Integrate Sumo with Azure AD

Availability

Account Type	Account Level
Cloud Flex	Trial, Enterprise
Credits	Trial, Essentials, Enterprise Operations, Enterprise Security, Enterprise Suite

Organizations with Enterprise accounts can provision Security Assertion Markup Language (SAML) 2.0 to enable Single Sign-On (SSO) for user access to Sumo Logic. This section has instructions for integrating Sumo with Azure AD.

Configure Sumo as an Enterprise App in Azure AD

In this step you set up Sumo as an Enterprise App in Azure AD.

note

The steps below are for the new Azure Management Console. For general steps for using the legacy GUI, see Configure single sign-on to applications that are not in the Azure Active Directory application gallery in Azure help.

1. Go into the Microsoft Azure Management Console and select Azure Active Directory in the left-side navigation pane.

2. Select Enterprise Applications. 

   

3. Select Manage > All Applications.

4. Click New application at the top of the All applications blade. 

   

5. Search for SumoLogic.

6. Select the SumoLogic tile.

   

7. Enter a name for your application and click Create. Throughout this procedure, we refer to the application name as \<app-name>.

   

8. From the Overview tab, click Get Started in the Set up single sign-on tile.

   

9. Click the SAML tile on the Single sign-on page.

   

10. Click Edit in the Basic SAML Configuration page.

    

11. In the Basic SAML Configuration pane:

    1. Select https://service.sumologic.com as the default Identifier (Entity ID) and use the trash can icon to delete the other Entity IDs in the list. (You'll update this in a later step.)

    2. Enter https://service.sumologic.com as the Reply URL (Assertion Consumer Service URL). (You'll update this in a later step.)

    3. Click Save at the top of the pane, and then close the pane.

       

12. In the SAML Signing Certificate tile, click the Download link for Certificate (Base64) to download the <app-name>.cer file.

    

13. In the Set Up \<app-name> section, copy and paste the contents of the following fields into a text document. You will need these values when in the next step.

    • Login URL

    • Azure AD identifier

    • Logout URL

      

Do not close the Setup Single Sign-On with SAML window, you will return later for additional configuration steps.

Configure SAML in Sumo Logic

1. Go to Administration > Security > SAML.

2. Select an existing configuration, or click Add Configuration to create a new configuration.

   

3. The Add Configuration page appears.

    

4. Configuration Name. Enter a name to identify the SSO policy (or another name used internally to describe the policy).

5. Debug Mode. Select this option if you'd like to view additional details if an error occurs when a user attempts to authenticate. For more information, see View SAML Debug Information.

6. Issuer. Enter the Azure AD Identifier that you noted in the substep 13 of Configure Sumo as an Enterprise App in Azure AD. 

7. X.509 Certificate. Use a text editor to open the certificate file you downloaded in substep 12 of Configure Sumo as an Enterprise App in Azure AD. Copy and paste the contents of the file into the field. 

8. Attribute Mapping. Select Use SAML subject.

9. Configure SP-initiated Login. (Optional) This step has instructions for setting up SP-initiated login. When SP-initiated login has been enabled, your SAML configuration will appear as an additional authentication option within your subdomain-enabled account login page. SP initiated login requires a custom Sumo Logic subdomain. If a custom subdomain has not yet been configured for your org, following the instructions in the Change account subdomain section of the Manage Organization topic.

   1. Click SP Initiated Login Configuration in the Optional Settings section of the SAML configuration page. When you click this option, the following configurations appear.

      

   2. Authn Request URL. Enter the Login URL that you noted in the substep 13 of Configure Sumo as an Enterprise App in Azure AD.

   3. Disable Requested Authn Context. Checkmark this option.

   4. Select Binding Type. Click Post.

   5. Sign Authn Request. Leave this option deselected.

10. Configure on-demand provisioning. (Optional) If you configure on-demand provisioning, Sumo Logic automatically creates a user account the first time a user logs on to Sumo.When the account is created, Sumo Logic credentials are emailed to the user. (Users need both Sumo Logic credentials and SAML permissions.) To complete this procedure, you  supply the First Name and Last Name attributes Azure AD uses to identify users.

    1. Click the On Demand Provisioning checkbox.

       

    2. First Name Attribute. You might need to provide the full attribute path, which can vary based on the ADFS version (the actual path can be seen in the SAML assertion). Here is an example:http://schemas.microsoft.com/ws/2008/06/identity/claims/givenname

    3. Last Name Attribute. You might need to provide the full attribute path, which can vary based on the ADFS version (the actual path can be seen in the SAML assertion). Here is an example:http://schemas.microsoft.com/ws/2008/06/identity/claims/surname

    4. On Demand Provisioning Roles. Specify the Sumo RBAC roles you want to assign when user accounts are provisioned. (The roles must already exist.)

11. Configure logout page. (Optional) Configure a logout page if you would like to point all Sumo users to a particular URL after logging out of Sumo Logic or after their session has timed out. You could choose your company's intranet, for example, or any other site that you'd prefer users in your organization access.

    1. Click the Logout Page checkbox.
    2. Enter the URL of the page to which you want to direct users after logging of Sumo.

12. Click Add to save the configuration

13. Select the new configuration from the Configuration List.

14. Copy the following field values and save them in a text file. You'll need them in the steps to follow. 

    • Assertion Consumer URL
    • Entity ID

Complete Azure configuration

1. In Section 1, Basic SAML Configuration, edit the configuration.

   1. Identifier (Entity ID). If you configured selected SP initiated login, replace https://service.sumologic.com with the Entity ID you copied in substep 14 of Configure SAML in Sumo Logic. 

      

   2. Reply URL (Assertion Consumer URL). Replace https://service.sumologic.com with the Assertion Consumer URL you copied in substep 14 of Configure SAML in Sumo Logic.

      

   3. Click Save.

2. In the left navigation pane, click Properties in the Manage section.

   1. Enabled for users to sign in? Enter Yes.

   2. User assignment required? Enter Yes. (This option controls whether a user must be assigned to this group or whether any user in the Azure AD tenant can use Sumo Logic. We recommend setting this to Yes as the Sumo environment has a finite number of users.

   3. Click Save.

      

3. In the left navigation pane, click Users and Groups in the Manage section.

4. Select Add user/group.

5. Add the Users or Roles that should have access to login to Sumo Logic and then click Assign. 

Test SAML Authentication

1. On the Azure Single Sign-on page click Test.

   

2. Click the Sign in as current user radio button and then Test sign in.

   

3. You should be redirected and logged into your Sumo Logic account.  If you have enabled SP Initiated Login, you can also go to your Sumo Logic account subdomain login page and select the new SAML login option that appears.