CLASS: Setting up Microsoft Authentication

To set up Microsoft Authentication in CLASS for the first time, your Centre will need to follow the steps below.

Depending on whether or not your Centre’s CLASS Administrator is also your Azure/Microsoft Administrator will have an impact.

We’ve put together two guides to help you with this process.

I am the CLASS Administrator AND the Microsoft/Azure Administrator at my Centre

What you will need

An existing Microsoft Cloud tenant for your Organisation
Access to Azure Active Directory with any of the following roles:
- Global Administrator
- Application Administrator
- Cloud Application Administrator
Access to a CLASS user account in your Centre’s database with the CLASS Admin – Advanced role

Step 1: Obtain your Azure Tenant ID

You can get your Tenant ID by following the instructions from Microsoft.

Step 2: Enter your Tenant ID into CLASS Authentication Portal

Login to the CLASS Authentication portal with your usual CLASS username and password.
Click on System Settings in the bottom left of your screen.
Click on Centre Profile in the top left of your screen.
Paste the Tenant ID in the AD Tenant ID field in the General Information group.
Click Save & Close.

Step 3: Update your Username to match your Microsoft User Principal Name

From System Settings click on User Accounts.
Navigate the user list to locate your account – open it by clicking on the hyperlink in the Username column.
Make sure your Username matches with your Microsoft User Principal Name (‘UPN’) – this is the same as the Username you use to sign into Microsoft. You can get more information about UPN here.
If it doesn’t, click Change Username underneath the Username field in the Login Credential group.
In the window that pops up, enter the UPN into the New Username field.
Click Save & Close.

You only need to do this step for yourself. We have a template you can fill out for all other users as this will be much faster.

Step 4: Grant Permissions to the CLASS AAD Application

Visit the User Registration portal, click Sign in with Microsoft, and follow the prompts to sign into your Microsoft account.
You will be asked to consent on behalf of your organisation to grant permissions to the CLASS Azure Active Directory Application in your Tenant.
1. To accept tick Consent on behalf of your organisation; and
2. Click Accept.
Success! The CLASS AAD Application should now be visible in Azure Active Directory under Enterprise Applications.

This step only needs to be completed once per Azure Tenant.

Warning: Once the live version of CLASS is switched over to Azure Active Directory authentication in November you will be unable to access CLASS without it. If you have concerns about granting permissions at this step please contact us urgently.

Step 5: Claim your Username in the CLASS AAD Application and verify access

Once you click Accept to the Azure AAD application you will be taken to the User Registration page;
1. Click Save My Claim; and
2. Sign out.
Wait at least 10 minutes for the AD Object ID field to be populated against your CLASS User record in the CLASS Authentication portal.
Navigate to the CLASS Login Test site.
Click Single Sign On and follow any Microsoft login prompts. If the Message Board is visible, it has worked! Hover over your name in the top right corner and click Sign out.

Congratulations! Your CLASS User Account is now configured for Microsoft Single Sign on.

Tip: You can check to see if your User account has connected to the CLASS Authentication portal by closing and re-opening your user account.

I am the CLASS Administrator BUT NOT the Microsoft/Azure Administrator at my Centre

Azure Administrator will need

An existing Microsoft Cloud tenant for your Organisation
Access to a network with an IP address in our IP whitelist
Access to Azure Active Directory with any of the following roles:
- Global Administrator
- Application Administrator
- Cloud Application Administrator

CLASS Administrator will need

A CLASS user account in your Centre’s database with the CLASS Admin – Advanced role
A Microsoft account in the same tenant being administered by the Azure Administrator (this user does not need elevated permissions in Azure)

Step 1: Obtain your Azure Tenant ID – Azure Admin

You can get your Tenant ID by following the instructions from Microsoft.

Step 2: Enter your Tenant ID into CLASS Authentication Portal – CLASS Admin

Login to the CLASS Authentication portal with your usual CLASS username and password.
Click on System Settings in the bottom left of your screen.
Click on Centre Profile in the top left of your screen.
Paste the Tenant ID in the AD Tenant ID field in the General Information group.
Click Save & Close.

