Logz.io offers a quick integration for SSO with Azure.
To set up single sign-on for Azure
Request SSO access from Logz.io
Only account admins can request single sign-on access for their accounts.
To kick off this process, send an email to firstname.lastname@example.org. Write that you want to set up Azure SAML SSO for Logz.io. Include these items in the message:
The Support team will respond with the connection information you’ll need to give in Azure.
Add Logz.io as a gallery application in Azure
When you get to the step Set up single sign-on with SAML, you’ll need the SAML information you received from Logz.io Support’s email.
- The Audience URI from Logz.io is the SAML Identifier (Entity ID).
- The Single sign on URL from Logz.io is the SAML Reply URL (Assertion Consumer Service URL).
Zip the SAML certificate
In the SAML Signing Certificate section of the page, click the Certificate (Base64) download link (next to the certificate).
Download the certificate file and zip it. You’ll need to email this zip file to the Logz.io Support team in the next step.
Save your configuration.
Send your SAML details to Logz.io
Draft a new email to Support, and include these items:
- Your zipped SAML Signing Certificate (from the previous step).
Your SAML-P SIGN-ON ENDPOINT. This is your Azure Login URL.
Configure Azure to send user groups
Return to the App registrations page in your Azure Portal. If you don’t see Logz.io, click View all applications.
Open the App registrations service, choose the relevant application from the list, and then click Manifest.
In the manifest JSON, set groupMembershipClaims to
Click Save (at the top of the page).
Additional configuration for users who are in over 150 groups
Azure’s API requires additional configuration for members of 150 groups.
Azure has some limitations for users who are members in over 150 groups, and requires additional configuration to send the relevant data to Logz.io. To make sure your groups are sent appropriately, follow these steps:
Next, navigate to API Permissions, and click Add a permission.
Add the three following permissions to your account:
Select the APIs my organization uses tab on the right side menu, search for Windows Azure Active Directory, and click on it. Choose Application permissions > Directory.Read.All and add the permission.
Click Add a permission again. Under Microsoft APIs select Microsoft Graph. Choose Application permissions, and search for Group. Choose Group:ReadAll, and click Add permissions.
Click Add a permission again, select Microsoft APIs tab and click on Microsoft Graph. Choose Application permissions, search for Application, choose Application.Read.All, and click Add permissions.
Next, navigate to Certificates & secrets on the left side menu, and add a New client secret. Name the secret, for example, Logz.io Group Access, set the expiration date to the farthest option available, 24 months, and click the Add button.
Navigate to Overview, located on the left side menu, copy the Application ID and send it with the Secret you’ve created to Logz.io Support team.
Once your connection has been updated and approved by Logz.io Support team, you and your team should be able to log in to Logz.io via the SSO connection (found in https://myapplications.microsoft.com/) regardless of the number of members in a group.
(Optional) Restrict access to Logz.io to specific user groups
By default, all Azure users with Logz.io access can sign in to your Logz.io accounts.
You can restrict this access from the Manage users page for each of your accounts. Click Add group, and then paste the group’s Object ID for each group that should have access to the account in Logz.io.
Receive confirmation from Support
When Support has created your Azure + Logz.io connection, you’re done! You can start logging in to Logz.io through your Azure Apps portal.