Azure Active Directory

• Adding Forecast from the gallery
• Configuring user provisioning and single sign-on

• Provisioning permissions from Azure

Adding Forecast from the gallery

To configure the integration of Forecast into Azure AD, you need to add Forecast from the gallery to your list of managed SaaS apps.

To add Forecast from the gallery

1. Sign in to the Azure portal using either a work or school account, or a personal Microsoft account.
2. On the left navigation pane, select the Azure Active Directory service.
3. Navigate to Enterprise Applications and then select All Applications.
4. To add a new application, select New application.
5. Click Create the application.
6. In the newly opened pane on the right side, name the app "Forecast" and select the option Integrate any other application you don't find in the gallery (Non-gallery).
7. Click the Create button at the bottom of the page (Note that it takes a minute to create the app).

Configuring user provisioning and single sign-on

Now that Forecast is added to the gallery, you can proceed with configuring user provisioning and single sign-on options. 

To configure user provisioning and single sign-on

1. From top to bottom in the menu of the new app:
   1. Go to Properties and set the image file to the image that can be found here.
   2. Go to Single sign-on and set it to Linked.
   3. Set the Sign-on URL to https://app.forecast.it/azureAD?iss=YOUR_TENANT, where YOUR_TENANT is visible by clicking on the profile in the top-right and clicking Switch directories. The directory of the company should be listed along with a URL: YOUR_TENANT.onmicrosoft.com. The first part of this URL is your tenant.
   4. After the Sign-on URL is input, click Save in the top left.
   5. Go to Provisioning and set the Provisioning Mode to Automatic.
   6. Under Admin Credentials, set the Tenant URL to https://api.forecast.it/scim/v2/ and set the Secret Token to the value of the SCIM bearer token field found on the integrations page.
      1. Click Test Connection and Save the configuration if the connection is successful.
      2. Expand the Mappings section and disable the Directory Groups by clicking it and clicking the Enabled slider and then the Save button.
      3. Go back to the Provisioning page (click the breadcrumbs in the top left of the panel).
      4. Click the Directory Users line and change the attribute mappings according to what is required and what Forecast supports.
      5. Go back to Provisioning once again.
      6. Under the Settings header, click the Provision Status slider so that it is On.
      7. Click Save once again.
2. Now click on Azure Active Directory in the left-hand menu.
3. Click App Registrations, All applications, and then click on the Forecast app.
4. From top to bottom in the menu of the Forecast app:
   1. On the Overview page, click the copy icon next to the Application (client) ID and paste it into the Application client id field on the app page in Forecast.
   2. Write the tenant name in the Azure Tenant field on the same page. Keep this page open.
   3. Go to Authentication and click on the "Add a platform" button.
   4. Select Web on the right-hand side and under Redirect URI add the following URI: https://graphql.forecast.it/azuread/oauth/
   5. Click Configure.
   6. Go to Certificates & Secrets and under Client secrets, click the New client secret button.
   7. Under Expires, select 24 months and click Add. The new client's secret should now appear with Value.
   8. Click the copy icon next to the value and paste it into the Application client secret field on the app page in Forecast.
   9. Go to API Permissions and click the Add a permission button.
   10. In the newly opened window, click the Microsoft Graph button and then the Delegated permissions button.
   11. Tick email, OpenID & profile at the top of the list, and scroll down and tick the User. Read under User.
   12. Click the Add permissions button.
   13. Click the Grant admin consent for YOUR_TENANT_NAME and click Yes.

Assign users to Forecast single sign-on in Azure AD

The setup is now done and ready to configure users. This will need to happen from Azure AD. Below are the steps necessary to achieve this.

To assign users to Forecast single sign-on in Azure AD

1. Go to Azure Active Directory.
2. Click on Enterprise applications.
3. Click on Forecast.
4. Under Users and groups add the needed users.

Those users can then access Forecast through their Microsoft access panel or on the AAD tab on the Forecast login page.

Provisioning permission profiles from Azure

If it is required to provision user types we recommend using Azure Active Directory's App Roles for this purpose. This can be done by adding an expression mapping targeting the userType attribute with a source of "SingleAppRoleAssignment([appRoleAssignments])". Once this attribute is set follow the steps below to assign user permissions.

To provision permission profiles from Azure Active Directory

1. Sign in to the Azure portal.
2. In Azure Active Directory, select App registrations in the left-hand navigation menu.
3. Select All applications to view a list of all your applications. If your application doesn't appear in the list, use the filters at the top of the All applications list to restrict the list, or scroll down the list to locate your application.
4. Select the application to which you want to assign an app role.
5. Select API permissions > Add a permission.
6. Select the My APIs tab, and then select the app for which you defined app roles.
7. Select Application permissions.
8. Select the role(s) you want to assign.
9. Select the Add permissions button complete addition of the role(s).

The role assigned to a user is translated to the permission level in Forecast, by matching names to user types (or profiles, if enabled). This means that if you assign a person an app role of "Admin" they will have admin rights in your Forecast company.

Custom permission profiles provisioning

When a user with a Forecast custom permission profile is provisioned access to Forecast by Azure, the 'User type' set in Azure will need to match the Permission Profile name in Forecast, in order to set the custom permission profile automatically. 

The 'User type' name set in Azure is case insensitive. If Forecast doesn’t find a match, it will default to the profile called ‘Collaborator’. If that doesn’t exist either, the provisioning of the user will fail.