Introduction

This guide details the steps required to configure ReadyWorks as an Azure Enterprise Application, enabling integration with Azure Active Directory (AAD) via the Microsoft Graph API. This document targets IT professionals already proficient with ReadyWorks, Azure, and AAD, seeking to enhance their organization’s asset management capabilities through secure and efficient API integrations.

Setting up ReadyWorks in Azure establishes API connectivity, facilitating secure data exchange between ReadyWorks and your Microsoft tenant. This guide provides configuration instructions, security best practices, and troubleshooting steps.

 

Important Security Considerations

Please review these security guidelines before proceeding:

• Permissions requested herein are highly privileged, providing extensive access to Azure resources (e.g., users, groups, devices).
• Adhere strictly to the principle of least privilege: consider read-only permissions wherever applicable.
• Securely manage and regularly rotate the client secret following organizational security policies.
• Apply Conditional Access policies to restrict the application’s access according to location, network, or device criteria.
• Regularly audit application activity and permissions via Azure’s monitoring and audit capabilities.

 

Configuration Steps

 

1. Register ReadyWorks as an Application in Azure

1. Sign in to Azure Active Directory Admin Center.
2. Navigate to Azure Active Directory > App Registrations.
3. Select New Registration.
4. Enter application details:
   • • Name: Descriptive name (e.g., ‘ReadyWorks Graph Integration’)
     • Supported account types: Accounts in this organizational directory only (Single tenant)
     • Redirect URI: (Leave blank unless specifically required)
5. Click Register.
6. Record the Application (client) ID from the overview page.

 

2. Configure Microsoft Graph API Permissions

1. From the app’s registration page, select API Permissions > Add a Permission.
2. Select Microsoft Graph, then Application Permissions.
3. Carefully choose permissions aligned to your organization’s needs:

Permission	Type	Purpose	Recommended Alternative
Device.ReadWrite.All	Application	Manage device lifecycle	Device.Read.All if write access unnecessary
Group.ReadWrite.All	Application	Manage Azure AD groups	Group.Read.All if write access unnecessary
GroupMember.ReadWrite.All	Application	Manage group memberships	GroupMember.Read.All if write access unnecessary
User.ReadWrite.All	Application	Manage Azure AD users	User.Read.All if write access unnecessary

 

1. After selecting required permissions, click Add Permissions.
2. Click Grant Admin Consent for [Your Organization] and confirm with Yes.
   • • Note: This action impacts tenant-wide; ensure clarity on scope and necessity before proceeding.

 

3. Generate and Secure Client Secret

1. Select Certificates & Secrets > New Client Secret.
2. Enter a clear description (e.g., “ReadyWorks Graph Client Secret”).
3. Select an appropriate expiration aligned with organizational security requirements.
4. Click Add.
5. Immediately copy and securely store the client secret’s Value. (This is your sole opportunity to access this credential.)

 

4. Information Required for ReadyWorks Integration

Ensure the following information is securely documented for ReadyWorks connector setup:

• Tenant ID: Azure Tenant ID (found in Azure Active Directory overview)
• Application (Client) ID: From Step 1 registration
• Client Secret: From Step 3 secret generation

 

Recommended Permissions and Their Uses

Permission	Type	Detailed Purpose
DeviceManagementManagedDevices.Read.All	Application	Access detailed Intune-managed device information (compliance, hardware, security)
User.Read.All	Application	Retrieve comprehensive user profile details (UPN, email, department, roles)
Group.Read.All	Application	Access group details within Azure AD
GroupMember.Read.All	Application	Read membership details of all Azure AD groups
Directory.Read.All	Application	Broad read access across Azure AD directory objects

 

Maintenance and Security Best Practices

• Secret Rotation: Proactively rotate client secrets before expiry; schedule reminders accordingly.
• Permission Reviews: Regularly audit permissions to confirm necessity and alignment with current business requirements.
• Access Reviews: Implement periodic access reviews for continued security compliance.
• Monitoring: Activate Azure monitoring tools for auditing and alerts to detect unauthorized or anomalous activity.

 

Troubleshooting Guidance

If integration issues arise:

• Confirm admin consent for all permissions.
• Verify client secret validity and expiration status.
• Check accuracy of Tenant ID and Application ID in ReadyWorks.
• Confirm sufficient permissions for personnel configuring ReadyWorks.
• Consult Azure AD audit logs for authentication errors or permission issues.
• Open a support ticket with ReadyWorks at: support.readyworks.com

 

This guide emphasizes secure, minimal-permission integrations aligned with best practices to maximize the utility of ReadyWorks while maintaining rigorous security compliance.

See more

This guide outlines the procedure for integrating Microsoft Entra ID (formerly Azure Active Directory) user data into ReadyWorks using SQL ETL mappings. The objective is to normalize and transform Entra user data into the ReadyWorks target schema.

