This page describes how to configure user provisioning for Single Sign-On (SSO) customers in MyBusiness.

Background

The SSO and User Provisioning features in MyBusiness allows the customer to fully control  

  • Who has access to the customer’s associated Companies in MyBusiness
  • How the customer users can access MyBusiness through Conditional Access (CA) policies in Entra ID, i.e. enforce Multi Factor Authentication when authenticating to the application.

Once SSO is activated, users provisioned by Entra ID to MyBusiness will have their current sign in method deactivated and will only be able to login through their Microsoft Entra ID account.

About Single Sign-On (SSO)

SSO is an authentication scheme that allows a user to log in with a single ID to several independent software systems. For the purposes of this document, SSO refers to using Microsoft Entra ID to sign in to MyBusiness.

About System for Cross-domain Identity Management (SCIM)

The SCIM Protocol is a protocol for provisioning and managing identity data on the web. Microsoft Entra ID supports using SCIM to provision users in third party systems like MyBusiness.

More information: SCIM: System for Cross-domain Identity Management

Prerequisites

Before starting this guide, the following prerequisites must be met:

  • Usage of SSO and User Provisioning must be agreed with Aspia and enabled to on the Customer’s Companies in MyBusiness.
  • A user account with Application Administrator role in the Microsoft Entra ID tenant that is to be connected to MyBusiness is required for this process.
  • One group per Company in MyBusiness must be created in Entra ID. Basic user access to a company is controlled by the associated group in the customer Entra ID. The customer is responsible for maintaining membership in the groups. Dynamic groups are supported and may be used. Nested groups cannot be used. See How Application Provisioning works in Microsoft Entra ID for more information.

MyBusiness User Provisioning administration

  1. Click the link in the invitation email.
  2. Sign in using an account with Application Administrator role in the tenant that is to be connected to MyBusiness. This account must have the same email domain as address that the invitation email was sent to. A consent screen for the MyBusiness app will be shown. Check the Consent on behalf of your organization checkbox. Click Accept. This will add the Microsoft Entra ID Enterprise Application that is used to sign in to MyBusiness to the tenant and is required for the Single Sign In to work. 
  3. Ensure that the company name and tenant directory ID are correct, and then click Connect Company.
  4. (Optional) If desired, change the email for notifications by clicking the edit icon. Notifications about upcoming token expiration will be sent to this address.
  5. Keep this page open

Microsoft Entra ID configuration

  1. Sign in to the Microsoft Entra ID portal.
  2. Select Applications, then select Enterprise applications in the left pane.
  3. Select the MyBusiness Enterprise Application.
  4. Select Users and groups in the left pane. Add the groups that represent a company by selecting + Add user/group. The Add Assignment screen is shown. Under Users and groups click None Selected. Select the groups and click the Select button.
  5. Select + New application, then select + Create your own application. In the new application panel, write a name (for example: “MyBusiness Provisioning”) and then select Integrate any other application you don't find in the gallery (Non-gallery). Create the application.
  6. Select Properties. Set Enabled for users to sign-in? and Visible to users? to No.
  7. Select Users and groups in the left pane. Add the groups that represent a company by selecting + Add user/group. The Add Assignment screen is shown. Under Users and groups click None Selected. Select the groups and click the Select button. In the step Configure MyBusiness companies these groups will be assigned to companies in MyBusiness.
  8. Select Provisioning in the left pane and then Get started.
  9. Select Automatic in the Provisioning Mode dropdown.
  10. On the MyBusiness User provisioning administration page, click Generate secret token. A dialog box will open. Click the Copy button to copy the token to clipboard. Paste the token into the Secret Token field of the Admin Credentials section.
  11. Copy the Tenant-URL from the MyBusiness User Provisioning administration page and paste it into the Tenant URL field.
  12. Test the connection. If the connection is successful, save the current settings.

After saving, the Mappings section will appear.

Attribute mapping

Some of these mappings may have been automatically created. Note: in case an unwanted mapping is automatically created and the Delete button is not enabled, select Show advanced options and then Edit attribute list for customappsso. Find the attribute in the list and deselect Required? and then click Save.

Note: Depending on the configuration of the specific tenant, the source attribute may be different than the one listed in Group mapping or User mapping. These are default values. If custom mapping is necessary, see Custom attribute mapping.

Group mappings

Click Provision Microsoft Entra ID Groups.

Update the mappings to match the ones in the table in Direct mappings. Delete any other predefined mappings that are not listed.

To add a new mapping: Under Attribute Mappings, select Add New Mapping to map the attributes in the following table. For all mappings, leave Default value if null (optional) as blank and Apply this mapping as Always.

Direct mappings

For all the following mappings select Direct in the Mapping Type dropdown.

Source attribute

Target attribute

Match objects using this attribute

Matching precedence

displayName

displayName

Yes

1

objectId

externalId

No

 

members

members

No

 

 

Select Save to commit any changes.