Step 3: Update your Username to match your Microsoft User Principal Name – CLASS Admin

From System Settings click on User Accounts.
Navigate the user list to locate your account – open it by clicking on the hyperlink in the Username column.
Make sure your Username matches with your Microsoft User Principal Name (‘UPN’) – this is the same as the Username you use to sign into Microsoft. You can get more information about UPN here.
If it doesn’t, click Change Username underneath the Username field in the Login Credential group.
In the window that pops up, enter the UPN into the New Username field.
Click Save & Close.

You only need to do this step for yourself. We have a template you can fill out for all other users as this will be much faster.

Step 4: Grant Permissions to the CLASS AAD Application – Azure Admin

Visit the User Registration portal, click Sign in with Microsoft, and follow the prompts to sign into your Microsoft account.
You will be asked to consent on behalf of your organisation to grant permissions to the CLASS Azure Active Directory Application in your Tenant.
1. To accept tick Consent on behalf of your organisation; and
2. Click Accept.
Success! The CLASS AAD Application should now be visible in Azure Active Directory under Enterprise Applications.

This step only needs to be completed once per Azure Tenant.

Note: To access any of the sites in this document you need to be on our CLASS IP whitelist – if you get a timeout please contact us to get you added temporarily in order to complete the setup.

Warning: Once the live version of CLASS is switched over to Azure Active Directory authentication in November you will be unable to access CLASS without it. If you have concerns about granting permissions at this step please contact us urgently.

Step 5: Claim your Username in the CLASS AAD Application and verify access – CLASS Admin

Once your Azure Admin has completed step 4, you will also need to sign into the User Registration page. From there, simply;
1. Click Save My Claim; and
2. Sign out.
Wait at least 10 minutes for the AD Object ID field to be populated against your CLASS User record in the CLASS Authentication portal. What if the ID doesn’t sync?
Navigate to the CLASS Login Test site.
Click Single Sign On and follow any Microsoft login prompts. If the Message Board is visible, it has worked! Hover over your name in the top right corner and click Sign out.

Congratulations! Your CLASS User Account is now configured for Microsoft Single Sign on.

Tip: You can check to see if your User account has connected to the CLASS Authentication portal by closing and re-opening your user account.

Troubleshooting

AD Object ID does not sync to CLASS

We have found some Azure environments have been configured with policies to deny end-user access to Cloud Applications. There are two separate settings that may cause this issue. They are:

User assignment; and
End-user consent

An Azure Administrator will need to amend policies to allow the CLASS AAD Application to let users grant consent to sync their own user data.

What if we don't want to change this?

You do not need to grant users permission to save their claim through the registration website – this will just mean that the CLASS Admin will need to manually paste in the AD Object ID into the user account in CLASS. New CLASS users created after MFA is implemented will receive a link to this site in place of the existing password reset link they currently get so you will also need to tell users to ignore this link.

CLASS: Setting up Microsoft Authentication

What you will need

Step 1: Obtain your Azure Tenant ID

Step 2: Enter your Tenant ID into CLASS Authentication Portal

Step 3: Update your Username to match your Microsoft User Principal Name

Step 4: Grant Permissions to the CLASS AAD Application

Step 5: Claim your Username in the CLASS AAD Application and verify access

Congratulations! Your CLASS User Account is now configured for Microsoft Single Sign on.

Azure Administrator will need

CLASS Administrator will need

Step 1: Obtain your Azure Tenant ID – Azure Admin

Step 2: Enter your Tenant ID into CLASS Authentication Portal – CLASS Admin

Step 3: Update your Username to match your Microsoft User Principal Name – CLASS Admin

Step 4: Grant Permissions to the CLASS AAD Application – Azure Admin

Step 5: Claim your Username in the CLASS AAD Application and verify access – CLASS Admin

Congratulations! Your CLASS User Account is now configured for Microsoft Single Sign on.

Troubleshooting

Acknowledgement of Country

Community Legal Centres Australia is inclusive of everyone in our community