click `Provisioning`. -Microsoft Entra ID Provisioning Get Started - Under the `Create configuration` section, click `connect your application`. Fill out the `New provisioning configuration` form with the following details: @@ -99,28 +81,22 @@ Fill out the `New provisioning configuration` form with the following details: See [Microsoft's SCIM compatibility documentation](https://learn.microsoft.com/en-us/entra/identity/app-provisioning/application-provisioning-config-problem-scim-compatibility#flags-to-alter-the-scim-behavior) for more details. -Microsoft Entra ID Connect Application Configuration +The Entra ID New provisioning configuration form with Bearer authentication, the NetBird Tenant URL, and the Secret token Click `Test Connection` to verify the SCIM connection. If the connection is successful, click `Create` to save the configuration. -Microsoft Entra ID Connection Success - ### Configure Attribute Mapping On the NetBird dashboard click the Continue → button. A new wizard screen will appear, offering step-by-step instructions for configuring attribute mapping. -Microsoft Entra ID Configure Attribute Mapping - After creating the provisioning configuration, you need to configure the attribute mappings for both groups and users. Navigate to the `Attribute mapping` section. -Microsoft Entra ID Attribute Mapping - #### Group Attribute Mapping Select the `Groups` tab to configure the group attribute mapping. -Microsoft Entra ID Group Attribute Mapping +The Groups attribute mapping list in Entra ID with the externalId row to delete In the attribute mappings list, locate the `externalId` row and click `Delete`. @@ -128,14 +104,10 @@ NetBird matches synchronized groups by `displayName`. Removing the `externalId` Click `Save` to apply the updated group attribute mapping configuration. -Microsoft Entra ID Group Attribute Mapping After Deletion - #### User Attribute Mapping Select the `Users` tab to configure the user attribute mapping. -Microsoft Entra ID Default User Attribute Mapping - The default Entra mapping includes around 20 user attributes. NetBird only consumes the attributes listed below. Removing the unused mappings keeps the provisioning logs clean and avoids mapping errors for attributes NetBird does not accept. @@ -152,8 +124,7 @@ Remove all attribute mappings except for the following: Click `Save` to apply the updated user attribute mapping configuration. -Microsoft Entra ID Updated User Attribute Mapping - +The Users attribute mapping reduced to the seven attributes NetBird consumes In the attribute mappings list, locate the `externalId` row and click `Edit`. @@ -161,19 +132,14 @@ Change the **Source attribute** from `mailNickname` to `objectId`. `externalId` is the stable identifier NetBird uses to link a SCIM user record to its Entra user. The Entra default of `mailNickname` is not guaranteed to be set on every user, is not guaranteed to be unique in the directory, and can change. `objectId` is the immutable Entra GUID and is the correct stable identifier. This ensures NetBird continues to recognize the same user across email address or display name changes. -Microsoft Entra ID Edit External ID Attribute +Editing the externalId mapping with the Source attribute set to objectId Click `Apply` to save the change, then click `Save` to apply the final user attribute mapping configuration. -Microsoft Entra ID Final User Attribute Mapping - ## Assign Users and Groups On the NetBird dashboard click the Continue → button. A new wizard screen will appear, offering step-by-step instructions for assigning users and groups. -Microsoft Entra ID Assign Users and Groups - - To enable SCIM synchronization of users and groups to NetBird, you need to assign them to the NetBird enterprise application. In the Azure portal, navigate to your NetBird enterprise application: @@ -183,18 +149,13 @@ In the Azure portal, navigate to your NetBird enterprise application: * Select the users and groups you want to synchronize to NetBird * Click `Assign` to save the assignments -Microsoft Entra ID Assign Users and Groups Interface - ## Start Provisioning On the NetBird dashboard click the Continue → button. A new wizard screen will appear, offering step-by-step instructions for starting the provisioning. -Microsoft Entra ID Run Provisioning - - After assigning users and groups, navigate back to the provisioning configuration, click `Overview`, then click the `Start provisioning` button to enable automatic synchronization. The first sync will begin shortly after provisioning is started. -Microsoft Entra ID Provisioning Started +The