Configure SAML single sign-on with Azure AD

1. Log in to your Microsoft Azure portal.
2. In the Azure services section, click Enterprise applications.
3. Click New application.
4. Click Create your own application.
5. Type a name for the sensor in the name field. This name appears for your users on the Azure My Apps page.
6. Select Integrate any other application you don't find in the gallery.
7. Click Create.

You must assign users or groups to the new application before users can log in to the ExtraHop system.

1. In the left pane, click Users and groups.
2. Click Add user/group.
3. Add your privileged users or groups and then click Assign.

1. In the left pane, click Single sign-on.
2. Click SAML.
   
3. In the Basic SAML Configuration section, click Edit.
4. Type or paste the Entity ID from the ExtraHop system into the Identifier (Entity ID) field and select the Default checkbox. You can delete the existing http://adapplicationregistry.onmicrosoft.com/customappsso/primary entry.
5. Type or paste the ACS URL from the ExtraHop system into the Reply URL (Assertion Consumer Service URL) field.
6. Click Save.
7. In the Attributes & Claims section, click Edit.
8. In the required claim section, click Unique User Identifier (Name ID).
9. Click Choose name identifier format.
10. From the drop-down list, select Persistent.
11. Click Save.
12. In the additional claims section, delete the user.mail claim from the list and replace the default claim names with the following claim names:

    Claim name	Value
    urn:oid:2.5.4.4	user.surname
    urn:oid:2.5.4.42	user.givenname
    urn:oid:0.9.2342.19200300.100.1.3	user.userprincipalname

13. Click Add new claim. This claim enables users to access the ExtraHop system with the assigned privileges.
    1. Type writelevel in the Name field. You can type any name you want, but it must match the name you will configure on the ExtraHop system.
    2. Click Claim conditions.

       Important:

       The order in which you add the conditions is important. If a user matches multiple claim conditions, they are assigned the privileges that match last. For example, if you add unlimited as the first value and read-only as the second value and the user matches both claim conditions, the user is assigned the read-only privilege.

    3. From the User type drop-down list, select Any.
    4. Under Scoped Groups, click Select groups, click the name of the group you want to add, and then click Select.
    5. Under Source, select Attribute.
    6. In the Value field, type unlimited or a name of your choosing that defines the privilege for this group. Repeat this step for each group that you want to assign unique privileges to. In the example below, we created a claim condition for two groups. One group is assigned read-only privileges and the other group is assigned unlimited privileges.
       
    7. Click Save.
14. Return to the Attributes & Claims page and click Add new claim. This claim assigns access to packets and session keys.
    1. Type packetslevel in the Name field. You can type any name you want, but it must match the name you will configure on the ExtraHop system.
    2. Click Claim conditions.
    3. From the User type drop-down list, select Any.
    4. Under Scoped Groups, click Select groups, click the name of the group you want to add, and then click Select.
    5. Under Source, select Attribute.
    6. In the Value field, type justpackets or a name of your choosing that defines the privilege for this group.
    7. Click Save.
15. Return to the Attributes & Claims page and click Add new claim. This claim assigns access to detections.
    1. Type detectionslevel in the Name field. You can type any name you want, but it must match the name you will configure on the ExtraHop system.
    2. Click Claim conditions.
    3. From the User type drop-down list, select Any.
    4. Under Scoped Groups, click Select groups, click the name of the group you want to add, and then click Select.
    5. Under Source, select Attribute.
    6. In the Value field, type full or a name of your choosing that defines the privilege for this group.
    7. Click Save.