# Azure AD Integration

**URL:** <https://forum.inductiveautomation.com/t/azure-ad-integration/109345>\
**Category:** Ignition\
**Created:** [August 4, 2025, 7:09pm UTC](https://forum.inductiveautomation.com/t/azure-ad-integration/109345 "2025-08-04T19:09:29Z")\
**Posts on this page:** 3\
**Page:** 1

<div class="post-metadata">

**Author:** ![blindsay](https://avatars.discourse-cdn.com/v4/letter/b/e36b37/32.png) [@blindsay](https://forum.inductiveautomation.com/u/blindsay)\
**Post date:** [August 4, 2025, 7:09pm UTC](https://forum.inductiveautomation.com/t/azure-ad-integration/109345/1 "2025-08-04T19:09:29Z")

</div>

Hey all,

I work on the IT side of the house but working with our Automation Engineer who uses Ignition.

I have setup a SAML identity provider (Azure AD for us) in ignition and have it where I can successfully login (to the gateway for now, Ill worry about more fine grained permissions once i get the gist of it)

I have setup the mapped user attributes and I am currently passing these  
ID  
Username  
First Name  
Last Name  
Email  
Roles

I created an AD group which has me and our Ignition admin in it and I have it assigned it to our azure AD app that I created for the ignition SAML and I can see that group name being passed into the roles attribute (I just called it Ignition\_Admins) Eventually we will have a few different AD groups depending on the level of user access

What I am really stuck on is now mapping that AD group to roles within Ignition (IE I want my Ignition\_Admins group having an Admin role assigned to it).

Also what is the best way to handle user provisioning? Is there an automated way that I can push all the members of my group into Ignition or perhaps create the user when someone in the correct AD group tries to sign in.

I did see the Users,Roles section to create a new user source but those seem to mostly point to on prem AD and not azure. Can I use my Azure idp for both authentication and provisioning?

Thanks!

---

<div class="post-metadata">

**Author:** ![diamond](https://avatars.discourse-cdn.com/v4/letter/d/e79b87/32.png) [@diamond](https://forum.inductiveautomation.com/u/diamond)\
**Post date:** [August 4, 2025, 7:21pm UTC](https://forum.inductiveautomation.com/t/azure-ad-integration/109345/2 "2025-08-04T19:21:48Z")

</div>

1. Go to security levels and create your "roles"
2. Go to your SAML IdP and define "security level rules". You can map groups using containsAny() function.
3. User provisioning... just add your users to a group, link that group to a security level and then allow that security level under project properties to allow user access.

---

<div class="post-metadata">

**Author:** ![blindsay](https://avatars.discourse-cdn.com/v4/letter/b/e36b37/32.png) [@blindsay](https://forum.inductiveautomation.com/u/blindsay)\
**Post date:** [August 4, 2025, 7:48pm UTC](https://forum.inductiveautomation.com/t/azure-ad-integration/109345/3 "2025-08-04T19:48:44Z")

</div>

![image](https://us1.discourse-cdn.com/inductiveautomation/original/3X/3/2/3238e0403fa06f3d61ea8c4da812892c05305d04.png)

Ignition\_Admins is the one I have tried to create.