The New Page landing page for the Knowledge Base is https://product.korbyt.com/help

The new version of this specific article can be found at: https://product.korbyt.com/help/articles/2089452-microsoft-graph-api-permissions-required-by-korbyt-for-azure-ad

Please update any of your bookmarks to the new Knowledge Base

For assistance on using the new Knowledge Base, we have a Welcome to the New Korbyt Knowledge Base guide

The new Korbyt Product Page also has sections for submitting feedback on system improvements, a view of our Roadmap of upcoming enhancements, and a change log of all updates.

Microsoft Graph API serves as an interface for developers to interact programmatically with Azure Active Directory (AD), facilitating access to comprehensive user and group-related functionalities and data.

Korbyt Required Minimum Permissions

These permissions can be configured in the Azure AD application’s registration settings under “API permissions.”

It’s important to note that administrative consent may be required after adding these permissions, especially in environments where the application’s service principal lacks administrative privileges.

for our application’s functionality, the minimum permissions required are:

• Group.Read.All
  • Requires Application Level access for this API Call
    • Delegated access is not sufficient
  • Essential for enumerating groups from Azure AD
  • Provides access to group-related information such as group name, description, memberships, and other properties
  • Required for Korbyt to efficiently manage and interact with groups within the Azure AD directory
• User.Read.All
  • Requires Application Level access for this API Call
    • Delegated access is not sufficient
  • Required for enumerating users from Azure AD
  • granting access to comprehensive user properties and relationships, including the Security Identifier (SID)
  • The SID is a critical identifier assigned to each security principal in Windows operating systems, including Azure AD
  • Required for Korbyt to retrieve vital user information such as contact details, organizational data, and the SID, enabling seamless user management and interactions
  • We use the SID as a unique identifier when logging in Korbyt users.
• User.Read
  • Required for Authenticating the individual user when they log in
  • Delegated Permission is sufficient for this API Permission

By securing these minimum permissions at the application level, our application can ensure secure and efficient access to group and user-related data within the Azure AD directory, while adhering to organizational policies and regulatory requirements.

With the Group.Read.All and User.Read.All permissions in place, our application is well-equipped to fulfill its functionality of group and user enumeration, providing users with a seamless experience and facilitating effective user and group management within our system.

For more information on the steps of connecting Korbyt to your Azure AD please see

• How to Manage CMS Users – Importing from Azure
• How to Manager End Users of Desktop(InView) and Mobile&Web – Importing for Azure

The rest of this article explores the implications of Microsoft Graph API calls, and their effects so that you can better understand Korbyt’s need for the previously listed services.

Understanding Minimum Permissions Required for Group Enumeration

When utilizing Microsoft Graph API to enumerate groups from Azure AD, it’s essential to configure the appropriate permissions to ensure secure and efficient access to the required data.

The minimum permissions required for group enumeration are as follows:

• Group.Read.All: – REQUIRED Application Level Access
  • This permission allows reading all groups within the Azure AD directory.
  • It provides access to group-related information such as group name, description, memberships, and other properties.

• Group.ReadWrite.All: – Not Required and Not Recommended for Korbyt Access
  • In addition to reading group information, this permission grants the application the ability to modify group properties and memberships.
  • It provides full read and write access to all groups within the Azure AD directory.
  • Korbyt Does Not Want this level of access to your Azure Active Directory.

Understanding Group Member Read Permissions

While Group.Read.All and Group.ReadWrite.All permissions focus on accessing group-related information, so it’s crucial to differentiate the implications of using GroupMember.Read.All permission in this context.

• GroupMember.Read.All: Not Required and Not Sufficient for Korbyt Access
  • This permission grants the application the ability to read the members of all groups within the Azure AD directory.
  • It provides access to user or application memberships within groups.

Important Consideration: Although GroupMember.Read.All allows reading group members, it does not provide permissions to enumerate groups themselves. This means that while the application can fetch information about group members, it lacks the capability to list the groups present in the Azure AD directory.

