Skip Navigation LinksALVAO 11.1ALVAO Asset ManagementImplementation of the system in the organisationUser managementUser authentication in applicationsAzure Active Directory authentication Skip Navigation Links.

Azure Active Directory authentication

Only users from a single Azure Active Directory (AAD) tenant and external users (guests) of that tenant can log in to Alvao. If you enable AAD authentication in Alvao, no other users outside of AAD will be able to log in to Alvao.

If you are switching from Active Directory (AD) authentication to AAD authentication, pay attention to the options for limiting the set of users and groups imported from AAD that differ from AD, see Scope below. Before setting up user import from AAD, first disable the existing user import from AD (ImportAD).

Import users from AAD (user provisioning)

See Tutorial: Configure ALVAO for automatic user provisioning.

Setting up AAD authentication

  1. In the Microsoft Azure portal, navigate to Azure Active Directory - App registrations and select the previously created ALVAO app.
  2. On the Overview page, set Redirect URIs to https://<WebApp>/Account/LoginMicrosoftEndpoint.
  3. On the Authentication page, check Access tokens (used for implicit flows) and save the settings.
  4. On the API permissions page:
    1. Click Add a permission, go to APIs my organization uses tab and select the first created ALVAO app.
    2. Check user_impersonation permission and click Add permissions.
    3. Grant admin consent for previously added permission
    4. Click Add a permission, select Microsoft Graph, select Delegated permissions, check Presence.Read.All and click Add permissions. This allows to enable Show users presence option.
  5. Make a note of the values from the application registration that you will need later:
    1. Client ID
    2. Directory (tenant) ID
    3. Client credentials - Client secrets - New client secret - Client Secret
  6. In the following SQL script, insert the Directory (tenant) ID and Client ID values obtained above and run the script on your Alvao database.
    INSERT INTO AzureAdTenant (AzureTenantId) VALUES (N'<Directory (tenant) ID>')
    EXEC spUpdateInsertProperty N'AzureApplicationId', N'<Client ID>'
  7. On the server in IIS Manager:
    1. In Alvao (WebApp), change the authentication method to anonymous and forms.
      In the forms login details, specify
      ~/Account/LoginMicrosoft address.
    2. In AssetWebService (AM WS), set the authentication method to anonymous.
    3. In AlvaoRestApi, set the authentication method to anonymous.
    4. In AlvaoCustomAppsWebService (CA WS), set the authentication method to anonymous.
  8. In the following configuration files, fill the AAD_ClientSecret setting with the Client Secret value obtained above:
    1. WebApp – web.config file
    2. AssetWebService – web.config
    3. AlvaoService – appsettings.json
    4. AlvaoRestApi – web.config
    5. AlvaoCustomAppsWebService – web.config

For more information on registering apps in AAD, see Register your app with the Azure AD v2.0 endpoint - Microsoft Graph | Microsoft Docs.

Import users into object tree

If ALVAO Asset Management is activated, users are also automatically imported into the object tree in the Read Objects from Active Directory folder, from where they are moved to the correct location in the tree. The same set of users is imported into the object tree as in WebApp - Administration - Users.

When removing a user from the AAD, the user is automatically blocked in the object tree (see the Account is blocked property) but not removed. Once in a while, we recommend checking the tree for blocked users and removing them if necessary.

If you activate Asset Management after the fact, when you have already imported users into Report, the existing users are not automatically created in the tree. You can additionally create them with a prepared SQL script that creates all users from Report that do not already exist in the object tree. The property values are set according to the default attribute mapping. Existing users will remain unchanged.

You can also manually create a small number of users in the object tree and set their property values according to the information in the Message (especially the User Name property, which is key).

You can disable the import of users into the object tree with this SQL script if needed:
EXEC spUpdateInsertProperty 'AM.Scim.ImportUsers', NULL, 0;

After executing the script, we recommend recycling the Alvao application pool on the IIS server so that the import shutdown takes effect immediately.

You can turn the import back on with the script:

EXEC spUpdateInsertProperty 'AM.Scim.ImportUsers', NULL, 1;


Importing (provisioning) users from AAD to Alvao uses the SCIM interface, through which Alvao automatically:

  • Create, edit and delete users in WebApp - Administration - Users
  • Create, edit, and delete groups in WebApp - Administration - Groups
  • Updates user and group memberships in groups
  • Created and edited by users in the object tree in ALVAO Asset Management

AAD sends information about changes to Alvao via the SCIM interface on an ongoing basis. Most changes are reflected in Alvao within 40 minutes, some, such as locking out a user, even sooner. This interval is entirely under the control of AAD and cannot be changed.

The SCIM interface is part of the ALVAO REST API, which must be installed on a server accessible from the Internet (or Azure).


Did not find what you were looking for? Ask our technical support team.