Microsoft Azure Active Directory-Authentifizierung

Voraussetzungen

Der Microsoft Azure Active Directory-Connector unterstützt die folgenden Authentifizierungsmethoden:

• Anwendungszugriff – OAuth2.0 (Client-Anmeldeinformationen)
• Delegierter Zugriff – OAuth 2.0 (Autorisierungsgewährung)
• Client-Zertifikat-Authentifizierung – OAuth 2.0 (Client-Zertifikat)

Before creating a connection, you need an active Microsoft Azure application registration. To set one up:

1. Sign in to the Azure Portal and navigate to Azure Active Directory > App registrations.
2. Select New registration.
3. Enter a name for your application (for example, UiPath IS Azure AD).
4. Under Supported account types, select one of the following:
   • Accounts in this organizational directory only — for a single-tenant application.
   • Accounts in any organizational directory — for a multi-tenant application.
5. Wählen Sie Registrieren aus.

After registration, collect the following values from the app's Overview page — you will need them when creating the connection in Integration Service:

Wert	Where to find it
Anwendungs-ID (Client).	Overview page of the app registration
Verzeichnis-ID (Mandant)	Overview page of the app registration

Um eine Verbindung zu erstellen, müssen Sie die folgenden Anmeldeinformationen angeben:

• Für Anwendungszugriff:
  • Client-ID
  • Geheimer Clientschlüssel
  • Mandanten-ID
• Für delegierten Zugriff:
  • Client-ID
  • Geheimer Clientschlüssel
  • Mandanten-ID
  • Benutzername
  • Passwort
• Für die Client-Zertifikats-Authentifizierung:
  • Client-ID
  • OAuth Base64-Clientzertifikat
  • Passwort für das Zertifikat
  • Mandanten-ID
  • OAuth-Geltungsbereich

Weitere Informationen zu Authentifizierungsanmeldeinformationen und zum Einrichten der Azure Active Directory-Integration finden Sie unter Einrichten der Azure AD-Integration im Automation Cloud-Handbuch.

Zusätzliche Informationen sind in der offiziellen Microsoft-Dokumentation verfügbar: Grundlagen der Authentifizierung und Autorisierung, Einführung in Berechtigungen und Zustimmung, und Abrufen von Anmeldeinformationen.

Application access

Use this option to authenticate as the application itself, without a signed-in user context. This is the recommended option for unattended automation scenarios.

Setting up the client secret in Azure

1. In your Azure app registration, go to Certificates & secrets > Client secrets > New client secret.
2. Enter a description and select an expiry period.
3. Select Add and immediately copy the Value — it is shown only once.

Wichtig:

Client secrets expire. Rotate the secret before the expiry date to avoid connection failures.

Erforderliche API-Berechtigungen

In your Azure app registration, go to API permissions > Add a permission > Microsoft Graph > Application permissions and add the following:

Minimum required

Berechtigung	Typ	Beschreibung
User.Read.All	Anwendung	Read all users' full profiles
Group.Read.All	Anwendung	Read all groups
Directory.Read.All	Anwendung	Read directory data
RoleManagement.Read.Directory	Anwendung	Read all directory RBAC settings

Optional (add only if your automation creates or modifies objects)

Berechtigung	Typ	Beschreibung
Group.ReadWrite.All	Anwendung	Read and write all groups
Directory.ReadWrite.All	Anwendung	Read and write directory data
RoleManagement.ReadWrite.Directory	Anwendung	Read and write all directory RBAC settings

After adding the permissions, select Grant admin consent for [your organization].

Verbindungsfelder

Feld	Beschreibung
Client-ID	The Application (client) ID from the Overview section of your Azure app registration.
Geheimer Clientschlüssel	The secret value from the Certificates & secrets section. Use the Value, not the Secret ID.
Mandanten-ID	The Directory (tenant) ID from the Overview section of your Azure app registration.

Delegierter Zugriff

Use this option to perform actions on behalf of a signed-in user. The connection authenticates using OAuth 2.0 delegated permissions and prompts the user for consent during connection creation.

Setting up delegated access in Azure

1. In your Azure app registration, go to Authentication > Add a platform > Web.

2. In the Redirect URIs field, enter the callback URL displayed on the UiPath connection screen: https://{baseURL}/provisioning_/callback (for example, https://cloud.uipath.com/provisioning_/callback for Automation Cloud).

   Hinweis:

   The exact callback URL is shown on the connection creation screen in Integration Service. Copy it from there, as it may differ depending on your deployment (Automation Cloud, Automation Suite, or private cloud).

