- Getting started
- Best practices
- Organization Modeling in Orchestrator
- Managing Large Deployments
- Automation Best Practices
- Optimizing Unattended Infrastructure Using Machine Templates
- Organizing Resources With Tags
- Orchestrator Read-only Replica
- Exporting grids in the background
- About the Tenant Context
- Searching for Resources in a Tenant
- Managing Robots
- Connecting Robots to Orchestrator
- Storing Robot Credentials in CyberArk
- Storing Unattended Robot Passwords in Azure Key Vault (read-only)
- Storing Unattended Robot Credentials in HashiCorp Vault (read-only)
- Storing Unattended Robot Credentials in AWS Secrets Manager (read Only)
- Deleting Disconnected and Unresponsive Unattended Sessions
- Robot Authentication
- Robot Authentication With Client Credentials
- Resource Catalog Service
- Folders Context
- Bulk Uploading Queue Items Using a CSV File
- Managing Queues in Orchestrator
- Managing Queues in Studio
- Review Requests
- Storage Buckets
- Test Suite - Orchestrator
- Test Automation
- Host administration
- Host Administration Portals
- Configuring System Email Notifications
- Managing System Administrators
- Configuring Host Security
- Host Audit Logs
- Customizing the Login Page
- Maintenance Mode
- Identity Server
- Organization administration
- Managing tags
- Audit Logs
- Overriding System Email Settings
- Other Configurations
- Classic Robots
Configuring SSO: Azure Active Directory
These instructions only apply if you have a standalone installation of Orchestrator. If you are using Orchestrator in Automation Suite, follow the Automation Suite instructions instead.
If you enable the Azure AD integration at the host level, as described on this page, you cannot enable it at the organization/tenant level.
The integration at the host level only enables SSO. But if enabled at the organization/tenant level, the integration allows for SSO, but also for directory search and automatic user provisioning.
To set up the Azure AD integration, you need:
- admin permissions in both Orchestrator and Azure AD (if you don't have admin permissions in Azure, collaborate with an Azure administrator to complete the setup process);
- the UiPath organization administrator should have an Azure AD account that has the same email address as their UiPath account; the Azure AD account does not require admin permissions in Azure;
- your users need to use UiPath Studio and Assistant version 2020.10.3 or later;
- UiPath Studio and Assistant should be set up to use the recommended deployment.
- if you previously used local user accounts, make sure that all your Azure AD users have the email address in the Mail field; having the email address in the User Principle Name (UPN) field alone is not enough. The Azure AD integration links directory user accounts with the local user accounts if the email addresses match. This allows users to retain permissions when they transition from signing in with their local user account to the Azure AD directory user account.
- Log in to the Azure portal as an administrator.
- Go to App Registrations, and click New Registration.
- In the Register an application page, fill in the Name field with a name for your Orchestrator instance.
- In the Supported account types section, select Accounts in this organizational directory only.
- Set the Redirect URI by selecting Web from the drop-down list and filling in the URL of your Orchestrator instance, plus the suffix
/identity/azure-signin-oidc. For example,
- At the bottom, select the ID tokens checkbox.
- Click Register to create the app registration for Orchestrator.
- Save the Application (Client) ID to use it later.
- Log in to the Management portal as a system administrator.
- Click Security.Note: If you are still using the old Admin experience, go to Users instead of Security.
- Click Configure under Azure AD SSO.
- If you want to only allow logging in to Orchestrator using Azure AD, select the Force automatic login using this provider checkbox.
- Fill in the Display Name field with the label you want to use for the AzureAD button on the Login page.
- In the Client ID field, paste the value of the Application (Client) ID obtained from the Azure portal.
- (Optional) In the Client Secret field, paste the value obtained from the Azure portal.
Set the Authority parameter to one of the following values:
https://login.microsoftonline.com/<tenant>, where <tenant> is the tenant ID of the Azure AD tenant or a domain associated with this Azure AD tenant. Used only to sign in users of a specific organization.
https://login.microsoftonline.com/common. Used to sign in users with work and school accounts or personal Microsoft accounts.
- (Optional) In the Logout URL, paste the value obtained from the Azure portal.
- Click Save to save the changes to the external identity provider settings.
The page closes and you return to the Security Settings page.
- Click the toggle to the left of SAML SSO to enable the integration.
- Restart the IIS site. This is required after making any changes to External Providers.
Now that Orchestrator is integrated with Azure AD Sign-In, user accounts that have a valid Azure AD email address can use the Azure AD SSO option on the Login page to sign in to Orchestrator.
Each administrator must do this for their organization/tenant if they want to allow login with Azure AD SSO.
- Log in to Orchestrator as an administrator.
- Add local user accounts for your users, each with a valid Azure AD email address.