diff --git a/docs/directorymanager/11.1/admincenter/workflow/advancedsettings.md b/docs/directorymanager/11.1/admincenter/workflow/advancedsettings.md index 1d14203ec6..84192d9889 100644 --- a/docs/directorymanager/11.1/admincenter/workflow/advancedsettings.md +++ b/docs/directorymanager/11.1/admincenter/workflow/advancedsettings.md @@ -17,17 +17,17 @@ Functions discussed in this topic are licensed under different add-ons. See the ## Specify a Default Approver -You can designate a recipient as the default approver for workflow requests. Requests are routed to -this recipient based on the following rules: +You can designate a recipient as the default approver for workflow requests. Directory Manager routes +requests to this recipient based on the following rules: -- When approver acceleration is not enabled, the applicable rules are discussed in the +- When approver acceleration isn't enabled, the applicable rules are discussed in the [Workflow Approval Scenarios](overview.md#workflow-approval-scenarios) topic. - When approver acceleration is enabled: - - A request is sent to the default approver when the last approver in the acceleration chain - does not approve or deny it within the specific number of days. - - A request is routed to the default approver when the hierarchy breaks at any point in the - acceleration chain. For example, if the maximum acceleration level is set to 3 but there is no + - Directory Manager sends a request to the default approver when the last approver in the + acceleration chain doesn't approve or deny it within the specific number of days. + - Directory Manager routes a request to the default approver when the hierarchy breaks at any + point in the acceleration chain. For example, if the maximum acceleration level is set to 3 but there is no recipient to accelerate the request after second level acceleration, the request goes to the default approver. @@ -92,4 +92,4 @@ example, you can delete the ‘denied’ requests that are old by 30 days or mor ## Integrate with Microsoft Power Automate You can also link your Power Automate flows to Directory Manager workflows. For details, see the -[Integrate with Power Automate](/docs/directorymanager/11.1/admincenter/workflow/integrate.md) topic. +[Integrate with Power Automate](/docs/directorymanager/11.1/admincenter/workflow/powerautomate/integrate.md) topic. diff --git a/docs/directorymanager/11.1/admincenter/workflow/implement.md b/docs/directorymanager/11.1/admincenter/workflow/implement.md index 75d3ca1818..13271bafe6 100644 --- a/docs/directorymanager/11.1/admincenter/workflow/implement.md +++ b/docs/directorymanager/11.1/admincenter/workflow/implement.md @@ -8,8 +8,8 @@ sidebar_position: 10 To create a workflow, you have to specify the following: -- **Object** - the object(s) - user, contact, group - to apply the workflow to. -- **Event** - a create, edit, or delete event that, when performed for the object(s), would trigger +- **Object** - the objects - user, contact, group - to apply the workflow to. +- **Event** - a create, edit, or delete event that, when performed for the objects, would trigger the workflow. - **Field** - one or more fields (attributes) that the workflow would apply to. When the values of these attributes change for the object, an approval request is triggered. @@ -43,7 +43,7 @@ But if you add a filter as: | employee Type | Not Equals | manager | It implies that when a manager edits the value of the _criteria_ attribute, the change is effective -immediately and this workflow does not apply. When a non-manager user changes the value of the +immediately and this workflow doesn't apply. When a non-manager user changes the value of the attribute, it triggers the workflow. ## View the Workflows @@ -59,8 +59,8 @@ attribute, it triggers the workflow. | Enable | Shows whether a workflow is enabled or disabled Use the toggle button next to a workflow to enable or disable it. | | Type | A workflow has one of these types:
