Using the 8x8 Azure (Entra)AD App

Using the 8x8 Azure (Entra)AD App

Objective

Configure your organization to use the 8x8 Azure App.

Applies To

  • 8x8 Admin Console
  • Microsoft Azure (Entra) Active Directory (Azure AD)
  • SSO

If you want to configure Single-Sign-On for Azure AD users, see Azure (Entra) AD: 8x8 Single Sign-On (SSO) and User Provisioning (SCIM) Configuration. 

Procedure

In the following sections, user attributes are described in bold to indicate the name shown in the Azure AD portal and in italics to indicate the equivalent name seen in PowerShell, Attribute mappings, and the Graph API. For example the surname attribute is labeled Last name in the Azure AD portal.

Create a User

To create a user in 8x8 assign them to the 8x8 App. They appear in Admin Console when the next Azure AD sync cycle runs.

8x8 recommends that each AD user to be assigned to 8x8 has their Office (physicalDeliveryOfficeName) attribute set to the name of the 8x8 Site they belong to. You can copy the site name from Admin Console.

Azure AD provisioning activity typically runs on a 40 minute cycle. Allow one hour between assigning a user to the 8x8 app before the user appears in Admin Console.

Any unlicensed 8x8 users are visible along with their contact number to the licensed users in their corporate directory. If you do not intend to assign an 8x8 license to the created user then no further action is required.

To configure a user with an X Series service you must sign into Admin Console and assign an X Series license to the user. Then edit the user individually, or in bulk, using the Edit feature.

User Changes

Whenever an Azure AD user that has been assigned to the 8x8 app is updated, Azure AD pushes any changes to 8x8 as required automatically.

Deactivate and Activate a User

If a user has their Block sign in (isSoftDeleted) attribute set to Yes in Azure AD, they are deactivated in 8x8 and are no longer able to make or receive phone calls (except Emergency calls). They are also not able to log in to any applications. Existing login sessions expire within half an hour. The user is not deleted and they retain their X Series license and settings.

When you unblock a sign-in for a user in Azure AD it also re-activates that user in 8x8.

Delete a User

Deleting a user in Azure AD is a two-stage process:

  1. Initial deletion is a soft-delete which moves the user to the “Deleted users” blade in Azure AD. This causes the user to be deactivated in 8x8 (This is similar to blocking sign-in from Azure AD).
  2. When a user is fully deleted from Azure AD, nothing further happens to the 8x8 user. If the user had not already been deactivated, then the user is deactivated at this point, but not deleted. It is not possible to delete an 8x8 user via the integration, you need to do this individually in Admin Console.

Administration Restrictions in 8x8 Admin Console

When a user is created in 8x8 via the Azure AD app, 8x8 considers the user to be owned by Azure AD. This activates some administration restrictions in Admin Console, specifically preventing any changes to the key user attributes that are mastered in AD:

  • Username
  • First name
  • Last name
  • Email address
  • Deactivation and Activation

These restrictions are there to ensure your 8x8 users do not become out of sync with Azure AD.

Unassign Users from the 8x8 App

When a user is unassigned from the 8x8 app in Azure AD, they are deactivated in the 8x8 app but not deleted.

Link an Existing 8x8 User to Azure AD

If you create a user in 8x8 Admin Console directly, and there is an equivalent user in Azure AD, then assigning the Azure AD user to the 8x8 app in Azure AD is enough to link them providing the following criteria are met:

  • Their Username in Admin Console matches their User name (userPrincipalName) in AD.
  • Upon initial assignment to the 8x8 app, Azure AD checks if the user’s attributes are in sync and updates the 8x8 user accordingly. At this point, Admin Console considers the user to be owned by Azure AD and prevents any changes to those attributes that are mapped from Azure AD. This restriction avoids data inconsistency by enforcing that changes are only made to the master data source of the user.

Disable the Integration

If you want to disable the integration temporarily, there is setting for this in the application’s Provisioning blade in Azure AD.

User Provisioning Configuration

Site 

Each 8x8 user created through the 8x8 Azure AD app must be associated with a Site before they can be assigned an X Series license. To do this, you need to ensure that the Office (physicalDeliveryOfficeName) attribute contains the exact name of one of your Sites from Admin Console .

In the default installation, Site is set from the Office (physicalDeliveryOfficeName) attribute in AD, but you can change this in app mappings to suit your AD environment if required.

If your 8x8 installation has only one Site, you can opt to hard-code its name in the 8x8 application's attribute mappings using a “Constant” mapping type. This avoids the need to set the Office (physicalDeliveryOfficeName) attribute for each user.

Note: A user's site cannot be modified once set. If you change the name of any of your Sites in 8x8 Admin Console, the synchronization of users is broken until their Office (physicalDeliveryOfficeName) attribute matches in AD.

Contact Numbers

In the default installation, the AD user’s Office phone (telephoneNumber) and Mobile phone (mobile) attributes are passed to 8x8 as contact numbers and will be displayed to other 8x8 users in the following places:

  • Company directory of 8x8 Work Desktop and Mobile
  • Contact Center directory
  • Switchboard Pro directory

Note: Contact numbers are not displayed in the directory of physical desk phones.

User Provisioning Attribute Mappings

Default Attribute Mappings 

This table shows the default set of attribute mappings for user provisioning.

Azure AD Attribute

Azure AD Portal Name

System for Cross-domain
Identity Management (SCIM) Attribute

8x8 Admin Console Name

userPrincipalName

User name

userName

Username

objectID

Object ID

externalId

Not visible in Admin Console

mail

Not visible in AD portal

emails[type eq "work"].value

Email

Not([IsSoftDeleted])

Block sign in

active

User is greyed out

givenName

First name

name.givenName

First Name

surname

Last name

name.familyName

Last Name

jobTitle

Job title

title

Job title

department

Department

urn:ietf:params:scim:schemas:extension:enterprise:2.0:User:department

Department

mobile

Mobile phone

phoneNumbers[type eq "mobile"].value

Personal contact number

telephoneNumber

Office phone

phoneNumbers[type eq "work"].value

Not visible in Admin Console

physicalDeliveryOfficeName

Office

urn:8x8:scim:schemas:extension:8x8user:2.0:User:site

Site

Advanced Attribute Mappings

This table displays additional attributes that are available but not mapped by default. Instructions for configuration of advanced mappings is outside the scope of this guide.

System for Cross-domain
Identity Management (SCIM) Attribute

Suggested Azure AD attribute

Notes

locale

PreferredLanguage

PreferredLanguage may be set through the AzureAD powershell module

timezone

User extension attribute