Connect Your Microsoft Entra ID Active Directory to Abacus.AI

• Requirements
• Setting up the Microsoft Entra ID connector
• Licenses
• Troubleshooting and FAQ

Abacus.AI allows you to manage user accounts using Microsoft Entra ID:

Requirements

• Have the appropriate Microsoft licenses:
  • Microsoft Entra ID P2
  • Microsoft Entra ID Governance
  • Both licenses are required in order to assign Microsoft users and groups to Abacus.AI roles
• Create an Abacus.AI Application on Microsoft Entra App Gallery
• Have the proper permissions set in Microsoft Entra ID
• Create the Microsoft Entra ID authentication connector on the Abacus.AI platform
• Reach out to Abacus.AI to set the specified organization's managed user service to Microsoft
  • Ensure all users are assigned roles in Microsoft Entra ID before switching managed user services. Existing users who are not properly migrated may lose access

Setting up your Microsoft Entra ID environment for Abacus.AI user management

1. Log into your Microsoft Entra admin dashboard
   
   

2. Go to the Enterprise applications tab and select your installation of Abacus.AI (Application ID: b89bbf6f-22a7-4b66-9bcf-6a80edf04dc5).
   
   

3. Go to the permissions tab and ensure the following permissions are enabled. You might have to click the "Grant admin consent" button.
   
   

4. Follow the pop-up instructions accordingly (Microsoft admin permissions are necessary).

Managing accounts on Microsoft Entra ID:

1. Go to the "Users and groups" tab and press "Add user/group".
   
   

2. Select the users or groups you want to give access to, along with their corresponding roles:

   • Admin - The user is an admin on the Abacus.AI Chat and platform.

   • Chat User - The user only has access to the Abacus.AI Chat.

   • Platform User - The user has access to the Abacus.AI Chat and platform.
     
     

Licenses

While Microsoft Entra ID Governance is not strictly necessary for single sign-on (SSO) integration, it becomes essential when you want to leverage group-based role assignments and automated identity management features as group assignments are not avalailable from Microsoft without this plan. Your team can still use SSO integration if you're willing to accept the limitations of manually assigning roles to individual users. However, if you want to assign roles to user groups and enable access to private group-specific bots for "Chat Users," then Entra ID Governance is necessary, but only 1-2 licenses would be needed for the admins who will manage and maintain the groups.

Setting up Microsoft Entra ID connector

1. Select Organization:

   • Go to the organization that you want to be managed by Microsoft Entra ID.
     
     

2. Access Connected Services Dashboard:

   • Go to the Abacus.AI Connected Services Dashboard. You can click your profile in the top right and then click "Manage Connectors".

3. Add New Connector:

   • Click on the "Add New Connector" option and select "Microsoft Entra ID".
     
     

4. Connect Microsoft Entra ID:

   • Press the "Connect Microsoft Entra ID" button. Follow the instructions in the dialog box to provide your Microsoft admin user credentials -- the account that has your target directory as the home organization.
   • Ensure you have granted admin consent as outlined in the Setting up your Microsoft Entra ID environment for Abacus.AI user management instructions. Without this, you will not have the necessary permissions to create the connector.
     
     

5. Verify Connector Status:

   • Your connector should be set up and confirm that it has an "ACTIVE" status.

6. Enable Feature:

   • Reach out to Abacus.AI to enable this feature and have Microsoft Entra ID manage user accounts for this organization.

Troubleshooting and FAQ for the Microsoft Entra ID connector

• On Microsoft, users must be internal members and not guests. The emails should be of the form @domain.com, not ext@domain-on-microsoft.com
• When logging into the https://workspace.abacus.ai/chatllm application using Microsoft SSO, the user must switch their Microsoft organization to their targeted directory.