# Azure Applications

## Introduction

Lucy offers the capability to integrate with Azure for importing users, distribute awareness training via SMTP, and implement the Microsoft Graph API XML reporting plugin. Administrators can synchronize several Azure applications, organized by client, to ensure applications are accessible solely to administrative users associated with the respective client.

{% hint style="info" %}
Navigate to Settings > Common System Settings > Azure Applications
{% endhint %}

## Creating an application in Azure

See here for a guide on setting up an application in Entra ID:\
<https://learn.microsoft.com/en-us/entra/identity-platform/quickstart-register-app>

### Redirect URIs

Lucy can sync with Entra ID for a few different purposes.\
Depending on your use-case you will need to configure the correct URIs:

<table><thead><tr><th width="218.44439697265625">Use Case</th><th>URIs</th></tr></thead><tbody><tr><td><a href="/pages/teHucLmXFyjOYNlMcb54#oauth-2.0-azure">SSO via OAuth</a><br><a href="/pages/waxFCi8OpoVHcN2ZPy3q">Recipient (user) import</a></td><td><code>https://example.com/oauth</code><br><code>https://example.com/oauth/admin</code><br><code>https://example.com/oauth/user</code></td></tr><tr><td><a href="/pages/1JK6MCKeLDYigeVpXkKd">Incident Reporting (XML)</a></td><td><p><code>https://example.com/oauth</code><br><code>https://example.com/login/login.html</code></p><p><code>https://example.com/new-o365/dist/index.html</code></p></td></tr><tr><td><a href="/pages/Ml6zmHmvnPlNKiXqxZP7">Incident Reporting (MSI)</a></td><td><code>https://example.com/oauth</code><br><code>https://login.microsoftonline.com/common/oauth2/nativeclient</code>
<br><code>https://login.live.com/oauth20_desktop.srf</code>
<br><code>msal&#x3C;application_id>://auth</code></td></tr></tbody></table>

## Add an application to Lucy

On this page you can view, add, and delete Azure applications in Lucy.

<figure><img src="/files/4Khl0ARPrLVkrKSGgzs7" alt=""><figcaption></figcaption></figure>

To add an application, select **+ Add Application**. \
On the page that follows, fill out the application details:

<figure><img src="/files/rv9BppgQE0YK9Elb156W" alt=""><figcaption></figcaption></figure>

{% tabs %}
{% tab title="Client" %}
This is the Lucy client associated with the Azure app registration. Lucy ensures data segregation on a client basis, meaning that all data is containerized within the respective client. This setup guarantees that the app integration remains accessible solely to administrative users for the specified client. Moreover, it enables Managed Security Service Providers (MSSPs) and Partners to integrate multiple Azure tenants for their respective clients, further enhancing security and customization.
{% endtab %}

{% tab title="Name" %}
Give your App registration a friendly name so you can recognize it elsewhere in Lucy.
{% endtab %}

{% tab title="Application Data" %}
Once your app is registered copy the Client ID, Secret, and Tenant ID into the corresponding fields.
{% endtab %}
{% endtabs %}

After configuring all the parameters mentioned above, proceed by clicking "Save". After saving the application, a new button will appear labeled "Authorize". Click this button to grant the required permissions to your Azure application.

This action will redirect you to the Microsoft authentication page, where you will be asked to provide consent on behalf of your organization. This consent is necessary to establish the connection between Lucy and Azure.

<figure><img src="/files/hmliuAB0FggCr3X0uVf7" alt="" width="563"><figcaption></figcaption></figure>

{% hint style="warning" %}
To integrate Lucy with your Azure App Registration, it's essential to have Global Azure Administrative consent for your organization. If the administrator account in Lucy lacks the necessary privileges to grant consent on behalf of the organization, refer to the guide provided below to establish a consent flow in Azure.
{% endhint %}

<details>

<summary>Setup Admin Consent flow in Azure</summary>

### Purpose

The integration of third-party applications like Lucy with Azure requires careful configuration to ensure API permissions are correctly set. This is crucial for applications such as Lucy demanding access beyond the Azure permission set of the Lucy administrative users. A common challenge faced during integration is a permissions mismatch, leading to integration errors. This guide aims to navigate administrators through the consent framework in Azure, enabling Lucy to receive the necessary permissions while upholding the security and integrity of the Azure environment.

