Purpose
This guide covers the process of adding a new user account when the source directory of Practice Protect is Microsoft Entra ID (formerly Azure Active Directory). Locking, provisioning, and account creation processes differ depending on whether your environment was setup in Practice Protect via Entra ID as Source (Legacy) or Entra ID SAML.
If your Practice Protect deployment does not use Microsoft Entra ID as the source, please refer to the appropriate guide for your setup.
Prerequisites
-
Microsoft 365 Administrator Account – Required to create and manage user accounts in Microsoft 365 / Entra ID.
-
Practice Protect Administrator Account – Required to configure user access and SSO settings in Practice Protect.
-
Mobile Number of New User – Recommended if the user will also be enrolled in Practice Protect MFA for authentication purposes.
Identify the Source of a User Account in Practice Protect
- Entra ID as Source (Legacy)
-
Log in to Practice Protect
-
Click the 9-dot menu and switch to Manage Space.
-
Navigate to Inventory > Identities > Users.
-
Click Filter and select Source > Microsoft Entra ID.
-
If users are displayed with Microsoft Entra ID as the source, this indicates that the Practice Protect environment is using the Legacy Entra ID as Source setup.
-
If no accounts are listed, the environment may be using Entra ID SAML. Continue with the steps below to confirm the configuration.
-
- Entra ID SAML
- In your Practice Protect switch to Setup Space.
-
Navigate to Deployment > Identity Sources > External Identity Providers.
-
Look for Microsoft Entra ID SAML in the list.
-
Check the Status. If Microsoft Entra ID SAML is listed as Active, this confirms that the environment is using Entra ID SAML. If Microsoft Entra ID SAML is not listed or is not Active, then Entra ID SAML is not configured in the environment.
Note: You may also see Practice Protect Support listed as an External Identity Provider. This is used for Practice Protect support purposes and should be ignored when checking the client’s identity source. -
Once you have confirmed that Entra ID SAML is configured, follow the steps below to add the new user in Microsoft Entra ID.
- In your Practice Protect switch to Setup Space.
Instructions
Add User in Microsoft 365
This step is typically performed by your IT team or the person who manages the Microsoft 365 Admin account.
- Sign in to Microsoft 365 Admin Center
-
In the left-hand menu, navigate to Users > Active users.
-
Click Add a user.
-
Enter all of the user’s details, including the Username, ensuring the information is correct.
- Select both Automatically create a password and Require this user to change their password when they first sign in.
Note: Microsoft 365 will generate a temporary password that you can provide to the user. When the user signs in for the first time, they will be prompted to change the password. -
Select the appropriate Location and Microsoft 365 license for the new user, then click Next.
Note:
Select the license from the available licenses for the client. If no license is available, select Create user without product license.
If Practice Protect manages the client’s Microsoft 365 licensing, contact the Practice Protect Support Team for assistance. -
Expand Roles and select User (no admin center access). This ensures the new user does not have access to the Microsoft 365 admin center.
-
Under Optional settings, enter all the required user details.
Note: If the client uses Practice Protect MFA, we recommend entering the user’s Mobile phone number. If Microsoft MFA will be the preferred authentication method, this field can be left blank.
- Click Next to continue.
-
Review the user account details and click Finish adding to create the account.
-
The user will now appear in your list of active users.. Click Show and copy the temporary password.
-
Store or provide the temporary password securely to the user, then click Close.
- Continue with the steps below to complete the Practice Protect user setup and invitation process.
Invite the User to Practice Protect
Before sending the Practice Protect invitation, ensure the user’s email address is active and the mailbox can receive emails.
-
Log in to Practice Protect.
-
Click the 9-dot menu and switch to Manage Space.
-
Navigate to Inventory > Identities > Users.
-
Click Invite Users in the top-right corner.
-
Search for the user account using their Email Address, select the user, and click Invite.
Note: Confirm that the Source Directory matches the required setup before sending the invitation.
-
Click Send Invites. This will send the invitation email to the user and add the account to the Users list in Manage Space.
-
To refresh the platform and view the new account, open your account dropdown in the
top-right corner and click Reload Rights.
- An updated list of Invited accounts will now show in the User List after the page is refreshed/reloaded
-
After creating the account, assign the appropriate roles and policies to the user. This ensures the user has the correct permissions and that your organisation’s security controls are applied. Additional restrictions, such as country-based or IP-based access policies, can also be configured as required.
Assigning Policy
A policy must be assigned to each user account to enable access and enforce security controls. Policies can include restrictions such as GeoLock (country-based access) and IP Lock (IP address-based access).
Policies consist of one or more conditions that control user access based on criteria defined by your organisation.
-
From the Manage space, expand Inventory > Identities, then select Roles.
-
On the Roles page, select the role you want to assign to the user (for example, AU User – Geo Locking).
Note: Roles such as Geolocking, WFH, and Travel are linked to policies that enforce country-based access restrictions. The Restricted Users role is intended for users who require IP-based access restrictions.
- Once inside the role, go to Members, then click Add.
-
Find the user, select the account and click Add.
- Click Save in the bottom-right corner to complete the assignment.
-
The user has now been successfully assigned to the selected role. In this example, the user was assigned the AU User – Geolocking role, which is linked to a policy that restricts access based on location. As a result, the user will only be able to access Practice Protect when signing in from within Australia.
Add User to the SAML Group (For Provisioning)
If you do not have a Microsoft Entra ID P1 license (or another license that supports custom groups), group-based provisioning will not be available. In this case, users must be provisioned manually by assigning them individually to the Practice Protect SAML application.
- Login to Microsoft Entra Admin Center
- Go to Entra ID > Groups.
-
In All Groups, locate and open the standard group created by Practice Protect for SAML. This group is typically named Microsoft Entra ID – Practice Protect Users.
Note: The group name may differ if your IT team collaborated on the setup and chose a custom group name.
- Click Add Members, select all the users you want to include, and then click Select.
- You will receive a notification in the upper-right corner confirming that the member(s) have been added successfully.
- Now, go to Entra ID > Enterprise Apps > All Applications under Manage.
- Locate and open the Practice Protect SAML application.
-
Go to Users and Groups and check if the group Microsoft Entra ID – Practice Protect Users is assigned. If you see individual users instead of the group, it means the group is not being used. In this case, you must add the user manually by clicking Add User/Group.
This step is only to verify whether provisioning is done via groups or individual assignments.
- Go to Provisioning.
-
Select Provisioning on Demand. Use the search field to find the user and click Provision.
You can also search for a group and tick the boxes next to each user (up to 5 users per provisioning) to provision them simultaneously. In this example, we are provisioning a single user.
- Once the provisioning sync is complete, click on Provisioning Logs under the Manage section and verify that there are no provisioning failures
-
Return to the Practice Protect Manage Space Users list. The user should now appear as a newly added user.
-
Add the user to the relevant Role in Practice Protect, such as Geo Locking, and assign any required applications.
-
Then invite the user to sign in to the Practice Protect platform, or they can sign in directly using the Practice Protect login URL. The user can simply enter their Microsoft 365 credentials to sign in.
Need help? If you require assistance assigning roles, configuring policies, or applying access restrictions, please contact the Practice Protect Support team.