3. Under Implicit grant and hybrid flows, leave both checkboxes unselected.

4. Wählen Sie Konfigurieren aus.

Erforderliche API-Berechtigungen

In your Azure app registration, go to API permissions > Add a permission > Microsoft Graph > Delegated permissions and add the following:

Minimum required (needed to establish the OAuth connection)

Berechtigung	Typ	Beschreibung
openid	Delegiert	Sign users in
profile	Delegiert	View users' basic profile
email	Delegiert	View users' email address
offline_access	Delegiert	Maintain access to data when the user is not present
User.Read	Delegiert	Sign in and read user profile

Optional (add based on the operations your automation performs; permissions marked with * require admin consent)

Berechtigung	Typ	Beschreibung
User.ReadWrite	Delegiert	Read and update user profile
User.Read.All*	Delegiert	Read all users' full profiles
Group.Read.All*	Delegiert	Read all groups
Group.ReadWrite.All*	Delegiert	Read and write all groups
Directory.Read.All*	Delegiert	Read directory data
Directory.ReadWrite.All*	Delegiert	Read and write directory data

For permissions that require admin consent, select Grant admin consent for [your organization] after adding them.

Verbindungsfelder

Feld	Beschreibung
Client-ID	The Application (client) ID from the Overview section of your Azure app registration.
Geheimer Clientschlüssel	The secret value from the Certificates & secrets section. Use the Value, not the Secret ID.
Mandanten-ID	The Directory (tenant) ID from the Overview section of your Azure app registration. For multi-tenant applications, use common. For single-tenant applications, enter your specific tenant ID.

After filling in the fields, select Connect. A Microsoft sign-in window opens — sign in with the user account to be used for automation and grant the requested permissions.

Client-Zertifikats-Authentifizierung

Use this option to authenticate using a client certificate instead of a client secret.

Setting up a certificate in Azure

1. In your Azure app registration, go to Certificates & secrets > Certificates.
2. Select Upload certificate and upload your .cer or .pem public key file.
3. After upload, note the thumbprint value for your records.

Generating the certificate locally

To generate a certificate locally (if you do not already have one):

1. Create a self-signed certificate with Subject set to CN=uipath.com and Content Type set to PEM.
2. Download the certificate in .pfx format.
3. Convert the .pfx file to Base64-encoded format before entering it in the connection field.

You can also use a Powershell script. For example, the following script generates a self-signed certificate and exports it in the required formats:

# Generate self-signed cert
$cert = New-SelfSignedCertificate `
    -Subject "CN=uipath.com" `
    -CertStoreLocation "Cert:\CurrentUser\My" `
    -KeyExportPolicy Exportable `
    -KeySpec Signature `
    -KeyLength 2048 `
    -HashAlgorithm SHA256 `
    -NotAfter (Get-Date).AddYears(2)

# Export public key (.cer) — upload this to Azure
Export-Certificate -Cert $cert -FilePath ".\uipath.cer" -Type CERT

# Export private key (.pfx)
$pfxPassword = Read-Host "Enter PFX password" -AsSecureString
Export-PfxCertificate -Cert $cert -FilePath ".\uipath.pfx" -Password $pfxPassword

# Convert .pfx to Base64 — paste this value into the connection field
$base64 = [Convert]::ToBase64String([IO.File]::ReadAllBytes(".\uipath.pfx"))
$base64 | Out-File ".\uipath_base64.txt"

Write-Host "Thumbprint: $($cert.Thumbprint)"
Write-Host "Base64 saved to uipath_base64.txt"
Write-Host "Upload uipath.cer to Azure > Certificates & secrets > Certificates"

Erforderliche API-Berechtigungen

In your Azure app registration, go to API permissions > Add a permission > Microsoft Graph > Application permissions and add the following:

Minimum required

Berechtigung	Typ	Beschreibung
User.Read.All	Anwendung	Read all users' full profiles
Group.Read.All	Anwendung	Read all groups
Directory.Read.All	Anwendung	Read directory data

Optional (add only if your automation creates or modifies objects)

Berechtigung	Typ	Beschreibung
Group.ReadWrite.All	Anwendung	Read and write all groups
Directory.ReadWrite.All	Anwendung	Read and write directory data

After adding the permissions, select Grant admin consent for [your organization].

Verbindungsfelder

Feld	Beschreibung
OAuth Base64-Clientzertifikat	The client certificate in Base64-encoded format, converted from the .pfx file downloaded from Azure.
Passwort für das Zertifikat	The password set during certificate creation.
Client-ID	The Application (client) ID from the Overview section of your Azure app registration.
Mandanten-ID	The Directory (tenant) ID from the Overview section of your Azure app registration.

Verbindung hinzufügen

Um eine Verbindung mit Ihrer Microsoft Azure Active Directory-Instanz herzustellen, müssen Sie die folgenden Schritte ausführen:

1. Wählen Sie Orchestrator im Produktstartprogramm aus.
2. Wählen Sie einen Ordner aus und navigieren Sie dann zur Registerkarte Verbindungen .
3. Wählen Sie Verbindung hinzufügen aus.
4. Um die Seite zur Erstellung der Verbindung zu öffnen, wählen Sie den Konnektor in der Liste aus. Sie können die Suchleiste verwenden, um den Connector zu finden.
5. Wählen Sie in der Dropdownliste Authentifizierungstyp eine der verfügbaren Optionen aus: Client-Zertifikat-Authentifizierung, Anwendungszugriff, oder Delegierter Zugriff. Standardmäßig ist Anwendungszugriff ausgewählt.
6. Geben Sie die erforderlichen Anmeldeinformationen ein und wählen Sie Verbinden aus .