| | Name | A descriptive name for a workflow that identifies the action the workflow audits | - | Object(s) | The directory object(s) the workflow applies to | - | Approver(s) | The approver(s) specified for a workflow. Approver(s) are responsible for approving or denying the requests generated for the workflow. | + | Objects | The directory objects the workflow applies to | + | Approvers | The approvers specified for a workflow. Approvers are responsible for approving or denying the requests generated for the workflow. | | Event | The event that triggers a workflow | 4. You can perform the following actions: @@ -79,7 +79,7 @@ attribute, it triggers the workflow. right corner. 5. On the **Create Workflow** page, enter a name for the workflow In the **Name** box. 6. Select one or more objects (User, Contact, Group) to apply the workflow to. -7. In the **Events** drop-down list, select the event (Create, Edit, Delete) that will trigger the +7. In the **Events** dropdown list, select the event (Create, Edit, Delete) that will trigger the workflow. :::note @@ -89,31 +89,31 @@ attribute, it triggers the workflow. ::: -8. Select the **Mail Approval** check box to enable the approver to approve or deny a workflow +8. Select the **Mail Approval** checkbox to enable the approver to approve or deny a workflow request from within the workflow email notification. These notifications contain the **Accept** and **Deny** buttons. On clicking any of these, the approver is redirected and auto-authenticated on the Directory Manager portal, where he or she can approve or deny the request. - When this check box is not selected, the **Accept** and **Deny** buttons are not available in the + When this checkbox isn't selected, the **Accept** and **Deny** buttons aren't available in the email notifications. Approvers have to sign into the Directory Manager portal to manage workflow requests. -9. The **Approver Acceleration** check box applies if approver acceleration is enabled for the +9. The **Approver Acceleration** checkbox applies if approver acceleration is enabled for the identity store. See the [Apply Approver Acceleration](approveracceleration.md#apply-approver-acceleration) topic. - To apply approver acceleration to this workflow, select the **Approver Acceleration** check box. - - To exempt this workflow from approver acceleration, clear this check box. + - To exempt this workflow from approver acceleration, clear this checkbox. 10. Enter a brief description for the workflow in the **Description** box. -11. In the **Portal URL** drop-down list, select a Directory Manager portal URL to include in the +11. In the **Portal URL** dropdown list, select a Directory Manager portal URL to include in the workflow email notifications. The URL will redirect the recipients to the portal for taking action on a request, such as approve or deny it. The list contains URLs of Directory Manager portals linked with the identity store. -12. Click **Add Approver(s)** in the **Approver(s)** section to select the users and groups to - approve the requests generated for this workflow: The **Add Approver(s)** dialog box is +12. Click **Add Approvers** in the **Approvers** section to select the users and groups to + approve the requests generated for this workflow: The **Add Approvers** dialog box is displayed. - 1. Fields on the **Add Approver(s)** dialog box vary, depending on the object and event + 1. Fields on the **Add Approvers** dialog box vary, depending on the object and event selected. Then select one or more of the available options: | Option | Available For | Description | @@ -122,9 +122,9 @@ attribute, it triggers the workflow. | Owner and Additional Owner of the Group | _Edit_ and _delete_ events of the _Group_ object | Select it to specify the group’s primary and additional owners as the request approvers. | | Manager of User | _Edit_ and _Delete_ events of the _User_ and _Contact_ objects | Select it to specify the user’s or contact’s primary manager as the request approver. | | Manager and Additional Manager of User | _Edit_ and _Delete_ events of the _User_ and _Contact_ objects | Select it to specify the user’s/contact’s primary and additional managers as the request approvers. | - | Search Container Include Sub-Containers Search box | For all objects and events | You can specify one or more users and groups as approvers. In case of a group, all its members are set as approvers. Specify a container to search for the desired object(s); then perform a search to locate and select the object.
| + | Search Container Include Sub-Containers Search box | For all objects and events | You can specify one or more users and groups as approvers. In case of a group, all its members are set as approvers. Specify a container to search for the objects you want; then perform a search to locate and select the object.
