What is Azure Active Directory?
Azure Active Directory (Azure AD) functions as a robust identity and access management service by integrating the management of digital certificates. This capability allows organizations to centralize their certificate management, improving security and simplifying administrative tasks. By leveraging Azure AD, enterprises ensure that their digital certificates are managed with high availability and compliance with industry standards, thus safeguarding sensitive information and communications.What is Microsoft Intune?
Microsoft Intune streamlines the implementation of S/MIME certificates across various devices, enhancing email security through encryption and digital signatures. By leveraging Intune, organizations can automatically deliver S/MIME signing and encryption certificates to devices running on Android, iOS/iPadOS, macOS, and Windows 10/11. On iOS devices using the native mail client, and on iOS and Android devices using Outlook, the S/MIME certificates are automatically associated with the mail profiles, ensuring seamless integration and enhanced email security. For Windows and macOS platforms, as well as other mail clients on iOS and Android, Intune will facilitate the distribution of S/MIME certificates. However, users must manually enable S/MIME in their respective mail applications and select their certificates. This capability of Intune simplifies the deployment process, ensuring that S/MIME certificates are readily available on managed devices, thereby enhancing overall email security by enabling encrypted and signed email communications across the organization.Strengthen your email security and protect sensitive data with SSL.com S/MIME certificates.
How to Configure Microsoft Intune and Microsoft Active Directory for S/MIME Certificates
Prerequisites
Listed below are the prerequisites for the API. These need to be configured on the Intune tenant to which certificates will be imported from SSL.com.- An account with Intune Administrator rights.
Add users and grant permissions – Microsoft Intune | Microsoft Learn - All the users for whom the PFX certificate is imported should have Intune license assigned.
Assign Microsoft Intune licenses | Microsoft Learn - Intune certificate connector installed and configured on a Windows server.
Install the Certificate Connector for Microsoft Intune – Azure | Microsoft Learn - Public key exported from Intune connector server.
Use imported PFX certificates in Microsoft Intune | Microsoft Learn - Create Enterprise application in Microsoft Entra
This guide assumes that the Enterprise app will already be created at the tenants and SSL.com will have the information about the registered enterprise app. The process to register the Enterprise app (using Entra portal) is explained below.- Login to portal.azure.com and search for Microsoft Entra ID
- Click Enterprise applications
- Click New application
- Click Create your own application
- Enter the name of the application and click Create
- Application is now created successfully.
- Click App registrations
- Click All applications
- Select the Application.
Note the Application ID and the Directory ID: these need to be passed to API. - Click Certificates & secrets and then select New client secret
- Click Authentication and add the Web Redirect URLS of SSL.com. Redirect URLs are https://secure.ssl.com/oauth2/azure for Production and https://sandbox.ssl.com/oauth2/azure for Sandbox
- Provide a name to the key and click Add
Note the value of the Key. This needs to be passed to the API.
Permission requirements for Enterprise application to import the certificate
- Under App registrations >> application name, click API Permissions.
- Click Add a permission.
- Click Microsoft Graph.
- Click Delegated Permissions and search for user.read. Check the boxes for User.Read and User.Read.All.
- Click Delegated permissions and search for “group”. Check the box for Group.ReadWrite.All.
- Click Delegated Permissions and search for “DeviceManagementApps”. Check the box for DeviceManagementApps.ReadWrite.All.
- Search for “DeviceManagementConfiguration”. Check the boxes for DeviceManagementConfiguration.Read.All and DeviceManagementConfiguration.ReadWrite.All. Proceed to click the Add permissions button.
- Click Add a permission.
- Select Microsoft Graph.
- Click Application permissions and search for “user.read”. Check the boxes for User.Read.All and User.ReadWrite.All.
- Click Application permissions and search for “group”. Check the box for Group.ReadWrite.All.
- Click Application permissions and search for “deviceManagementApps”. Check the box for DeviceManagementApps.ReadWrite.All
- Click Application permissions and search for “DeviceManagementService”. Check the box for DeviceManagementService.ReadWrite.All
- Search for “DeviceManagementConfiguration” and check the boxes for DeviceManagementConfiguration.Read.All and DeviceManagementConfiguration.ReadWrite.All. Proceed to click the Add Permissions button.
- Once all the rights are assigned, click Grant admin consent for [name of organization].
- Click Yes to grant the permission
- The permission should now be granted successfully.
How to Export Certificates to Azure Active Directory Using SSL.com Azure Integration Tool
The following sections provide instructions on how to use the SSL.com Azure Integration Tool to export certificates to Azure Active Directory.Requirements from SSL.com
- An active Identity pre-validation agreement also known as an Enterprise PKI (EPKI) Agreement. Find instructions here (Enterprise PKI (EPKI) Agreement Setup) to submit and activate this agreement. Once activated, the steps in the next section can be performed.
- Configured Microsoft Entra and Intune account, as described in this previous section: How to Configure Microsoft Intune and Microsoft Active Directory for S/MIME Certificates.
Configure Azure Sync
- Login to your SSL.com account and click Integrations on the top menu. From the listed options,, click Azure AD.
- Fill out the required fields for Azure integration. Afterwards, click the Save button.
- Client ID. Application (client) ID.
- Client Secret. Copy client secret(s) value from client credentials.
- Tenant ID. Directory (tenant) ID.
- Intune Public Key. Base64 version of the Public key exported from Intune connector server. For more details, check out this Microsoft resource.
Use the SSL.com Azure Integration Tool for Issuance of S/MIME certificates
- Once the Azure setting has been created. Click the Authorize link.
- Click Azure Users so that the list of users from Azure can be imported to SSL.com’s system.
- You will be prompted to login to your Microsoft account.
- Click the Import Users button on the SSL.com Azure Integration Tool.
- SSL.com will notify that the information of the Azure users who will be assigned digital certificates are in process of being imported. Reload the page to confirm that these have been imported.
- SSL.com will show the list of Azure users, indicated by their first name, last name, and email address. Tick the check box for all the users that will be assigned with a certificate. The amount of users displayed in the list can be increased by clicking the drop-down arrow at the lower-left of the page. Upon finalization of selected users, click the Enroll Certificate button to proceed.
- Accomplish the requirements for the certificate.
- Certificate: Choose the type of certificate you want to assign for the selected users.
- Duration: Specify the length of time before the certificate expires.
- Intended Purpose: Choose among General Purpose, SMIME Encryption, or SMIME Signing.
- After the choices are finalized, click the Add button.
- Certificate: Choose the type of certificate you want to assign for the selected users.
- Each user will be assigned a new certificate order from here. With the presence of an Identity pre-validation agreement, each order will be auto-validated and issued. The successful issuance of the certificate can be confirmed by clicking Orders from the top menu, followed by the details link of the particular order. By scrolling down and clicking the END ENTITY CERTIFICATES section, the details of the certificate will appear including its ISSUED status.