Understanding Minimum Permissions Required for User Enumeration

When leveraging Microsoft Graph API to enumerate users from Azure AD, it’s imperative to configure appropriate permissions to ensure secure and effective access to required data.

• User.Read.All: REQUIRED Application Level Access
  • This permission grants your application the ability to read all user profiles within the organization’s directory.
  • It provides access to comprehensive user properties and relationships, encompassing details such as contact information, organizational data, and more. User.Read.All is sufficient for retrieving basic information about users.

• User.ReadWrite.All: Not Required and Not Recommended for Korbyt Access
  • In addition to reading user profiles, this permission facilitates the modification of user data.
  • It empowers your application to both read and write all user properties within the organization’s directory, offering comprehensive access for data manipulation and management.
  • This permission is not recommended for Korbyt integration.

• User.ReadBasic.All: Not Required and Not Sufficient for Korbyt Access
  • Does not include access to the SID
  • SID is required to identify the user when logging in

Application Level Permissions Required for Group and User Enumeration

To access the SID and other detailed properties of all users in the directory, Application-level permissions (also known as application-level or admin-level permissions) are required.
These permissions are typically granted by an administrator and apply to the entire directory.

Delegated Permissions grants access to just the signed-in user’s profile rather than the entire directly, meaning that the permission is granted by the signed-in user only for their own user profile and the profiles they have access to.
Therefore it is insufficient to read all groups or users who require access.

Understanding Minimum Permissions Required for User Login

• User.Read: REQUIRED
  • Delegated access is sufficient for this API call
  • Used when the individual is requesting to log into Korbyt to verify their SID information within the organization’s Active Directory

The post Microsoft Graph API Permissions Required by Korbyt For Azure AD Integration appeared first on Korbyt Knowledge Base.

The New Page landing page for the Knowledge Base is https://product.korbyt.com/help

The new version of this specific article can be found at: https://product.korbyt.com/help/articles/3697464-managing-end-users-for-desktopinview-mobileandweb

Please update any of your bookmarks to the new Knowledge Base

For assistance on using the new Knowledge Base, we have a Welcome to the New Korbyt Knowledge Base guide

The new Korbyt Product Page also has sections for submitting feedback on system improvements, a view of our Roadmap of upcoming enhancements, and a change log of all updates.

This article reviews how to add new End Users to your your tenant. End Users are the users who will be logging into the Desktop(InView) Application to view Messages or will be Logging into the Mobile & Web Experience to view and interact with their News Feed.

Both the Desktop(InView) and Mobile & Web platforms share the same End User List. If you have an individual who uses both systems they only need to be added once as an End Users.

End Users are different than Content Management System Users (CMS Users) who log directly into the tenant to create and mange communications.  If you are trying to add new CMS Users you should check out the How to Manage CMS Users article

End User Management

To find your End Users in Korbyt

• Click on the Hamburger Menu
  
• Then from the Mega Menu (depending on your services) you can open click on Users in the Desktop Section or the Audience Section
  • If you subscribe to both the Desktop(InView) AND the Mobile, Web, & Email services you can navigate through either path to find your End Users
    
• If you already have End Users in your service they will also be listed on this screen and The Edit, Export User, Impersonate Desktop View, Send Notification and Archive Actions are available.
  
  • Users who no longer access the system are Archived, rather than deleted
    • This maintains the record of previous interactions
  • If a users was Archived and needs to be active again
  • • IF you manually add single users you can not move them back directly, you will need to follow a few steps
      • Find the Archived record, click the Pencil to edit, and change the archived records email and/or user name
        • This will free up the email address and/or user name to be used for a new active user
      • Create a New User record for the person
    • IF you manage users through CSV files, adding them back to the CSV file will create an active user for them again

There are 4 different methods to add End Users to your Korbyt tenant

• Adding a Single Users
• One Time Import Through CSV File
• Schedule Import Through CSV File
• Azure Active Directory Import

Optional First Step – Creating User Attributes

If you will be creating different Audiences in your tenant so that they can receive different messages these audiences can be managed dynamically using User Attributes. The alternative to a Dynamic Audience is one that would have to be managed manually.

