This article will detail the needed steps by a School District to set up SSO for Navigate360 Visitor Management. Each section must be followed in order, first by the school district in Section A, then by Navigate360 in Section B, and then finally by the school district in Section C. 

A. Azure Setup - Completed by District

To fill in the basic information section for the connection between Auth0 and Microsoft Azure AD, you'll need to gather and send specific details (Client ID, Client Secret Value, and Azure AD Domain) from your Azure AD portal. Please follow the below steps to complete this task. 

1. Log in to the Azure Portal: Open the Azure Portal and log in with your account.
2. Navigate to Azure AD (Active Directory): From the left-hand navigation pane, select “Azure Active Directory.”
3. Go to App Registrations: Select "App registrations" from the menu.
4. Create or Select an Application: If you have an existing application that you want to use, click on its name. Otherwise, click "New Registration" to create a new application.
5. Add the Redirect URI: In the “Overview” or “Authentication” section, add the below callback address as a Redirect URI:
   1. Type: Web
   2. Redirect URI: https://alice-dev.auth0.com/login/callback
6. Copy the Client ID: In the "Overview" section, you'll find the Application (client) ID. Copy this value.
7. Create a Client Secret: Go to the "Certificates & secrets" section, then click on "New client secret." Enter a description and select an expiration period, then click "Add." Copy the value of the client secret as it won't be visible again after you leave this page.
   1. Important: The Client Secret will have a Client Secret ID and a Client Secret Value. Please ensure that you are sharing the Client Secret Value, as this is the field needed to connect Auth0 and your Microsoft Azure AD. 
   2. It will typically be in the format “xxxxx~xxxxxxx-xxx…”.
8. Find Your Azure AD Domain: Go back to the "Azure Active Directory" overview page. You should see your primary domain listed under the "Custom domain names" section. 
   1. It will typically be in the format “mydomain.onmicrosoft.com”.
9. Send the Client ID, Client Secret Value, and Azure AD Domain to your Navigate360 Implementation Consultant. 

B. Auth0 Setup - Completed by Navigate360

Once you provide the Client ID, Client Secret Value, and Azure AD Domain to your Navigate360 Implementation Consultant (Section A), the Navigate360 team will create the connection in Auth0. 

The Implementation Specialist will inform you once this has been completed, so you can finish the VM Configuration (Section C) steps below. 

C. VM Configuration - Completed by District 

Now that both Azure and Auth0 setup is complete, Please follow the below steps to complete the configuration and confirm SSO access. 

Configure the group name to the permission level

1. Find the group names within your Azure AD. You’ll link the group names created in Azure to the SSO Permission Mapping page in VM.

2. Log into Visitor Management as a District Admin.
3. Navigate to the Admin menu and select SSO Permission Mapping.

4. Click on Add Groups → Add Groups Manually.

5. Enter a Group Name and press Enter on your keyboard. You can add multiple Group Names for a single Permission Level prior to saving. 
   1. Note: Please ensure that the Group Name is entered exactly how it is listed in Azure AD.

6. Ensure you've selected the Permission Level and Building(s) if necessary, for the entered Group(s). Then click Save Changes.

7. The saved permission mapping for the added Group(s) will now be displayed on the SSO Permission Mapping table.

8. Repeat steps 4-6, as needed, for any remaining Azure AD Groups.

Testing the SSO Functionality

1. Open the Login page for Visitor Management and click Sign in with SSO. 
2. In the popup window, enter the email address for an Azure AD user account that you have access to.
   1. Note that the email address being used for testing will need to have access to an Azure AD Group that has been configured in VM (Section C).
3. You will see a message “SINGLE SIGN-ON ENABLED.” 
4. Click Log In to be redirected to your Microsoft Account for authentication. 
5. Once authenticated, the popup will close and the system will log you into VM.

Troubleshooting

1. Ensure all steps outlined have been completed.
2. Check that pop-up blockers or cross-site limiters are not preventing the communication between VM and Azure AD.