Clients upgrading to LMS v4 must add the new LMS v4 callback URL provided by Intellek to their SSO application to ensure proper functionality after the upgrade is complete. The new callback URI is designed for a Single-page application (SPA) in LMS v4, which differs from the Web application method used in LMS v3.

In addition, the LMS v4 callback URL must be added to both the Trusted Sites security zone and Pop-up Blocker exception lists.

Use the following steps as a guide to configure Microsoft Entra ID for LMS v4.

Register the Application

1.Open a web browser and sign in to the Microsoft Entra admin center using an account with administrative privileges.

2.Navigate to Entra ID > App Registrations, then select New registration.  

3.In the Name field, enter a descriptive name for the application, i.e. Intellek LMS SSO.

4.Under Supported account types, select Accounts in this organizational directory only.

5.Under Redirect URI:

oSelect Single-page application as the platform.

oEnter the redirect URI (callback URL) provided by Intellek, i.e. https://[name.v4.namelms.com/authentication/sso/callback]

6.Click Register.

Record the Application Details

After registration is complete copy and save the following values for future configuration:

oApplication (client) ID

oDirectory (tenant) ID

Note: These values are required when configuring authentication within LMS v4.

Configure Authentication Settings

1.In the application menu, select Authentication.

2.Verify the redirect URI is correct.

3.Under Implicit and hybrid flows, select the following checkboxes:  

oAccess tokens (used for implicit and hyrid flows)

oID tokens (used for implicit and hybrid flows)

4.Click Save.

Configure API Permissions

1.Select API permissions, then click Add a permission.

2.Grant the following permissions with Admin consent:

•For Single Sign-On (SSO):

oUser.Read (Delegated permissions)

•For Outlook Decline Functionality grant the Entra Application the following Application permissions (not Delegated) with Admin consent:

oUser.Read.All

oCalendar.Read

For additional information, see Outlook Decline - Technical Information.

Create a Client Secret

1.Select Certificates & secrets, then New client secret.

2.Enter a description and select an expiration period.

3.Click Add.

4.Copy and securely store the Client secret value. This value cannot be retrieved after you leave this page.

Configure LMS v4

Clients who have upgraded to LMS v4 can configure and manage their Single Sign-on credentials directly from the SSO Provider tab within the LMS Setup Authentication tool. See Configuring Authentication Methods.

First, register your application with your Azure Active Directory (Azure AD) tenant. This will give you an Application ID for your application, as well as enable it to receive tokens. 

1.Sign in to the Azure portal. 

2.If you have more than one Azure AD tenant, choose your Azure AD tenant by selecting your account in the top-right corner of the page, followed by selecting the Switch Directory navigation and then selecting the appropriate tenant. 

3.In the Azure portal, search for and select Azure Active Directory. 

4.In the Azure Active Directory left menu, select App registrations. Click to add a New registration. 

5.From the Register an application page, follow the prompts and create a new application. 

•Name is the application name and describes your application to end users. example: Intellek LMS SSO

•Under Supported account types, select Accounts in any organizational directory only.

6.Specify the Redirect URI.  - (Note: These instructions are for LMS v3. For LMS v4, see SSO Callback Configuration LMS v4.)

oSelect Web from the dropdown

oEnter https://[Intellek_LMS_URL]/authorization-code/callback where [Intellek_LMS_URL] is your LMS URL. 

•Click Register then Overview to overview your application.

7.Navigate to Certificates & secrets in the left menu.

8.Click to add a New client secret.

9.From the Add a client secret section

▪Enter a Description. example: Intellek LMS

▪Define your preferred expiration setting and add a reminder in your calendar to renew the client secret prior to that date.

▪Click Add

10.Copy/paste the Value (Client secret) in a safe place to use in later steps.  You won’t be able to copy it once you navigate away from this page.

11.Click Overview from the left panel. Once you've completed registration, Azure AD will assign your application a unique client identifier (the Application ID). Copy/paste this ID in a safe place to use in later steps.

12.Find and copy/paste your Azure AD tenant name in a safe place to use in later steps.

•Open the Custom domain names page. Find a domain that ends with .onmicrosoft.com. Copy/paste the tenant name in a safe place to use in later steps.

Configure the LMS to use Azure AD (legacy)

1.Important! Users’ Login in the LMS (User_Identifier in the import) MUST match their Azure Active Directory User name 

2.Contact Intellek Support ([email protected]) with the following information from your Azure portal 

oApplication (client) ID 

oClient secret for the above application 

oYour Azure AD tenant name (not to be confused with tenant ID)  - for example companyname.onmicrosoft.com

3.Intellek will configure your LMS instance with the above settings.