provisioning Overview page in Entra ID after clicking Start provisioning Once started, Microsoft Entra ID will automatically synchronize the assigned users and groups to NetBird. @@ -223,20 +184,17 @@ have been successfully synchronized by navigating to `Team > Users` in your NetB You can access some configuration settings inside the NetBird Dashboard. E.g. if you want to regenerate the authentication token or want to filter users and groups based on a specific prefix. Simply go to the Integrations page and click the settings icon of your integration. -Microsoft Entra ID SCIM Configuration Options +The enabled Entra ID SCIM integration on the NetBird Integrations page with its settings icon ### Regenerate Auth Token If your authentication token has expired or you need to update it, click **Regenerate Auth Token** in the configuration window to generate a new token. -Microsoft Entra ID Regenerate Authentication Token - - ### Groups to be synchronized By default, all groups assigned to the NetBird application in Entra will be synchronized. If you want to synchronize only assigned groups that start with a specific prefix, you can specify them in the filter. Keep in mind that the prefix matching is case-sensitive. -Microsoft Entra ID Group Prefix Filter +The group prefix filter in the NetBird SCIM integration settings Click `Continue` to proceed to the next step. @@ -244,4 +202,3 @@ Click `Continue` to proceed to the next step. By default, all users from the groups assigned to the NetBird application in Entra will be synchronized. If you want to further filter and synchronize only users from specific assigned groups, you can specify those group names in the filter. The group name matching is case-sensitive. -Microsoft Entra ID User Prefix Filter diff --git a/src/pages/manage/team/idp-sync/microsoft-entra-id-sync.mdx b/src/pages/manage/team/idp-sync/microsoft-entra-id-sync.mdx index 6d159e2e..80cb8e64 100644 --- a/src/pages/manage/team/idp-sync/microsoft-entra-id-sync.mdx +++ b/src/pages/manage/team/idp-sync/microsoft-entra-id-sync.mdx @@ -25,7 +25,7 @@ To get started, navigate to [Integrations](https://app.netbird.io/integrations) `Identity Provider` integration. Click the `Entra ID (Azure AD)` button. This action will trigger a pop-up window that will present you with a user-friendly wizard, guiding you through the synchronization process between NetBird and Azure AD. -![NetBird Get Started IdP](/docs-static/img/manage/team/idp-sync/microsoft-entra-id-sync/entra-req-permissions.png) +![The Entra ID (API) card on the NetBird Identity Provider Sync tab](/docs-static/img/manage/team/idp-sync/microsoft-entra-id-sync/entra-req-permissions.png) ## Prerequisites @@ -43,8 +43,6 @@ To check your permissions: * Expand the `Manage` tab and click on `Roles and administrators` in the left menu. * Look for your username and verify if you're assigned any of the above roles. -![EntraID Roles](/docs-static/img/manage/team/idp-sync/microsoft-entra-id-sync/roles.png) - If you don't have the required permissions, contact your Azure AD administrator to grant you the appropriate role before proceeding with the NetBird integration. ## Create and Configure a Microsoft Entra ID Application for NetBird Integration @@ -58,21 +56,13 @@ A new wizard screen will appear, offering step-by-step instructions for creating * Redirect Type * Redirect URI -![NetBird Create Application](/docs-static/img/manage/team/idp-sync/microsoft-entra-id-sync/connect-to-entra.png) +For convenience, click on [Azure Active Directory](https://portal.azure.com/#view/Microsoft_AAD_IAM/ActiveDirectoryMenuBlade/~/Overview) (step 1). That will open the Azure dashboard. Navigate to `App registrations` in the left menu and then click `+New registration`. -For convenience, click on [Azure Active Directory](https://portal.azure.com/#view/Microsoft_AAD_IAM/ActiveDirectoryMenuBlade/~/Overview) (step 1). That will open the Azure dashboard. Navigate to `App registrations` in the left menu and then click `+New registration` as indicated below: - -![EntraID App Registration](/docs-static/img/manage/team/idp-sync/microsoft-entra-id-sync/app-registration.png) - -Fill in the required information: - -![EntraID Register an App](/docs-static/img/manage/team/idp-sync/microsoft-entra-id-sync/register-app.png) - -After entering all required information, click the `Register` button at the bottom of the form to finalize the application registration process. +Fill in the registration form with the name, supported account type, and redirect URI shown in the NetBird wizard, using its copy buttons. Then click the `Register` button at the bottom of the form to finalize the application registration process. Upon successful registration, you'll be redirected to a confirmation screen similar to the following: -![EntraID App Registered](/docs-static/img/manage/team/idp-sync/microsoft-entra-id-sync/netbird-app-azure.png) +![The registered NetBird app overview in Entra ID showing the Application (client) ID and Directory (tenant) ID](/docs-static/img/manage/team/idp-sync/microsoft-entra-id-sync/netbird-app-azure.png) Copy and securely store the generated `Application (client) ID` and `Directory (tenant) ID` as you will need them shortly. @@ -80,23 +70,13 @@ Copy and securely store the generated `Application (client) ID` and `Directory ( On the NetBird dashboard click the `Continue →` button. A new wizard screen will appear, this time, offering step-by-step instructions for setting up API permissions. -![NetBird Add API Permissions](/docs-static/img/manage/team/idp-sync/microsoft-entra-id-sync/connect-with-entra.png) - -Back to Azure, in the `App registrations` screen, click on `Manage` in the left menu to expand it and then click on `API permissions`: - -![EntraID API Permissions](/docs-static/img/manage/team/idp-sync/microsoft-entra-id-sync/api-permissions-menu.png) +Back to Azure, in the `App registrations` screen, click on `Manage` in the left menu to expand it and then click on `API permissions`. Look for the `+ Add a permission` button, located near the top of the permissions list and click on it. -![EntraID API Permissions Screen](/docs-static/img/manage/team/idp-sync/microsoft-entra-id-sync/api-permissions-screen.png) - A new pop-up window will appear, asking you to select an API. Click on `Microsoft Graph`. -![EntraID Microsoft Graph](/docs-static/img/manage/team/idp-sync/microsoft-entra-id-sync/request-api-permissions.png) - -On the next screen, click on the `Application permissions` button, which will let you select the appropriate permissions for NetBird to function correctly with your Microsoft Entra ID environment. - -![EntraID Request API Permissions](/docs-static/img/manage/team/idp-sync/microsoft-entra-id-sync/application-permissions-graph.png) +On the next screen, click on the `Application permissions` button (not `Delegated permissions`), which will let you select the appropriate permissions for NetBird to function correctly with your Microsoft Entra ID environment. To assign user permissions: @@ -104,39 +84,31 @@ To assign user permissions: * In the search results, click on the `User` tab to expand it and view the available permissions. * Click on the checkbox to select and enable the `User.Read.All` permission. -![EntraID UserReadAll](/docs-static/img/manage/team/idp-sync/microsoft-entra-id-sync/request-api-perms.png) +![The Microsoft Graph application permissions picker with User.Read.All selected](/docs-static/img/manage/team/idp-sync/microsoft-entra-id-sync/request-api-perms.png) The `User.Read.All` permission allows NetBird to read the full set of profile properties, group memberships, and reports of the signed-in user and other users in your organization. -Next, repeat the procedure. This time, search for `Group.Read.All` and click on the checkbox to enable it as shown below: - -![EntraID GroupReadAll](/docs-static/img/manage/team/idp-sync/microsoft-entra-id-sync/select-group-read-all.png) +Next, repeat the procedure. This time, search for `Group.Read.All`, expand the `Group` tab, and enable it the same way. Once done, click the `Add permissions` button. You will see a few warnings: -![EntraID API Permissions Warnings](/docs-static/img/manage/team/idp-sync/microsoft-entra-id-sync/needed-netbird-api-perms.png) +![The API permissions list with User.Read.All and Group.Read.All showing a Not granted warning next to the Grant admin consent button](/docs-static/img/manage/team/idp-sync/microsoft-entra-id-sync/needed-netbird-api-perms.png) Locate the `Grant admin consent for [Your Organization Name]` button (you’ll find it next to `+Add a permission` button). Click on it to grant the required permissions. A confirmation dialog will appear, asking you to verify this action. Review the permissions listed in the dialog and click `Yes` to confirm. Wait for the process to complete, this may take a few seconds. -Once finished, the status of the permissions should change to `Granted for [Your Organization Name]`. Verify that all selected permissions now show a green checkmark, indicating they've been successfully granted: - -![EntraID API Permissions Granted](/docs-static/img/manage/team/idp-sync/microsoft-entra-id-sync/netbird-api-perms.png) +Once