### **Who Should Use This Guide?**

This guide is intended for Lucy Administrators who lack Azure Administrative privileges to grant organizational consent, as well as situations where Lucy servers operate without an Azure Administrator to facilitate the saving of Azure application configurations within Lucy.\
\
Lack of Administrative consent  is evident if the following message is displayed after saving your application in Lucy:\
\
![](/files/q3gKkRMhkezB08VrcWB7)

### Configuration

#### Accessing Azure

1. **Log into the Azure Portal**: Start by visiting [portal.azure.com](https://portal.azure.com/) and logging in with your credentials.

#### Setting Up Consent Flow

2. **Navigate to Microsoft Entra ID**: Find and select the Microsoft Entra ID option to proceed.
3. **Enterprise Applications**: In the Microsoft Entra ID section, locate and click on “Enterprise Applications.”
4. **Consent and Permissions**: Inside Enterprise Applications settings, select “Consent and Permissions.”\ <br>

   <figure><img src="/files/d1TgB30i6K0guvPT1FDJ" alt="" width="249"><figcaption></figcaption></figure>
5. **Admin Consent Settings**: Search for “Admin consent settings” and click it to modify the consent flow settings.
6. **Enable Consent Requests**: Activate the option “Users can request admin consent to apps they are unable to consent to” by toggling it to “Yes.” This allows non-admin users to request admin consent for applications.
7. **Designate Reviewers**: Specify Azure Administrative users for the consent review process, selecting your Azure Admin under Review Type as Users.\ <br>

   <figure><img src="/files/VrEOmD7RfqSTVi5QSych" alt="" width="563"><figcaption></figcaption></figure>
8. **Save Your Settings**: Click “Save” to apply the changes.

#### Finalizing Configuration in Lucy

9. **Adjustments in Lucy**: Instruct the Lucy admin to try saving the application configuration again, preferably using an incognito window to avoid caching issues.
10. **Consent Request Initiation**: The Lucy admin will see a consent request dialog, allowing them to submit a consent request to the Azure Admin.

#### Consent Approval Process

11. **Initiating Approval**: The Lucy admin clicks “Request Approval” to start the consent process.<br>

    <figure><img src="/files/e4mwCYT3A6sk3rEXnbCL" alt="" width="307"><figcaption></figcaption></figure>

12. **Notification to Administrator**: An approval request is sent to the Azure Administrator's email, and the request appears under Enterprise Applications -> Admin Consent Requests in the Azure portal.\ <br>

    <figure><img src="/files/u2a9BJfieaND8dUptL35" alt="" width="258"><figcaption></figcaption></figure>

13. **Admin Review and Consent Granting**: The Azure Administrator reviews the request in the portal and grants consent on behalf of the organization.\ <br>

    <figure><img src="/files/IpkM4dpTzKwaIzWPtT0d" alt="" width="375"><figcaption></figcaption></figure>

    <br>

    <figure><img src="/files/IV98F8lfjHZirHKWFtPH" alt="" width="375"><figcaption></figcaption></figure>

14. **Confirmation to Lucy Admin**: The Azure Administrator should inform the Lucy admin of the consent approval.

#### Completing Integration

15. **Finalizing in Lucy Settings**: The Lucy admin goes to Common System Settings -> Azure Applications in Lucy, selects the application, and clicks “Save” to proceed with the integration.
16. **Microsoft Login and Token Allocation**: This prompts the Lucy admin to log in with Microsoft credentials again to generate a refresh token for the integration.
17. **Binding to Lucy Server**: Successfully obtaining the refresh token completes the integration, effectively binding the Azure app registration to the Lucy server.