| - 2. Click **Add** to close the **Add Approver(s)** dialog box. + 2. Click **Add** to close the **Add Approvers** dialog box. 13. Use the **Filters** section to specify a criterion; anything beyond that criterion will not trigger the workflow. For example, when you define the following filter: @@ -135,23 +135,23 @@ attribute, it triggers the workflow. This workflow will trigger when a security group is deleted. However, when a group object with type other than ‘Security’ is deleted, this workflow will not trigger. - 1. In the **Filter(s)** section, click **Add Filter(s)**. The **Add Filter** dialog box is + 1. In the **Filters** section, click **Add Filters**. The **Add Filter** dialog box is displayed. 2. Select a schema attribute from the _field_ list. 3. Select an operator to evaluate the attribute from the _operator_ list. - **Present** - returns objects that have a value specified for the attribute. - - **Not Present** - returns objects that do not have a value specified for the attribute. + - **Not Present** - returns objects that don't have a value specified for the attribute. - **Equals** - returns objects when the attribute value exactly matches the text you specify in the value box. - - **Not Equals** - returns objects when the attribute value does not match the text you + - **Not Equals** - returns objects when the attribute value doesn't match the text you specify in the value box. - 4. Enter a value in the _value_ box (not case-sensitive). This box is not available for the - _Present_ and _Not Present_ operators, which are not comparison operators. + 4. Enter a value in the _value_ box (not case-sensitive). This box isn't available for the + _Present_ and _Not Present_ operators, which aren't comparison operators. 5. Click **Add** to close the **Add Filter** dialog box. -14. Use the **Field(s)** section to specify the fields (attributes) that you want to apply the +14. Use the **Fields** section to specify the fields (attributes) that you want to apply the workflow to. For example, when you define a workflow as: Object: User @@ -159,17 +159,17 @@ attribute, it triggers the workflow. Filter: Department = IT Field: Email This workflow will trigger when the Email field for a user object with department set to IT is - edited. It will not be triggered when the Email field is edited for a user that does not belong + edited. It will not be triggered when the Email field is edited for a user that doesn't belong to the IT department, or when a field other than Email is edited for a user in the IT department. - 1. To add a field, click **Add Field(s)** in the **Field(s)** section. - 2. On the **Add Fields** dialog box, select the check box for a field to add it to the workflow + 1. To add a field, click **Add Fields** in the **Fields** section. + 2. On the **Add Fields** dialog box, select the checkbox for a field to add it to the workflow and click **Add**. :::note - The **Field(s)** section is not available when _Create_ is selected in the **Events** - drop-down list. + The **Fields** section isn't available when _Create_ is selected in the **Events** + dropdown list. ::: @@ -183,7 +183,7 @@ attribute, it triggers the workflow. You can define Power-Automate settings for a workflow to link that workflow to a Power Automate flow. -These settings enable you to connect to Power Automate from within a workflow (say Workflow1) and +Use these settings to connect to Power Automate from within a workflow (say Workflow1) and create a basic flow template there. On providing the URL of the flow template in Workflow1, the two are linked. As a result, the flow auto triggers when the Directory Manager workflow is triggered. @@ -211,8 +211,8 @@ approver acceleration, and link it to a Power Automate flow. update the required information. 6. To link this workflow to a Power Automate flow, click **Power Automate Settings** in the top right corner; the **Power Automate Settings** dialog box is displayed. Follow step - [6](/docs/directorymanager/11.1/admincenter/workflow/integrate.md) and onwards in the - [Link an Identity Store Workflow to a Flow](integrate.md#link-an-identity-store-workflow-to-a-flow) + [6](/docs/directorymanager/11.1/admincenter/workflow/powerautomate/integrate.md) and onwards in the + [Link an Identity Store Workflow to a Flow](powerautomate/integrate.md#link-an-identity-store-workflow-to-a-flow) topic to complete the task. 7. After making the required changes, click **Update Workflow** on the **Edit Workflow** page to save the settings. @@ -249,7 +249,7 @@ You can enable or disable a workflow in any of the following ways. ## Delete a User-defined Workflow Workflows in an identity store can have their type as _System_ or _User Defined_. You can delete -user-defined workflows; system workflows cannot be deleted. +user-defined workflows; system workflows can't be deleted. **To delete a workflow:** diff --git a/docs/directorymanager/11.1/admincenter/workflow/integrate.md b/docs/directorymanager/11.1/admincenter/workflow/integrate.md