 

📌 Prerequisites

Before beginning, ensure the following:

• You have the ReadyWorks Data Mapping module enabled
  
• You have the appropriate privileges to configure Data Mappings.
• You are working within a ReadyWorks tenant where the Entra ETL Connector is configured
• There is data in the Entra Staging Tables with familiar information about Users in your organization and their associated attributes (e.g., displayName, jobTitle, etc.).
• You are familiar with the naming conventions and standards used within your organization

 

 

🧭 Process Overview

1. Access the Data Mapping Module
2. Create or Edit the ETL Mapping
3. Write the SQL Query to Transform Entra Data
4. Map Source Columns to ReadyWorks Fields
5. Preview Output and Troubleshoot Errors
6. Save and Commit the Mapping
7. Verify Output in the ReadyWorks Asset Table
8. Perform Reprocessing or Manual Adjustments as Needed

 

 

🧩 Step-by-Step Instructions

Step 1: Access the Data Mapping Module

• Log in to ReadyWorks.
• From the left-side menu, go to:
  • Configuration > Module Settings > Data Mapping
• Click on the existing mapping (e.g., AD Users) or create a new one.

 

 

Step 2: Create or Edit the Mapping

• Mapping Name: Set to Users. This table must be your master record of Users in the organization and is required for appropriate working of the Self-Service Portal.
• Target Table: Select User.
• Mapping Type: Set to Data Mapping.
• In the ETL Connector dropdown, select your Entra source (e.g., Azure Active Directory).

 

Step 3: Compose the SQL Transformation Query

Write a SQL SELECT statement that:

• Pulls relevant user fields from the staging table.
• Applies transformations to match ReadyWorks schema.
• Ensures normalization (e.g., truncating long values, deriving domain from UPN, joining to manager details).

 

Example SQL Snippet:

 

SELECT
  CONCAT(COALESCE(usr.displayName, ''), ' (', usr.mailNickname, ')') AS name,
  usr.displayName AS display_name,
  usr.mail AS email,
  SUBSTRING_INDEX(usr.userPrincipalName, '@', -1) AS domain,
  usr.officeLocation AS office_location,
  usr.department AS department,
  usr.jobTitle AS job_title,
  addr.streetAddress AS street_address,
  addr.city AS city,
  addr.state AS state,
  addr.postalCode AS zipcode,
  STR_TO_DATE(usr.passwordLastSet, '%Y-%m-%dT%H:%i:%sZ') AS password_last_changed,
  SUBSTRING(usr.manager, 0, LENGTH(SUBSTRING_INDEX(usr.manager, '/', -1)) - 2) AS manager_upn
FROM staging_entra_users usr
LEFT JOIN staging_entra_addresses addr ON addr.objectId = usr.objectId
LEFT JOIN staging_entra_users mgr ON mgr.userPrincipalName = SUBSTRING_INDEX(usr.manager, '/', -1)
WHERE usr.accountEnabled = TRUE;

 

Adjust field names based on your actual staging schema.

Ensure all Entra attributes you wish to ingest are present in the connector output.

 

 

Step 4: Map Columns to ReadyWorks Target Fields

In the Mapping Properties Panel:

• For each field from your SQL query, click Add Row.
• Assign:
  • Source Column (ETL): Name used in SQL output (e.g., display_name).
  • Target Column (RW): Field in ReadyWorks User table (e.g., Display Name).
  • Set Allow Null/Zero and Conversion as required.

 

 

Step 5: Preview and Validate Output

• Scroll down to the Output panel.
• Click Run (green play button).
• Inspect the output for:
  • Null values
  • Incorrect data types
  • Invalid joins
• Adjust the SQL as needed to resolve issues.

 

Step 6: Save the Mapping

• Click Disk icon to save.
• Wait for the “Mapping updated successfully” notification.
• Optionally: export a copy of the SQL for documentation or reuse.

 

 

Step 7: Confirm Data in ReadyWorks

• Navigate to User Table in ReadyWorks from the Left Hand sidebar.
• Confirm that values now appear as expected, including:
  • Normalized Display Name
  • Populated manager references
  • Accurate password last changed dates

 

 

Step 8: Post-Mapping Actions

If data appears incorrect or outdated:

• Confirm that the Entra ETL Connector has run successfully (check ETL Dashboard).
• Optionally, run a truncate and reprocess job if bad data must be purged (requires admin access and caution).

 

 

 

⚠️ Common Pitfalls

• Case Sensitivity: SQL column names in ReadyWorks may be case-sensitive in some configurations.
• Truncation Errors: ReadyWorks will truncate values if columns exceed expected length—always apply SUBSTRING if needed.
• Staging Table Not Found: Validate that connector output matches expected staging table names in SQL.
• Join Failures: Make sure UPNs or object IDs are present and not null in both parent and child records.

 

 

✅ Summary

Data Mapping any source data into ReadyWorks involves:

1. Authoring a normalized SQL query.
2. Aligning data fields with ReadyWorks schema.
3. Validating the output.
4. Saving and monitoring for data consistency.

 

Once configured properly, this mapping ensures that your ReadyWorks user records reflect the most accurate, up-to-date identity data from Microsoft Entra, supporting analytics, lifecycle tasks, and automation downstream.

See more