Entra ID (formerly Azure AD)

Overview

This topic explains how to integrate LaunchDarkly with Microsoft Entra ID (formerly Azure AD).

The Entra ID App Gallery includes LaunchDarkly and provides a LaunchDarkly application template that facilitates configuration.

Integrating LaunchDarkly with Entra ID

To integrate LaunchDarkly with Entra ID:

1. Log in to Entra ID.
2. Navigate to "Enterprise applications."
3. Click New application:

4. Search for the LaunchDarkly application.
5. After you add it, follow the Microsoft Entra integration with LaunchDarkly tutorial.

If your instance of Entra ID manages multiple LaunchDarkly accounts, contact Support.

If members cannot log in after you set up SSO, read the troubleshooting article New users are unable to log in with Azure AD once SSO is configured.

Mapping custom roles to Entra User Attributes

After you integrate LaunchDarkly with Entra ID, you can map LaunchDarkly role and custom role attributes to Entra User Attributes using Entra claims. The LaunchDarkly Entra SSO integration provides Just-In-Time (JIT) user provisioning for IdP-Initiated SSO.

To learn more about SSO provisioning for roles and custom roles, read Custom roles.

To set up role and customRole claims in Entra ID:

1. Navigate to the "Attributes & Claims" section.
2. Click Edit.
3. Click Add new claim. The "Manage claim" screen appears:

4. Enter "role" in the Name field.
5. Leave the source as "Attribute."
6. Choose a source attribute from the menu that is not currently mapped, such as user.country.
7. Click Save:
8. Repeat steps 1-7 with "customRole," mapping to a different unused source attribute.

Mapping custom roles to Entra Security Groups

In addition to Entra User Attributes, you can also assign LaunchDarkly custom roles to Entra Security Groups.

There are five steps to this process:

1. Create custom roles in LaunchDarkly
2. Create groups in Entra ID
3. Create roles for the Entra LaunchDarkly Enterprise Application
4. Set up groups and roles in the Entra LaunchDarkly Enterprise Application
5. Update the Entra LaunchDarkly Enterprise Application SSO configuration

Each of these steps are outlined below.

Create custom roles in LaunchDarkly

To begin, create the custom roles in LaunchDarkly that you want to use with the Entra LaunchDarkly Enterprise Application. Make note of each custom role's key, as you will need the key when you set up your Entra ID app role.

To learn how, read Custom roles.

Create groups in Entra ID

After you have created your custom roles in LaunchDarkly, set up your groups in Entra ID:

1. In Entra ID, navigate to "Groups," then click New group.
2. Select a group type and enter a group name.
3. Click “No members selected" to add new members:

4. Select members from the list to add to the group, then click Select:

Your Entra ID members are now in the group.

Create roles for the Entra LaunchDarkly Enterprise Application

Next, create roles within Entra ID:

1. In Entra ID, open the LaunchDarkly Enterprise Application.
2. Navigate to App Registrations, then click All applications:

3. Click LaunchDarkly to open the application.
4. Navigate to "App roles" and click Create app role.
5. Enter the role information. The value must be the key of the custom role you created during the Create custom roles in LaunchDarkly step:

6. Click Apply.

Repeat this procedure for each new Entra app role.

Set up groups and roles in the Entra LaunchDarkly Enterprise Application

Then, set up groups and roles in Entra ID:

1. In Entra ID, open the LaunchDarkly Enterprise Application.
2. Click Users and groups. The "Users and groups" screen appears:

3. On the "Groups" tab, choose the group you want to edit and click Select. The "Add Assignment" screen appears.
4. Click None Selected under "Users and groups" to add a new group. The "Users and groups" screen appears:

5. Choose the group you created in the Create groups in Entra ID step.
6. Click Select. You are returned to the "Add Assignment" screen.
7. Click None Selected under "Select a new role" to add a new role:

8. Choose the role you created in the Create roles for the Entra LaunchDarkly Enterprise Application step.
9. Click Select. You are returned to the "Add Assignment" screen.
10. Click Assign.

Repeat this procedure for each group and role you want to set up.

Update the Entra LaunchDarkly Enterprise Application SSO configuration

Finally, update Entra's SSO configuration:

1. In Entra ID, open the LaunchDarkly Enterprise Application.
2. Click Single sign-on.
3. Scroll to the "Attributes & Claims" section.
4. Click Edit. The "Manage claims" form appears.

5. Enter customRole in the Name field.
6. Leave the Namespace field empty.
7. Select "Attribute" as the source.

8. Enter user.assignedroles in the Source attribute field.

9. Click Save. You are returned to the "Attributes & Claims" screen.

Close the "Attributes & Claims" screen to return to the "Single sign-on" page. To test your SSO configuration, click Test at the bottom of the page.

For another example of this setup process, read How to setup LaunchDarkly custom roles from Azure AD Security Groups.

Assigning Entra ID Security Groups to LaunchDarkly teams

You can assign LaunchDarkly teams to Entra Security Groups. This keeps the members of your LaunchDarkly teams in sync with your Entra ID groups.

There are four steps to this process:

1. Create Security Groups in Entra ID
2. Create teams in LaunchDarkly
3. Assign Entra ID Security Groups to the LaunchDarkly Enterprise Application
4. Create a new Entra ID claim

Create Security Groups in Entra ID

First, set up a Security Group in Entra ID:

1. In Entra ID, navigate to "Groups," then click New group.
2. Select the "Security" group type and enter a group name.
3. Click Create. You are returned to the groups list.
4. Copy the object ID of the group you want to link to a LaunchDarkly team:

You will use this group's name and ID in the next section.

Repeat this procedure for as many groups you want to assign to LaunchDarkly teams.

Create teams in LaunchDarkly

Next, create a team in LaunchDarkly using your Entra ID Group name and ID:

1. In LaunchDarkly, navigate to the Teams tab under Account settings.
2. Click Create team. The "Create team" dialog appears.
3. In the Name field, enter your Entra ID group name.
4. In the Key field, paste the Entra ID group ID you copied the previous section.
5. Click Create team.

Repeat this procedure for as many teams as you want to sync with Entra ID Security Groups.

Assign Entra ID Security Groups to the LaunchDarkly Enterprise Application

Then, assign Entra ID Security Groups to the LaunchDarkly Enterprise Application:

1. In Entra ID, open the LaunchDarkly Enterprise Application.
2. Click Users and groups. The "Users and groups" screen appears:

3. On the "Groups" tab, choose the group you want to edit and click Select. The "Add Assignment" screen appears.
4. Click None Selected under "Users and groups" to add a new group. The "Users and groups" screen appears.

5. Choose the group you created in the Create Security Groups in Entra ID step.
6. Click Select. You are returned to the "Add Assignment" screen.
7. Click Assign.

Repeat this procedure for each Entra ID Security Group you created.

Create a new Entra ID claim

Finally, create a new Entra ID claim:

1. In Entra ID, open the LaunchDarkly Enterprise Application.
2. Click Single sign-on.
3. Scroll to the "Attributes & Claims" section.
4. Click Edit. The "Manage claims" form appears.

5. Click "+ Add a group claim." A "Group Claims" dialog appears.
6. Select "Groups assigned to the application" under "Which groups associated with the user should be returned in the claim?"
7. Select "Group ID" as the source attribute.
8. Open the Advanced options section.
9. Check the "Customize the name of the group claim" box.
10. Enter teamKey into the Name field:

11. Click Save. You are returned to the "Attributes & Claims" screen.

Close the "Attributes & Claims" screen to return to the "Single sign-on" page. To test your SSO configuration, click Test at the bottom of the page.