If you are using Azure AD Integrations, you can create Audiences from Azure groups

The section at the end of this article reviews How to Create User Attributes

Add A Single User

To add a  single user one at a time follow the steps below:

• In the Users screen described above Click on the Add Users button and Select Single Users
  
•  Fill the required information (*)
  
• Click on the button to Select the Audience.  The Audience section is where all the available audiences can be found. NOTE: An audience must first be created to be available in the list of options.  The steps to create an audience are listed in the next section below.  In this example the audience has already been created.
  
• Click on the Done button to complete selecting the Audience(s)
• Then Click on the Save Button to complete the action of adding a User
• The employee contact is created. The Edit, Export User, Impersonate Desktop View, Send Notification and Archive Actions are available.
  
• The user(s) are then imported and listed in the End User section

Back to Agenda

One-Time Import of a List of Users

To import a list of employees through a One-Time Import follow the steps below:

• In the Users screen described above Click on the Add Users button and Select One Time Import
  

• Click Download Template to get a CSV File with the correct columns and example information
  
• Navigate to the Downloads Folder on your Computer and you will see the template file
• Populate the file with your list of employees and save
  
• Fill in the CSV File with your values
  • first_name: Must contain a value.
  • last_name: Must contain a value.
  • email: Must be a unique value. You can leave this field blank. However, we recommend that you include an email address to ensure the highest degree of reach.
  • username: Must be a unique value. You can leave this field blank
  • phone_mobile: Must be a unique value. If you are loading email address, you can leave this field blank.  If you are using username only, mobile number is required.
  • international_code: This is the country code for mobile phone numbers such as 1 for US numbers. If you load mobile number, this field is required.  Otherwise, you can leave this field blank.
• If you include any user attributes in your CSV import file that are not defined in your Korbyt Anywhere settings such as Department and Location, your file will still load but those attributes will be ignored. See the User Attributes Section of this article
• Back in Korbyt, click on Select CSV file link to select the file.
  
• Locate your completed CSV file, select the file and click Open
  
• Once the file is selected, click on the “Validate and Preview” button.
  
• The Validate and Preview will show the employees on the file.
  • You have the Option to Remove Users who are no longer on the file by checking the box in the upper right
  • This will add new users and archive anyone no longer present on the CSV File
• Review that all info is correct and click on the Import or Cancel button.
  
• The user(s) are then imported and listed in the End User section

Back to Agenda

Scheduled Import of a List of Users

• In the Users screen described above Click on the Add Users button and Select Scheduled Import
  

• Click Download Template to get a CSV File with the correct columns and example information
  
• Navigate to the Downloads Folder on your Computer and you will see the template file
• Populate the file with your list of employees and save
  
• Fill in the CSV File with your values
  • first_name: Must contain a value.
  • last_name: Must contain a value.
  • email: Must be a unique value. You can leave this field blank. However, we recommend that you include an email address to ensure the highest degree of reach.
  • username: Must be a unique value. You can leave this field blank
  • phone_mobile: Must be a unique value. If you are loading email address, you can leave this field blank.  If you are using username only, mobile number is required.
  • international_code: This is the country code for mobile phone numbers such as 1 for US numbers. If you load mobile number, this field is required.  Otherwise, you can leave this field blank.
• If you include any user attributes in your CSV import file that are not defined in your Korbyt Anywhere settings such as Department and Location, your file will still load but those attributes will be ignored. See the User Attributes Section of this article
• Back in Korbyt, click on Select CSV File link to select the file
• In this interface you will be able to select a CSV File from your Media Manager
  • You can Drag and Drop the File into this window if you have not already uploaded the file to Korbyt
• Once the file is selected, click on the “Validate and Preview” button.
  