deleted file mode 100644 index 6b2f68751a..0000000000 --- a/docs/directorymanager/11.1/admincenter/workflow/integrate.md +++ /dev/null @@ -1,130 +0,0 @@ ---- -title: "Integrate with Power Automate" -description: "Integrate with Power Automate" -sidebar_position: 40 ---- - -# Integrate with Power Automate - -You can link an identity store in Directory Manager to Power Automate to achieve the following: - -- **Trigger a flow from** Directory Manager - To achieve this, you have to link a workflow in an - identity store to a Power Automate flow. When the Directory Manager workflow is triggered, the - linked flow is auto triggered. - -## Trigger a Flow from Directory Manager - -You can link a workflow in an identity store to a flow. Both system and user-defined workflows can -be linked to flows. - -- As a one-time process, connect your identity store to Microsoft Power Automate .See the Connect an - Identity Store to Power Automate topic. -- Link a workflow to a flow by providing the URL of that flow in the workflow .See the Link an - Identity Store Workflow to a Flow topic. - -Consequently, when the identity store workflow is triggered, the linked flow is auto triggered. - -:::note -When the flow is approved in Power Automate, the identity store workflow request is auto -approved. However, if the identity store workflow request is approved first, the flow would not be -auto approved. -::: - - -### Connect an Identity Store to Power Automate - -To connect an identity tore to Power Automate, you must configure a Power Automate client for that -identity store. This will establish a communication channel between the Directory Manager Data -service and the Power Automate platform. - -:::note -Make sure the Directory Manager server is deployed on a machine that is exposed over the -Internet, as Power Automate needs to communicate with the Directory Manager server for processing -requests. Power Automate cannot communicate with a server deployed on a machine behind NAT. -::: - - -**To configure a Power Automate client for an identity store:** - -1. In Admin Center, click **Identity Stores** in the left pane. -2. On the **Identity Stores** page, click the ellipsis button for an identity store and select - **Edit**. -3. Click **Workflows** under **Settings** in the left pane. -4. On the **Workflows** page, click the **Advanced Workflow Settings** tab. -5. In the **Power Automate Settings** section, click **Register Client**. -6. Enter the following information: - - - **Organization Code** - the unique name for the environment that stores your flows in Power - Automate. - - **Region** - the location of your environment. - - **Directory Manager Data Service URL** - the URL of the Data service. Requests from Power - Automate will communicate with the Data service endpoint. The URL is as: - `https:///` For example: - https://powerautomate-netwrix1.msappproxy.net/directorymanagerdataservice - - **Tenant ID** - the tenant ID assigned to the Directory Manager application when you - registered it in Microsoft Entra Admin Center. - - **Client ID** - the application ID assigned to the Directory Manager application when you - registered it in Microsoft Entra Admin Center. - - :::note - The Directory Manager application in Microsoft Entra Admin Center must have the following - permissions for Power Automate: - ![pa_permissions](/images/directorymanager/11.1/admincenter/workflow/pa_permissions.webp) - ::: - - -7. Click **Save** on the **Advanced Workflow Settings** page. - -### Link an Identity Store Workflow to a Flow - -To link an identity store workflow to a Power Automate flow, generate a flow template from an -identity store workflow and provide the URL of the flow in workflow settings. When the workflow is -triggered, the linked flow is auto triggered. - -**To link a workflow to a flow:** - -1. In Admin Center, click **Identity Stores** in the left pane. -2. On the **Identity Stores** page, click the ellipsis button for an identity store and select - **Edit**. -3. Click **Workflows** under **Settings** in the left pane. -4. On the **Configure Workflows** tab of the **Workflows** page, click the ellipsis button for a - workflow and select **Edit**. -5. On the **Edit Workflow** page, click **Power Automate Settings** in the top right corner. -6. On the **Power Automate Settings** dialog box, provide the username and password of a Microsoft - Entra ID account for managing flows in the Microsoft Power Automate portal. This account must - have the following permissions on the Entra tenant: - - ![pa_permissions](/images/directorymanager/11.1/admincenter/workflow/pa_permissions.webp) - -7. Click **Create Template**. Directory Manager creates a basic flow in Power Automate with the same - name as the workflow, and displays the following message: - - ![pa_template_message](/images/directorymanager/11.1/admincenter/workflow/pa_template_message.webp) - -8. The next step is to copy the flow URL from Power Automate and provide it here. To copy the URL, - do the following: - - 1. Launch Power Automate and navigate to **Environments > GroupID application > My Flows**. This - page displays the flow you created in Power Automate from the Directory Manager workflow. - 2. Hover the mouse over the flow to display the ellipsis button. Click it and select **Edit**. - 3. Expand the **Connections** area. - - ![connections_area](/images/directorymanager/11.1/admincenter/workflow/connections_area.webp) - - 4. Click **Approvals** in the **Connections** area. The approver of the Directory Manager - workflow is auto added here. Click **Save**. - 5. Expand the **When a HTTP request is received** area and copy the URL displayed for **HTTP - POST URL**. - -9. In Directory Manager, return to the workflow being linked to the flow, and click **Configure a - Request URL** on the **Power Automate Settings** dialog box. -10. Enter the copied HTTP POST URL in the **Request URL** box. -11. Click **Authenticate** and then **Save**. -12. Click **Update Workflow** on the **Edit Workflow** page to save the settings. -13. Click **Save** on the **Workflows** page. -14. Next, enable the linked flow in Power Automate. To do so: - - 1. In Power Automate, navigate to **Environments > GroupID application > My Flows**. This page - displays the flow you created in Power Automate from the Directory Manager workflow. - 2. Hover the mouse over the flow to display the ellipsis button. Click it and select **Turn - on**. diff --git a/docs/directorymanager/11.1/admincenter/workflow/powerautomate/_category_.json b/docs/directorymanager/11.1/admincenter/workflow/powerautomate/_category_.json new file mode 100644 index 0000000000..f5ebca4cc0 --- /dev/null +++ b/docs/directorymanager/11.1/admincenter/workflow/powerautomate/_category_.json @@ -0,0 +1,10 @@ +{ + "label": "Integrate with Power Automate", + "position": 40, + "collapsed": true, + "collapsible": true, + "link": { + "type": "doc", + "id": "integrate" + } +} \ No newline at end of file diff --git a/docs/directorymanager/11.1/admincenter/workflow/powerautomate/installproxy.md b/docs/directorymanager/11.1/admincenter/workflow/powerautomate/installproxy.md new file mode 100644 index 0000000000..e97d23e504 --- /dev/null +++ b/docs/directorymanager/11.1/admincenter/workflow/powerautomate/installproxy.md @@ -0,0 +1,156 @@ +--- +title: "Install Reverse Proxy for Power Automate" +description: "Install Reverse Proxy for Power Automate" +sidebar_position: 10 +--- + +# Power Automate Reverse Proxy — Installation Guide + +## Overview + +The **Power Automate Reverse Proxy** is a required component for the Netwrix Directory Manager (NDM) +integration with Microsoft Power Automate. When a Power Automate workflow needs to approve or deny a +directory request, it calls back into your NDM environment to deliver the decision. +Because Power Automate runs in Microsoft's cloud, your NDM DataService must be reachable over the public internet. + +The reverse proxy is a lightweight service you install on your NDM server. +It sits in front of the DataService and acts as a hardened entry point. + +## Prerequisites + +Before running the installer, ensure the following are in place: + +| Requirement | Details | +|-------------|---------| +| Administrator access | The installer must be run as Administrator | +| NDM DataService running | The proxy forwards to it; it must be reachable on the same machine or network | +| NDM Security Token Service (STS) running | Used for internal authentication | +| SQL Server access | The installer registers the proxy in the NDM database. Windows Authentication is recommended; SQL login is also supported | +| A publicly trusted TLS certificate | See **TLS Certificate Requirements** | +| An available public-facing port | A TCP port that is reachable from the internet and not used by another service | + +### TLS Certificate Requirements + +Power Automate runs in Microsoft's cloud and validates your proxy's TLS certificate against the **Microsoft Trusted Root Program**. +It silently rejects certificates issued by internal or private certificate authorities — you must obtain a certificate from a publicly trusted CA. + +The certificate must be issued for the **public DNS hostname** your