Single Sign On (SSO) with Microsoft Entra for Dalux FM

The 'Single Sign On' feature enables your company to have a more secure environment by granting increased security regarding access to your Dalux instance. With this feature, you can control how your organization's users access instances by giving them the option or requiring them to use SSO.

This article will go over how to set up SSO for your Dalux FM instance using Microsoft Login (Microsoft Entra).

Login must be agreed on from both Dalux and the customer’s organization to allow users to log in using their Microsoft Login.

Set up Dalux in Microsoft Entra

Information to provide to Dalux

First, contact Dalux Support to activate SSO via this link and provide the following information: 

• SSO activation: Inform Dalux that you want to activate SSO for your organization
• Domains: List the domains that you want to activate SSO for
• Request DNS TXT record: Dalux Support will contact you with further information for the DNS TXT record used to verify that you are the controller of the registered domains
• Name of your Dalux instance
• Login policy: State whether you want to require users to log in with their Microsoft login or whether they should also be able to log in with their Dalux account

Dalux Support will inform you when SSO has been activated.

Activate approval requests

When setting up SSO, you have different options to control how the login should look for your organization's users. Dalux must be registered in Microsoft Entra before you can provide Dalux with the required information for the setup.

If you want to use Microsoft Entra groups to manage user permissions in Dalux HelpDesk, Operations & Maintenance, or BIM & Documentation, make sure to register Dalux as 'Multitenant'.

Set up Dalux as an application in Microsoft Entra

When setting up SSO, you have different options to control how the login should look for your organization's users.

1. Dalux enables Microsoft Login for the customer domain
2. A system administrator with appropriate access in Microsoft Entra enters their mail address on the Dalux login page and clicks 'Microsoft Login'.
3. In Microsoft Entra, you receive a request (example) and Dalux becomes available as an application which you can set up as you wish.
4. SSO is successfully activated for your Dalux organization and the domains you have specified.

Activate approval requests

You can decide whether you want to grant consent for your organization's users in general or whether a reviewer should grant consent individually.

To do this, enable consent requests in Microsoft Entra and add at least one reviewer type. This way, when a user tries to log in with Microsoft Login, they will be prompted with an approval request form:

The reviewer can then approve or deny the request for this user in Microsoft Entra.

User management in Dalux FM with Entra

Managing user permissions

Dalux FM allows you to manage your Dalux user roles with groups from within Microsoft Entra. With this, you can manage user permissions in your AD, which will be synced with Dalux.

Make sure that your user roles in Dalux FM are properly set up. Then navigate to:

SettingsIntegrationsEntra AD

Copy the Client Id and Tenant Id from Microsoft Entra and enter the Client Secret into the appearing window, then click 'Save'. 

Only after saving will the service attempt to connect. If the connection is successful, the actual mapping options of Microsoft groups, Dalux user roles, and user regions will show.

Mapping AD groups to Dalux groups

Users can be part of multiple AD groups in Microsoft Entra.

Each AD group in Microsoft Entra can be mapped to exactly one Dalux user role and region.

Multiple AD groups in Microsoft Entra can be mapped to the same Dalux user role and region.

Mapping of your AD groups with user roles and user regions allows for an AD group to map to a single Dalux user role and region.

When entering the AD group's name, you can click on 'Validate' to make sure Dalux finds the correct group.

New Dalux user roles or AD groups are displayed immediately and can be mapped. Synchronization is done every night (UTC), so changes you make will take a day before they are applied to the Dalux FM instance.

Update user information

When a user authenticates via Microsoft Entra, the local Dalux user profile can be updated with the following values from the Microsoft Graph API (user.read):

• User.email -> Email
• User.givenName -> Name
• User.surname -> Name
• User.companyName -> Company
• User.mobilePhone -> Phone

This data in Dalux is overwritten by entries made in your directory. If the value in your directory is empty, the data in Dalux is retained.