In the Admin application for Azure Active Directory, go to Enterprise Applications and select New Application.
Search for TonicDM and add it.
Select Properties, set User assignment required to No and then Save at the top of the page.
See the notes at the bottom of the page for discussion on this.
Select Single sign-on and choose SAML
In the Single Sign-on screen, edit box 1:
- Keep https://tonicdm.com/saml/metadata for the Identifier (Entity ID)
- Enter https://tonicdm.com/saml/callback for the Reply URL (Assertion Consumer Service URL)
- Enter https://tonicdm.com for the Sign on URL
- Relay State and Logout URL can be left blank
Edit box 2:
- Click on givenname and delete the text in the namespace field, then click OK.
- Do the same for surname.
The SAML Tokens Attributes will now look like this:
Now add the following claims:
Name Source attribute Namespace
displayname user.displayname leave blank then click Save
jobtitle user.jobtitle leave blank then click Save
telephonenumber user.telephonenumber leave blank then click Save
city user.city leave blank then click Save
streetaddress user.streetaddress leave blank then click Save
- If givenname and surname attributes are not set as above, a new user account will not be created in TonicDM. The other attributes are optional for automatic new user creation. The values of these for each user are set in:
Azure Active Directory > Users and Groups > All Users > username > Profile
- To have a TonicDM Office Location set for the newly created user, the Azure AD attributes city and streetaddress should be set. TonicDM will match the city attribute to an Office Location in TonicDM, or if no match is found, it will copy these values to create a new one.
Save your work. ("Save" is at the top of the panel)
The next steps involve collecting the information needed by TonicDM and emailing us at email@example.com.
Send TonicDM the Required Information
Download the Certificate - Base64 file from box 3 and attach it to an email.
At the bottom of box 4 click on View step-by-step instructions then copy the three bulleted URLs in the Quick Reference into the email. Be sure to include the full URLs as shown.
To recap: your email should include the following information:
- SAML Single Sign-On Service URL
- SAML Sign-Out URL
- SAML Entity ID URL
- The Certificate - Base64 file renamed to remove the extension
then send the email to firstname.lastname@example.org.
Next Step: Deploy the Add-in to Outlook for Users
- For customers with Exchange On-Prem in Hybrid mode, refer to this requirements document:
- It is not necessary to provision user accounts in TonicDM. When a new user authenticates with Azure AD, TonicDM will create their account on the fly.
Assigning Users to the TonicDM Enterprise Application
We recommend setting User Assignment is set to No.
If User Assignment is set to Yes in
Azure Active Directory > Enterprise Applications > All Applications > TonicDM > Properties
then all staff you want to give access need to be specified in:
Azure Active Directory > Enterprise Applications > All Applications > TonicDM > Users and Groups
Click Add User and you will be able to select from your firm’s users. Remember to click Select and Assign at the bottom of the panels!
Note: if you are not paying for Azure AD P2 then you'll need to assign TonicDM access to users' individual accounts. You can only assign by group with P2 (which is why we recommend setting User Assignment is set to No). If you have P2 and elect to assign by group, note that only top-level groups are supported (not nested groups).