proxy will be reachable at. +The installer derives this hostname automatically from the certificate's Subject Alternative Name (SAN) +and uses it for all bindings and URLs. + +The installer expects two PEM files: + +| File | Content | +|------|---------| +| Certificate file (`--cert-path`) | The leaf certificate, followed by any intermediate CA certificates (full-chain PEM) | +| Private key file (`--key-path`) | The RSA or EC private key corresponding to the certificate | + +## Installation + +### 1. Obtain the installer package + +Extract the archive — it contains the proxy binaries and `Imanami.PowerAutomateProxy.Installer.exe`. + +### 2. Run the installer + +Open **PowerShell 7 as Administrator** on the target server and run: + +```powershell +.\Imanami.PowerAutomateProxy.Installer.exe ` + --cert-path "C:\certs\fullchain.pem" ` + --key-path "C:\certs\privkey.pem" ` + --port 443 ` + --sql-server localhost +``` + +If Windows Authentication isn't available for the NDM database, add `--sql-user ` — the password will be prompted interactively. + +#### All parameters + +| Parameter | Required | Description | +|-----------|----------|-------------| +| `--cert-path` | Yes | Path to the full-chain PEM certificate file | +| `--key-path` | Yes | Path to the PEM private key file | +| `--port` | Yes | HTTPS port the proxy will listen on. Must be reachable from the internet | +| `--sql-server` | Yes | SQL Server hostname or instance (e.g. `localhost` or `SERVER\SQLEXPRESS`) | +| `--zip-path` | No | Path to the proxy zip archive. Defaults to `PowerAutomateProxy.zip` next to the installer | +| `--sql-database` | No | NDM database name. Defaults to `GroupID` | +| `--sql-user` | No | SQL login name. Omit to use Windows Authentication (recommended) | +| `--sql-trust-server-certificate` | No | Flag. Skip SQL Server TLS validation. Use only if SQL Server uses a self-signed certificate | +| `--sts-authority` | No | NDM STS base URL. Auto-discovered from the database when omitted | +| `--data-service-url` | No | NDM DataService base URL. Auto-discovered from the database when omitted | +| `--known-proxies` | No | Comma-separated IP addresses of load balancers in front of the proxy, if any (e.g. `10.0.0.1`) | +| `--known-networks` | No | Comma-separated trusted upstream CIDR ranges, if any (e.g. `10.0.0.0/8`) | + +:::note +The installer doesn't roll back on failure. If it stops midway, see [Manual cleanup](#manual-cleanup-after-a-failed-install) before retrying. +::: + +## Verification + +The installer runs tests automatically at the end of installation. If the tests pass, Power Automate Proxy is ready for use. + +## Reinstalling or upgrading + +Re-run the installer with the same parameters. It safely handles existing installations: + +- If the proxy is already registered in the NDM database, the installer reuses the existing registration. +- If the IIS site and app pool already exist, the installer preserves them and only updates the binaries. +- The installer always replaces the proxy binaries with the contents of the new zip archive. + +## Manual cleanup after a failed install + +If the installer stopped partway through, remove the components that were created before retrying: + +1. **Remove the HTTP.sys certificate binding** (PowerShell): + ```powershell + netsh http delete sslcert ipport=0.0.0.0: + ``` +2. **Remove the IIS site**: IIS Manager → Sites → right-click **PAProxy** → Remove. +3. **Remove the IIS application pool**: IIS Manager → Application Pools → right-click **DirectoryManager_PowerAutomateReverseProxy** → Remove. +4. **Remove the publish directory**: + ``` + C:\Program Files\Imanami\GroupID 11.0\PowerAutomateProxy\Web\PowerAutomateProxy + ``` +5. **Remove the firewall rule**: Windows Defender Firewall with Advanced Security → Inbound Rules → find `DirectoryManager-PowerAutomateReverseProxy-` → Delete. + +## Troubleshooting + +### Power Automate can't reach the proxy + +- Confirm the proxy port is open in both Windows Firewall and any network firewall or NAT rules between the internet and the server. +- Confirm the DNS record for your proxy hostname points to the server's public IP address. +- Test connectivity from an external machine: `Invoke-WebRequest https://:/health` + +### Power Automate returns a TLS certificate error + +- Confirm the certificate was issued by a publicly trusted CA (not an internal CA or self-signed). +- Confirm the certificate's hostname matches the DNS name Power Automate is calling. +- If using a CDN or reverse proxy in front (e.g. Cloudflare), ensure it is configured in **DNS-only** mode — proxied/orange-cloud