Answer
The following provisioning features are supported by Foxit Admin Console:
- Push New Users. New users created through Azure will also be pushed to Foxit Admin Console.
- Push Profile Updates. Updates made to the user's profile through Azure will be pushed to Foxit Admin Console.
- Push User Deactivation. Deactivating the user or disabling the user's access to the application through Azure will be removed the user's licenses in Foxit Admin Console.
- Push Groups. Groups and their members in Azure can be pushed to Foxit Admin Console. Foxit Admin Console will automatically assign product licenses to group users based on the group names.
- Delete Groups
- Reactivate Users. User's authorization reassignment.
The scenario outlined in this page assumes that the user already have the following prerequisites:
- An Azure AD tenant.
- A user account in Azure AD with permission to configure provisioning (for example, Application Administrator, Cloud Application administrator, Application Owner, or Global Administrator).
- Configure an Azure SSO directory in the Foxit Admin Console.
- Step 1:Login to Foxit Admin Console. Navigate to Settings -> Directory Setting -> Directories. Select the Azure directory and click Provision to support provisioning with Azure AD.
- Step 2:Copy and save the Tenant URL and the Secret token. These values will be entered in the Tenant URL and Secret Token fields in the Provisioning tab of your Foxit Identity Management application in the Azure portal.
- Step 1: Sign in to the Azure portal. Select Enterprise Applications, then select All applications.
- Step 2: In the applications list,select the application that was created previously. For the configuration steps, refer to: Configure the Azure SSO Directory. Here, it is assumed that the name of the originally created Application is Foxit Identity Management.
- Step 3: Select the Provisioning tab, click Get started
- Step 4: Set the Provisioning Mode to Automatic.
- Step 5: Under the Admin Credentials section, input your Foxit Identity Management Tenant URL and Secret Token retrieved earlier
- Step 6: Click Test Connection to ensure Azure AD can connect to Foxit Identity Management. If the connection fails, ensure your Foxit Identity Management account has Admin permissions and try again.
- Step 7: (Option)In the Notification Email field, enter the email address of a person or group who should receive the provisioning error notifications and select the Send an email notification when a failure occurs check box.
- Step 8: When you are ready to provision, click Save.
3.3 Create users and groups in Azure AD
- Step 1: Select Azure Active Directory, click Users and then click Add
- Step 2: Select Azure Active Directory, click Groups and then click Add Group (Note：Foxit will assign licenses for corresponding products to users within this group. There are no restrictions on the product names.)
- Step 3: Add user to Group. Select Azure Active Directory, click Groups→click member→ click Add members ,Search user, and then click Select
3.4 Establish the relationship between the AAD group and Foxit products in Foxit Admin Console
- Step 1: Navigate to Settings -> Directory Setting -> Directories. Select the Azure directory and click More ->Provision Settings
- Step 2: Click Create group connections to enter the page that defines the relationship between Azure AD groups and Foxit products.
- Step 3: Manually enter Azure AD custom groups （this group name that matches the group name in Azure AD）or click "Select groups" to select Azure AD groups.
Select the products you want to automatically assign licenses to the selected group In "Auto-licensing products".
Click "Save", and then you can see the group product relationship in the list.
3.5 Add group to provisioning in Azure AD
- Step 1: Click Enterprise applications→ Foxit Identity Management, click Provisioning
- Step 2: Select the User and groups tab, click Add user/group ，click None Selected, select groups, and click Select
- Step 3: Click Overview tab, click Start provisioning
- Step 4: Check the Provisioning status
Once you've configured provisioning, use the following resources to monitor your deployment:
- Use the provisioning logs to determine which users have been provisioned successfully or unsuccessfully
- Check the progress bar to see the status of the provisioning cycle and how close it is to completion
- If the provisioning configuration seems to be in an unhealthy state, the application will go into quarantine. Learn more about quarantine states here.
3.6 View provision results in Foxit Admin Console
- Go to Settings > Directory Setting > Directories, Click the + on the Azure directory to see more information.
Check the Last synced time. (A push failure might be displayed here, with the reasons shown as follows FAQ)
- Switch to License Management, and you can see that product licenses have been automatically assigned to group users based on the group names.
- Switch to Content Log，and you'll be able to view the records of automatically assigned product licenses.
FAQ
Q1:Are groups created in Azure AD Enterprise Apps automatically synced to the Admin Console? Will the Admin Console show the group structure?
Answer: The Admin Console will sync the users and groups display them in the User ID Management->User->Directory users list of the Admin Console.
Q2: What are the rules for the Admin Console to automatically assign licenses based on AAD groups?
Answer: The Admin Console will automatically assign product licenses to group users based on the group names.
When the number of user in the AAD group increases or decreases, the Admin Console will automatically assign or revoke the user's product license.
Q3: How often are AAD's group users and Foxit Admin Console synchronized?
Answer: The default automatic sync interval is 40 minutes. Currently, AAD does not support changing the synchronization interval.
Q4: Will the group names be case sensitive?
Answer: Yes, group names are case sensitive.
Q5: Azure AD Sync will pull all users from AD into Admin Console. Will this function only sync the users in the groups or will it continue to sync all users?
Answer: Only the users/groups of the configured enterprise application will be synchronized, and not all Azure AD users will be synchronized to the Admin Console.
Q6: If authorization for both Foxit PDF Editor for Windows and Foxit PDF Editor Pro for Windows products has been configured simultaneously, and a user belongs to both groups, then how should the authorization be allocated to the user?
Answer: Users are given priority in the allocation of Foxit PDF Editor Pro (Windows version) licenses.