Skip to main content

Migrate Cloud Management Portal users to federated authentication

When enabling federated authentication, review the existing user management configuration to ensure it is compatible with the account identifier returned by Microsoft Entra ID.

Migration is only required if the account name format used by existing portal accounts differs from the value returned by Microsoft Entra ID in the preferred_username claim (typically the User Principal Name (UPN)).

Review the current configuration​

Before enabling federated authentication:

  1. Verify that the current account name format matches the value returned by Microsoft Entra ID in the preferred_username claim (typically the User Principal Name (UPN)).
  2. Review queries and mappings for new role type.
  3. Review account join rules.
  4. Review export mappings (if necessary).
  5. Review task mappings (if necessary).
  6. Configure federated authentication in the Cloud Management Portal.

Migrate to a new account name format​

If the account name format must be changed, perform the migration before enabling federated authentication for users.

Prerequisites

Before starting the migration, review all assignments with the Compliance status Not approved. Remove or approve these assignments, or ensure they are automatically approved before proceeding with the migration.

Migration procedure​

  1. Enable the review mode to prevent provisioning changes from being executed immediately.

  2. Disable automatic account creation.

  3. Run Recalculate All.

  4. Allow deprovisioning jobs to be generated, but do not execute them.

  5. Update the account name format configuration.

  6. Re-enable automatic account creation.

    • Verify that new accounts are created using the updated account name format and that existing resource assignments are reassigned.

  7. Review the generated provisioning jobs.

  8. Release the queued provisioning jobs.

info

Review mode allows provisioning jobs to be generated and reviewed before execution. This minimizes service disruption during the migration process.

Validate the migration​

Before releasing the queued provisioning jobs, verify that:

  • User accounts are correctly joined.
  • Existing role assignments have been re-established.
  • Existing resource assignments have been re-established.
  • No unexpected deprovisioning actions are present in the provisioning queue.
warning

Do not release the queued provisioning jobs until the migration results have been reviewed and validated.