mode changes the TLS certificate and breaks the trust chain. + +### `Certificate chain validation failed` during installation + +The installer validates the certificate chain before proceeding. Common causes: + +- The PEM file contains only the leaf certificate, not the full chain — use the full-chain file (e.g. `fullchain.pem` from Let's Encrypt, not `cert.pem`). +- The certificate was issued by an internal or private CA. Power Automate will also reject it — a publicly trusted certificate is required. + +### `STS token request failed: invalid_client` at runtime + +The proxy's `appsettings.json` has a missing or blank client ID. This typically happens when the proxy binaries were redeployed (e.g. during an upgrade) without re-running the installer. Always run `Imanami.PowerAutomateProxy.Installer.exe` after replacing the proxy zip — it updates `appsettings.json` in place. + +### IIS site fails to start (HTTP 503) + +- Check the `DirectoryManager_PowerAutomateReverseProxy` application pool is started in IIS Manager. +- Check that the `logs\` directory under the publish path exists and the app pool identity has write access to it. + +### STS or DataService URL auto-discovery failed + +The installer looks up the NDM service URLs from the database automatically. If your server hosts multiple NDM deployments or the URLs aren't registered, provide them explicitly: + +```powershell +.\Imanami.PowerAutomateProxy.Installer.exe ` + --sts-authority https://:/GroupIDSecurityService ` + --data-service-url https://:/GroupIDDataService ` + ... (other parameters) +``` \ No newline at end of file diff --git a/docs/directorymanager/11.1/admincenter/workflow/powerautomate/integrate.md b/docs/directorymanager/11.1/admincenter/workflow/powerautomate/integrate.md new file mode 100644 index 0000000000..a18aa57a0b --- /dev/null +++ b/docs/directorymanager/11.1/admincenter/workflow/powerautomate/integrate.md @@ -0,0 +1,117 @@ +--- +title: "Integrate with Power Automate" +description: "Integrate with Power Automate" +sidebar_position: 40 +--- + +# Integrate with Power Automate + +You can link an identity store in Directory Manager to Power Automate to achieve the following: + +- **Trigger a flow from** Directory Manager - To achieve this, you have to link a workflow in an + identity store to a Power Automate flow. When the Directory Manager workflow triggers, the + linked flow triggers automatically. + +## Trigger a Flow from Directory Manager + +You can link a workflow in an identity store to a flow. You can link both system and user-defined +workflows to flows. + +- As a one-time process, connect your identity store to Microsoft Power Automate. See the + [Connect an Identity Store to Power Automate](#connect-an-identity-store-to-power-automate) topic. +- Link a workflow to a flow by providing the URL of that flow in the workflow. See the + [Link an Identity Store Workflow to a Flow](#link-an-identity-store-workflow-to-a-flow) topic. + +Consequently, when the identity store workflow triggers, the linked flow triggers automatically. + +:::note +When you approve the flow in Power Automate, Directory Manager automatically approves the +identity store workflow request. However, if you approve the identity store workflow request +first, Power Automate doesn't automatically approve the flow. +::: + + +### Before you begin + +1. Check the SSL certificate for the Directory Manager server and ensure it is valid and issued by a + publicly trusted CA, as Power Automate runs in Microsoft's cloud and validates the proxy's TLS + certificate against the Microsoft Trusted Root Program. Power Automate silently rejects + certificates from internal or private CAs. +2. Ensure that Power Automate Reverse Proxy is deployed on the same machine as Directory Manager. If + not, [install Reverse Proxy](installproxy.md) before proceeding. + + +### Connect an Identity Store to Power Automate + +To connect an identity store to Power Automate, you must configure a Power Automate client for that +identity store. This will establish a communication channel between the Directory Manager Data +service and the Power Automate platform. + +**To configure a Power Automate client for an identity store:** + +1. In Admin Center, click **Identity Stores** in the left pane. +2. On the **Identity Stores** page, click the ellipsis button for an identity store and select + **Edit**. +3. Click **Workflows** under **Settings** in the left pane. +4. On the **Workflows** page, click the **Advanced Workflow Settings** tab. +5. In the **Power Automate Settings** section, click **Register Client**. +6. Enter the