User mapping

Click Provision Microsoft Entra ID Users.

Update the mappings to match the ones in the tables in Direct mappings and Expression mappings. Delete any other predefined mappings that are not listed.

To add a new mapping: Under Attribute Mappings, select Add New Mapping to map the attributes in the following tables. For all mappings, leave Default value if null (optional) as blank and Apply this mapping as Always.

Direct mappings

For all the following mappings select Direct in the Mapping Type dropdown.

Source attribute

Target attribute

Match objects using this attribute

Matching precedence

objectId

externalId

Yes

1

mail

emails[type eq “work”].value

No

 

preferredLanguage

preferredLanguage

No

 

givenName

name.givenName

No

 

surname

name.familyName

No

 

telephoneNumber

phoneNumbers[type eq “work”].value

No

 

mobile

phoneNumbers[type eq “mobile”].value

No

 

 

Expression mappings

For all the following mappings select Expression in the Mapping Type dropdown.

Expression

Target attribute

Match objects using this attribute

Switch([IsSoftDeleted], , "False", "True", "True", "False")

active

No

 

Select Save to commit any changes.

Start the provisioning

This step will enable provisioning of users and groups from Microsoft Entra ID to MyBusiness. Note that enabling the Microsoft Entra ID provisioning will not enable the Single Sign-on experience for the users in MyBusiness. Current users will be able to sign-in with their current sign-in method until completion of step Starting the Single Sign-On transition.

  1. Under Settings, ensure that the Scope dropdown is set to Sync only assigned users and groups.
  2. Set Provisioning Status to On.
  3. Select Save.
  4. Select Users and groups in the left pane. Ensure that the groups that represent a company are added. If they are not, add them by selecting + Add user/group. The Add Assignment screen is shown. Under Users and groups click None Selected. Select the groups and click the Select button.
  5. Select Assign.

Configure MyBusiness companies

Microsoft Entra ID provisioning must complete before this step can be started. It may take up to 40 minutes to start. If needed, the Provision on demand feature can be used to immediately start provisioning for a user or group.

  1. Go back to the MyBusiness User Provisioning administration portal
  2. Click on the Connect user groups tab
  3. For each of the groups in Waiting to be connected select which company in MyBusiness that group represents by selecting it with the Sync to company dropdown menu. If there are groups that do not represent a company, select Exclude from sync.
  4. For each group connection, press Confirm. If the connection is correct, press Connect.

Starting the Single Sign-on transition

Warning: This is the last step of the configuration. Once the Single Sign-On has been enabled all users lose the ability to sign in with their current sign in method. Ensure that the users have been informed about the change.

Go to the Enable SSO tab. In Enable SSO for end users in MyBusiness, select a start date for the Single Sign-On by clicking the Schedule SSO start date button and selecting a date. The SSO will be enabled at midnight leading to the selected date (i.e., all sign ins on the selected date will be using the SSO functionality). If the current date is selected, then the Single Sign-On will be activated immediately. Select Schedule start to select when the Single Sign-On will be activated.

 

Appendices

These sections are optional but may be useful for special situations.

Custom attribute mapping

If group and user attributes does not match the default values in the Attribute mapping section, then custom attribute mapping will need to be configured. See Customize user provisioning attribute-mappings.

The following sections describes the provisioning attributes as used by MyBusiness.

Group attributes

Attribute

MyBusiness property

Required

Notes

externalId

Unique identifier

Yes

 

displayName

Name

Yes

Used to identify the group in Configure MyBusiness Companies

members

Users to be added to a specific company

Yes

 

 

User attributes

Attribute

MyBusiness property

Required

Notes

externalId

Unique identifier

Yes

 

emails[type eq “work”].value

Email address

Yes

Used in initial matching with existing users in MyBusiness

preferredLanguage

The preferred language

No

Used to set initial language for a user in MyBusiness. Only used when creating a new user. Existing users are not updated.

Not currently used.

name.givenName

Given name

Yes

 

name.familyName

Family name

Yes

 

phoneNumbers[type eq “work”].value

Work phone number

No

 

phoneNumbers[type eq “mobile”].value

Mobile phone number

No

 

active

Whether the user is active. Either "True" or “False”.

Yes

Inactive users (active = “False”) will still exist in MyBusiness and be connected to companies but will not be able to sign in.

 

Deprovisioning users

See Microsoft Learn: Deprovisioning for more information.

The following sections describe how MyBusiness handles provisioning events that deprovision users.

If a user is unassigned from a group representing a company

The user will lose access to the company connected to that group. If the user is a member of a group connected to another company, the user will still be able to sign in and access that company. If the user is not a member of any groups, the user will no longer be able to sign in to MyBusiness.

If a user is soft-deleted in Microsoft Entra ID

The user will be prevented from signing in but is not otherwise changed.

If a user is permanently deleted / removed from the recycle bin in Microsoft Entra ID

The user will be removed from all companies and will not be able to sign in.