Set up Azure AD as the Identity Provider Using SAML 2.0 - Administrator Guide - Cortex XDR - Cortex - Security Operations

Cortex XDR Prevent Administrator Guide
Product
Cortex XDR
License
Prevent
Creation date
2024-05-06
Last date published
2024-09-08
Category
Administrator Guide
Retire_Doc
Retiring
Link_to_new_Doc
/r/Cortex-XDR/Cortex-XDR-Documentation

This topic provides specific instructions for using Azure AD to authenticate your Cortex XDR users. As Azure AD is third-party software, specific procedures and screenshots may change without notice. We encourage you to also review the Azure AD documentation.

To configure SAML SSO in Cortex XDR, you must be a user who can access the Cortex XDR tenant and have either the Account Admin or Instance Admin role assigned.

Step 1: Configure Azure AD Security Groups

Within Azure AD, assign users to security groups that match the user groups they will belong to in Cortex XDR. Users can be assigned to multiple Azure AD groups and receive permissions associated with multiple user groups in Cortex XDR. Use an identifying word or phrase, such as Cortex XDR, within the group names. For example, Cortex XDR Analysts. This allows you to send only relevant group information to Cortex XDR, based on a filter you will set in the group attribute statement.

Step 2: Copy Single SSO and Audience URI Values from Cortex XDR

  1. In Cortex XDR go to Settings → Configurations → Access Management → Single Sign-On.

  2. Expand the SSO Integration settings.

  3. Copy and save the values for Single Sign-On URL and Audience URI (SP Entity ID). Both values are needed to configure your IdP settings.

  4. You can not save the enabled SSO Integration at this time, as it requires values from your IdP.

Step 3: Configure Cortex XDR Application in Azure AD

  1. From within Azure AD, create a Cortex XDR application and Edit the Basic SAML Configuration.

    Azure-Basic-SAML-8.png

  2. Paste the Single sign-on URL and the Audience URI (SP Entity ID) that you copied from the Cortex XDR SSO settings. The Single sign-on URL from Cortex XDR should be pasted in the Reply URL and the Sign on URL fields . The Audience URI (SP Entity ID) value from Cortex XDR should be pasted in the Identifier (Entity ID) and Relay State fields. This allows users to log in to Cortex XDR directly from Azure AD.

    azure-basic-saml.png

  3. In the SAML Certificates section, click Edit and verify that Azure is configured to sign both the response and the assertion.

    Azure-Sign-Certificate-8.png

  4. To have Azure AD send group membership for the user in the SAML token, you must + Add a group claim in the Attributes & Claims section. Send the Security groups, using the source attribute Group ID. Use the word or phrase you selected when configuring Azure AD security groups (such as Cortex XDR) to create a filter. Customize the name of the group claim as memberOf.