following information: + + - **Organization Code** - the unique name for the environment that stores your flows in Power + Automate (the segment before the first period; for example, myorg in myorg.crm.dynamics.com). + - **Region** - the location of your environment (the segment before the second period; + for example, crm in myorg.crm.dynamics.com). + - **Tenant ID** - the tenant ID assigned to the Directory Manager application when you + registered it in Microsoft Entra Admin Center. + - **Client ID** - the application ID assigned to the Directory Manager application when you + registered it in Microsoft Entra Admin Center. + - **Client Secret** - the client secret value to the Directory Manager application when you + registered it in Microsoft Entra Admin Center. + +7. Click **Save** on the **Advanced Workflow Settings** page. + +### Link an Identity Store Workflow to a Flow + +To link an identity store workflow to a Power Automate flow, generate a flow template from an +identity store workflow and provide the URL of the flow in workflow settings. When the workflow +triggers, the linked flow triggers automatically. + +**To link a workflow to a flow:** + +1. In Admin Center, click **Identity Stores** in the left pane. +2. On the **Identity Stores** page, click the ellipsis button for an identity store and select + **Edit**. +3. Click **Workflows** under **Settings** in the left pane. +4. On the **Configure Workflows** tab of the **Workflows** page, click the ellipsis button for a + workflow and select **Edit**. +5. On the **Edit Workflow** page, click **Power Automate Settings** in the top right corner. +6. Click **Create Template**. Directory Manager creates a basic flow in Power Automate with the same + name as the workflow, and displays the following message: + + ![pa_template_message](/images/directorymanager/11.1/admincenter/workflow/pa_template_message.webp) + +7. Next, copy the flow URL from Power Automate and provide it here. To copy the URL, + do the following: + + 1. Launch Power Automate, choose your environment, and navigate to **My Flows**. This page displays the + flow you created in Power Automate from the Directory Manager workflow. + 2. Hover the mouse over the flow to display the ellipsis button. Click it and select **Edit**. + + ![connections_area](/images/directorymanager/11.1/admincenter/workflow/connections_area.webp) + + 3. Expand the **Manual** area and set **Who can trigger the flow**. + 4. Expand the **Start and wait for an approval** area and set up a new connection field, signing in with your Microsoft account when prompted. Click **Save**. + 5. Navigate back to the **Edit** window. Expand the **Manual** area and copy the URL displayed for **HTTP URL**. + +8. In Directory Manager, return to the workflow you are linking to the flow, and click + **Configure a Request URL** on the **Power Automate Settings** dialog box. +9. Enter the copied HTTP URL in the **Request URL** box. +10. Close the **Power Automate Settings** dialog box. +11. Click **Update Workflow** on the **Edit Workflow** page to save the settings. +12. Click **Save** on the **Workflows** page. +13. Next, enable the linked flow in Power Automate. To do so: + + 1. In Power Automate, choose your environment and navigate to **My Flows**. This page + displays the flow you created in Power Automate from the Directory Manager workflow. + 2. Hover the mouse over the flow to display the ellipsis button. Click it and select **Turn + on**. diff --git a/static/images/directorymanager/11.1/admincenter/workflow/connections_area.webp b/static/images/directorymanager/11.1/admincenter/workflow/connections_area.webp index 6f7d3cb97f..6833ed2886 100644 Binary files a/static/images/directorymanager/11.1/admincenter/workflow/connections_area.webp and b/static/images/directorymanager/11.1/admincenter/workflow/connections_area.webp differ diff --git a/static/images/directorymanager/11.1/admincenter/workflow/pa_permissions.webp b/static/images/directorymanager/11.1/admincenter/workflow/pa_permissions.webp deleted file mode 100644 index 828b8207d9..0000000000 Binary files a/static/images/directorymanager/11.1/admincenter/workflow/pa_permissions.webp and /dev/null differ diff --git a/static/images/directorymanager/11.1/admincenter/workflow/pa_template_message.webp b/static/images/directorymanager/11.1/admincenter/workflow/pa_template_message.webp index 6d807fc31f..fed52846a0 100644 Binary files a/static/images/directorymanager/11.1/admincenter/workflow/pa_template_message.webp and b/static/images/directorymanager/11.1/admincenter/workflow/pa_template_message.webp differ