• The Validate and Preview will show the employees on the file.
  • You have the Option to Remove Users who are no longer on the file by checking the box in the upper right
  • This will add new users and archive anyone no longer present on the CSV File
• Review that all info is correct and click on the Import or Cancel button.
  
• The user(s) are then imported and listed in the End User section
• The File will be re-checked every 24 hours

• To update the Users, Load an updated copy of the CSV File to the Media Manager
  • Make sure to use the same file name, and check the box to Overwrite media if the File already exists
    
  • Now when the schedule runs again and checks the updated file it will add and remove users as you have specified.

Back to Agenda

Creating User Attributes (Optional)

• Creating User Attributes in the settings allows you to apply those attributes to your end users when they are loaded into the system, and you can then create an audience of users based on that attribute rather than manual selection
• This step is optional, but will mean that creating different audiences will be done through manual selection of members
• If you are going to use Attributes, they should be created in the system before End Users are added
• To set User Attributes Navigate to the CMS Settings by clicking the gear icon  in the upper right, then scroll down on the General Tab or  select the Mobile & Web Tab depending on your services
  

• You can then Name your Attribute
  • For example, “Job Title” or “Role” or “Location”
  • What ever the name of the attribute is that will separate your users into groups
• Select the Type
  • This will define the space this information is entered
  • We recommend Lookup as a type with multiple predefined options, you can then define those options that will be available
    • For example, a list of Job Roles, or Locations
  • Boolean as an option when the selection either “Yes or No”
    • For example, If the Employee is a remote worker
  • Defining these attributes in settings will make them available to assign to end users both individually and through CSV file import

Back to Agenda

Importing Users from Azure Active Directory

Korbyt Anywhere provides integration with Azure AD for secure and scalable user management and single sign on, allowing a customer’s employees to login to the Korbyt Anywhere CMS, Desktop, and Mobile applications using
their Azure AD credentials.

This process will require configuring both your Korbyt Tenant as well as your Microsoft Azure services. Your IT Department, as well as Korbyt Professional Services will likely be involved in the process.

This document provides high-level insight into the process steps.

There are three main steps in the setup process:

• Granting Access: In your MS Azure service you must grant Korbyt Anywhere access to the desired Azure AD groups
  • In Azure – Registering an app on the Azure app registration portal
  • In Azure – Confirming permissions for Microsoft Graph on the app
    • Microsoft Graph API permissions are required for integration with Azure AD
    • This article lists the specific Microsoft Graph API Permissions Required by Korbyt
  • In Azure – Obtaining Administrator consent
  • In Azure – Generating a Client Secret
  • Recording the details from these steps as they will be used in Korbyt to create the connection

• Importing Users: Inside Korbyt Anywhere, setting the information so that Korbyt can automatically create a corresponding CMS
  and/or Desktop or Mobile user for each employee it detects in the customer’s designated Azure groups
  • In Korbyt – Enter User Import Parameters
    • Open the Mega Menu, in the  Advanced section select Azure AD
    • Click the pink +Add New Azure Users button and enter the details you established in the first steps
      
    • Click Save
  • In Korbyt – Map Azure Fields to Employee Metadata
    • This will allow you to select the Azure AD Fields you would like to make part of the employee record in Korbyt
      
  • In Korbyt – Filter By Group
    • If specified, the import process will only add users that are members of selected groups. This can be helpful if you have a large number of users and you only wan to import a subset of those uses
    • In the Azure Menu, use the Action to select Filter By Group
      
  • Now Established the Azure AD and Korbyt will communicate periodically to match the users that should be in Korbyt based on the information in your Azure AD.

• Employee Login: Once the import is processed and complete, an employee will be able
  to log in to Korbyt Anywhere using their Azure credentials

Back to Agenda

The post How to Manage End Users of Desktop(InView) or Mobile, Web, & Email appeared first on Korbyt Knowledge Base.