</details>

## What API permissions are required for this integration?

{% hint style="info" %}
Lucy is configured to utilize the Microsoft Graph API to access and manage various resources from Microsoft services. The configured permissions include both delegated permissions, which act on behalf of a user, and those requiring administrative consent to access specific types of data, like directory data and full user profiles. These permissions are in line with the version 1.0 standard of the Microsoft Graph API.
{% endhint %}

<figure><img src="/files/ehCYhq7Pd2iiU3QICoeG" alt=""><figcaption></figcaption></figure>

### API Permissions explained

{% tabs %}
{% tab title="EntraID" %}

<table><thead><tr><th width="201.33331298828125">Permission</th><th width="104.55560302734375">Type</th><th width="268">Description</th><th>Admin consent?</th></tr></thead><tbody><tr><td>OpenID</td><td>Delegated</td><td>Sign users in</td><td>No</td></tr><tr><td>offline_access</td><td>Delegated</td><td>Maintain access to data</td><td>No</td></tr><tr><td>email</td><td>Delegated</td><td>View user's email address</td><td>No</td></tr><tr><td>User.Read.All</td><td>Delegated</td><td>Read all users' full profiles</td><td>Yes</td></tr><tr><td>GroupMember.Read.All</td><td>Delegated</td><td>Read group memberships</td><td>Yes</td></tr></tbody></table>
{% endtab %}

{% tab title="O365 Plugin" %}

<table><thead><tr><th width="139.111083984375">Permission</th><th width="113.11102294921875">Type</th><th>Description</th><th>Admin consent?</th></tr></thead><tbody><tr><td>Mail.ReadWrite</td><td>Delegated</td><td>Create, read, update, and delete email in user mailboxes.</td><td>No</td></tr><tr><td>User.Read</td><td>Delegated</td><td>Read the profile of signed-in users. Read basic company information of signed-in users</td><td>No</td></tr><tr><td>Mail.Send</td><td>Delegated</td><td>Send mail as users in the organization.</td><td>No</td></tr></tbody></table>

{% endtab %}

{% tab title="Outlook Plugin" %}

<table><thead><tr><th width="209.3333740234375">Permission</th><th width="101.55548095703125">Type</th><th width="257.888916015625">Description</th><th>Admin consent?</th></tr></thead><tbody><tr><td>OpenID</td><td>Delegated</td><td>Sign users in</td><td>No</td></tr><tr><td>offline_access</td><td>Delegated</td><td>Maintain access to data after granting access</td><td>No</td></tr><tr><td>email</td><td>Delegated</td><td>View user's email address</td><td>No</td></tr><tr><td>User.Read.All</td><td>Delegated</td><td>Read all users' full profiles</td><td>Yes</td></tr><tr><td>GroupMember.Read.All</td><td>Delegated</td><td>Read group memberships</td><td>Yes</td></tr></tbody></table>
{% endtab %}

{% tab title="Outlook (Partial)" %}

<table><thead><tr><th width="107.66668701171875">Permission</th><th width="103.11114501953125">Type</th><th width="337.5555419921875">Description</th><th>Admin Consent?</th></tr></thead><tbody><tr><td>openID</td><td>Delegated</td><td>Sign users in</td><td>No</td></tr><tr><td>Mail.Send</td><td>Delegated</td><td>Send mail as users in the organization.</td><td>No</td></tr></tbody></table>
{% endtab %}
{% endtabs %}

{% hint style="info" %}
For a complete explanation of MS Graph permissions [see their documentation](https://learn.microsoft.com/en-us/graph/permissions-reference).
{% endhint %}


---

# Agent Instructions: Querying This Documentation

If you need additional information that is not directly available in this page, you can query the documentation dynamically by asking a question.

Perform an HTTP GET request on the current page URL with the `ask` query parameter:

```
GET https://wiki.lucysecurity.com/application-reference/settings/common-system-settings/azure-applications.md?ask=<question>
```

The question should be specific, self-contained, and written in natural language.
The response will contain a direct answer to the question and relevant excerpts and sources from the documentation.

Use this mechanism when the answer is not explicitly present in the current page, you need clarification or additional context, or you want to retrieve related documentation sections.