finished, the status of the permissions should change to `Granted for [Your Organization Name]`. Verify that all selected permissions now show a green checkmark, indicating they've been successfully granted. ## Create a Client Secret for Secure NetBird-Entra ID Authentication Back to the NetBird dashboard, click the `Continue →` button. A new wizard screen will appear, showing instructions for generating a client secret in Entra ID. -![NetBird Generate Client Secret](/docs-static/img/manage/team/idp-sync/microsoft-entra-id-sync/copy-client-secret.png) - -On Azure, click on the `Certificates & secrets` button in the left menu to open the management page. Click on `+New client secret` as shown below. Choose an expiration time that suits your security needs and click the `Add` button. - -![EntraID Add a Client Secret](/docs-static/img/manage/team/idp-sync/microsoft-entra-id-sync/add-client-secret.png) +On Azure, click on the `Certificates & secrets` button in the left menu to open the management page. Click on `+New client secret`. Choose an expiration time that suits your security needs and click the `Add` button. A new client secret will be generated and displayed on the screen. Copy and securely store the `Value` field immediately, as you will needed in the next step. -![EntraID Client Secret Value](/docs-static/img/manage/team/idp-sync/microsoft-entra-id-sync/certs-secrets.png) +![The new client secret in Entra ID with the Value column to copy](/docs-static/img/manage/team/idp-sync/microsoft-entra-id-sync/certs-secrets.png) ## Enter Application ID and Directory ID in NetBird @@ -144,7 +116,7 @@ Paste the secret `Value` from the previous step into NetBird and click the `Cont Paste the values and click the `Continue →` button. -![NetBird Application ID and Directory](/docs-static/img/manage/team/idp-sync/microsoft-entra-id-sync/entra-copy-ids.png) +![The NetBird wizard step asking for the Application (client) ID and Directory (tenant) ID](/docs-static/img/manage/team/idp-sync/microsoft-entra-id-sync/entra-copy-ids.png) ## Choose Groups to Synchronize from Entra ID At this stage, NetBird is set to synchronize all groups from your Microsoft Entra ID by default. You have two options: @@ -152,7 +124,7 @@ At this stage, NetBird is set to synchronize all groups from your Microsoft Entr * If you want to synchronize all groups, simply click the `Continue →` button. * To synchronize only specific groups, click the `+ Add group filter` button, which will open a new panel where you can set criteria to include or exclude groups. -![NetBird Group Sync](/docs-static/img/manage/team/idp-sync/microsoft-entra-id-sync/add-group-filter.png) +![The NetBird group synchronization step with the Add group filter button](/docs-static/img/manage/team/idp-sync/microsoft-entra-id-sync/add-group-filter.png) ## Choose Users to Synchronize from Entra ID After configuring group synchronization, you'll now set up user synchronization. Similar than before, NetBird is configured to synchronize all users from your Microsoft Entra ID by default. @@ -164,8 +136,6 @@ After configuring group synchronization, you'll now set up user synchronization. You can modify these synchronization settings later if necessary. -![NetBird Users Sync](/docs-static/img/manage/team/idp-sync/microsoft-entra-id-sync/user-group-filter.png) - After configuring user and group synchronization, the setup wizard will finalize the process and you'll automatically return to the main Identity Provider screen. On this screen, you'll see two key indicators of successful integration: @@ -183,15 +153,13 @@ These indicators confirm that: You can manually trigger a sync or adjust settings by clicking on the Microsoft Entra ID section in the Identity Provider screen -![NetBird Identity Provider Synchronized](/docs-static/img/manage/team/idp-sync/microsoft-entra-id-sync/idp-synced.png) +![The Identity Provider Sync tab with the Entra ID integration enabled and marked as synced](/docs-static/img/manage/team/idp-sync/microsoft-entra-id-sync/idp-synced.png) ## Verify the Integration To verify the synchronization, navigate to `Teams > Users` in the left menu. You should see all the users and groups from your Microsoft Entra ID environment listed in the NetBird dashboard. -![NetBird Checking Integration](/docs-static/img/manage/team/idp-sync/microsoft-entra-id-sync/qlNlfgV.png) - You can now proceed to configure [access control policies](/manage/access-control/manage-network-access#creating-policies) using the synchronized groups to allow or deny access to the synchronized users.