question

Lonnie-5070 avatar image
0 Votes"
Lonnie-5070 asked ·

Federation Setup

Hi All,

Clearly a newbie at this, required to setup federated identity for a Bentley systems application.
At present we simply sync on-premise AD to Azure for the purpose of activating our Office ProPlus Subscription.

The instruction from Bentley is to go to Enterprise applications>Categories>Add an application and "add" a "non-gallery" application. However when I attempt to do this Azure console says "require an upgrade to premium".

1) Can anyone tell me what level, or what is the minimum level of AD subscription that will allow me to add this non-gallery application?

2) In the referenced comparison chart can anybody tell me exactly which feature refers to what I am trying to do? https://azure.microsoft.com/en-us/pricing/details/active-directory/
I thought it was "Federated Authentication (ADFS or 3rd party IDP)" which suggests I should be covered for?

3) Is the ProPlus Subscription not included as an "Office 365 App" and hence does not have the same level AD as E3 or E5?

4) If point 3 were the case do would E3 or E5 include or do I need the separate AD subscription.

5) If I need to upgrade to a P1 or P2 subscription, does this mean I have to purchase 1 x subscription for every user in my AD? As this becomes many thousands of dollars per year.

I have attempted to ask this of Azure providers and no one has been able to advise, however I am trying to get an answer before i commit to many thousands of dollars.

Thanks in advance

azure-ad-connect
· 1
10 |1000 characters needed characters left characters exceeded

Up to 10 attachments (including images) can be used with a maximum of 3.0 MiB each and 30.0 MiB total.

@Lonnie-5070, Just wanted to check if the above response helped in answering your query or not. Do update us if there are any more queries around this so that we can help you further.


If the response above has helped you, it would be great if you can mark the response as answer so that it helps others too.


0 Votes 0 ·
soumi-MSFT avatar image
0 Votes"
soumi-MSFT answered ·

@Lonnie-5070, Thank you for reaching out. Based on teh question you posted I will try to answer those below:

1) Can anyone tell me what level, or what is the minimum level of AD subscription that will allow me to add this non-gallery application?

Ans: Inorder to register a non-gallery app in your AAD tenant, you would need to have either a AAD-P1 or AAD-P2 license.

2) In the referenced comparison chart can anybody tell me exactly which feature refers to what I am trying to do? https://azure.microsoft.com/en-us/pricing/details/active-directory/ I thought it was "Federated Authentication (ADFS or 3rd party IDP)" which suggests I should be covered for?

Ans: Federation authentication is just the authentication mode for the on-prem users to get authenticated to AAD and then access the intended applications. A non-gallery is an app that is registered in AAD and it is also protected by AAD. When I say protected by AAD, I mean that until the user authenticates to AAD, he/she wont be able to access that non-gallery app.

3) Is the ProPlus Subscription not included as an "Office 365 App" and hence does not have the same level AD as E3 or E5?

Ans: O365 ProPlus is not same as O365 E3 or O365 E5 license. Also having O365 E3 license or O365 E5 license doesnt get you to use the AAD premium features. For AAD premium features, you would need to have either an AAD-P1/AAD-P2 or EMS licenses.

4) If point 3 were the case do would E3 or E5 include or do I need the separate AD subscription.

Ans: Yes.

5) If I need to upgrade to a P1 or P2 subscription, does this mean I have to purchase 1 x subscription for every user in my AD? As this becomes many thousands of dollars per year.

Ans: Ideally the AAD-P1/AAD-P2 license would only be assigned to users who are going to maintain the AAD, like Global Administrators, Application Administrator etc. Hence its always a handful of people like admins who would need this license.

Azure AD Premium P1 - is an enterprise level edition which provides identity management for on-premise users, remote users and hybrid users accessing applications both locally and over the cloud. This edition includes support for self-service identity, access management, administration of dynamic groups including self-service group management, as well as Microsoft Identity Manager which is a suite of on-premise identity and access management tools.

Azure AD Premium P2 - is an edition includes all of the features of Azure AD Premium P1 with the addition of Identity Protection and Privileged Identity Management (PIM). Identity Protection provided management of conditional access to apps and critical data. PIM enhances management of privileged accounts tied to administrative access to resources.

Hope this helps.


Please take a moment to "Mark as Answer" and/or "Vote as Helpful" wherever applicable. Thanks!















·
10 |1000 characters needed characters left characters exceeded

Up to 10 attachments (including images) can be used with a maximum of 3.0 MiB each and 30.0 MiB total.

Lonnie-5070 avatar image
0 Votes"
Lonnie-5070 answered ·

Hi Soumi,

Thank you for your response, much appreciated.

Can you just confirm from the license agreement perspective to be covered legally I only need to have P1 subscriptions for the administrators and not each and every user who might authenticate in the AD or with the federation?

Thanks in advance

· 2 ·
10 |1000 characters needed characters left characters exceeded

Up to 10 attachments (including images) can be used with a maximum of 3.0 MiB each and 30.0 MiB total.

@Lonnie-5070, Yes you are correct. P1 license needs to be available for all the users/admins utilizing that feature. For example, there are 10 users in an org and among that 3 are application administrators (responsible for adding apps/registering apps in AAD). Now from license standpoint, all these 3 application administrators should have P1 license assigned to them individually.

Hope this helps.

0 Votes 0 ·

@Lonnie-5070, If the above responses helped you, it would be great if you can mark them as answer so that we can close the discussion. You marking the responses as answers would also help others facing similar issues.

0 Votes 0 ·