Integrating LanSchool Air with Azure Active Directory

Integrating LanSchool Air with Azure Active Directory

This feature is currently in Early Access. To request this feature be enabled for your LanSchool Air organization, please contact the Customer Success team.

Overview

This article explains how to integrate LanSchool Air with Azure Active Directory for Single Sign-On (SSO) and User Provisioning.

With this integration, instructor accounts can be automatically created and activated in LanSchool Air when created in the organization's Azure Active Directory environment. Only Active Directory users associated to the provisioning application in Azure will be provisioned to LanSchool Air.  Email invitations and activations are not required when users are provisioned from Azure Active Directory.

Once instructors are provisioned to LanSchool Air from Azure Active Directory, they will be automatically enabled for Single Sign-On using their Microsoft account. After entering their email address on the LanSchool Air sign-in page, they will be automatically forwarded to Microsoft for authentication.

Prerequisites

  1. Single LSA Org for all users (customers will multiple orgs are not supported at this time)
  2. Site Admin account in LanSchool Air
  3. Admin access to Azure Active Directory 
LanSchool Air's Azure Active Directory integration only supports integrating with one LanSchool Air organization per Azure AD domain. If your organization has multiple LanSchool Air organizations, only one of them may be integrated with Azure AD at this time.

Creating an Enterprise Application in Azure AD

  1. Log into LanSchool Air as Site Admin.
  2. Click on the menu at the top left then click Settings.



  3. Click on SSO Configuration.



  4. Click Generate New. The system generates a random secrete token. Click Copy.

  5. In a separate browser window or tab, log into Microsoft's Azure Portal at https://portal.azure.com/
  6. Click on Azure Active Directory in the left menu. A page show your organization's name displays.



  7. Click on Enterprise Applications.



  8. Click on +New Application.



  9. Click on +Create your own application.



  10. Name your Application (i.e. LanSchool Air) and select Integrate any other application you don't find in the gallery (Non-gallery)
  11. Select Create



  12. Click on Provisioning in the left navigation menu.



  13. On the Provisioning page:
    1. Select Get Started.
    2. Select Automatic from the Provisioning Mode drop-down list.
    3. Paste or enter one of the following URLs into the Tenant URL field:
      1. For Americas: https://api-lsa.lenovosoftware.com/0/lsa/common/scim
      2. For EMEA: https://api-lsa-emea.lenovosoftware.com/0/lsa/common/scim
      3. For Premier: https://api-lsa-premier.lenovosoftware.com/0/lsa/common/scim
      4. For APAC: https://api-lsa-apac.lenovosoftware.com/0/lsa/common/scim
    4. Copy the secret token from LanSchool Air (see step 4) and paste it into the Secret Token field.
    5. Click Test Connection.
    6. Click Save.



  14. Expand Mappings, select Provision Azure Active Directory Groups.



  15. Set Enabled to No. Select Save. Click on the X at the top right to return to Mappings.



  16.  Under Mappings, select Provision Azure Active Directory Users. Delete all attributes except the following:
    1. userPrincipalName
    2. Switch([isSoftDeleted], ,"False", "True", "True", "False")
    3. givenName
    4. Surname
    5. mailNickname



  17. Click on mailNickname and change the Source attribute to objectid. Click OK.



  18. Click Save at the top of the page (unless the Save button is grayed out).

Configuring SAML Authentication

  1. While still in Azure Active Directory, click on Single sign-on in the left menu.



  2. Click the SAML tile.



  3. From the Basic SAML Configuration tile, click the Edit icon.



  4. Configure the settings as follows:
    1. Delete the URL that is already in the Identifier (Entity ID).
    2. Paste one of the following URLs into the Identifier (Entity ID) field and mark as Default:
      1. For Americas: https://api-lsa.lenovosoftware.com/0/lsa/common/saml/sp
      2. For EMEA: https://api-lsa-emea.lenovosoftware.com/0/lsa/common/saml/sp
      3. For Premier: https://api-lsa-premier.lenovosoftware.com/0/lsa/common/saml/sp
      4. For APAC: https://api-lsa-apac.lenovosoftware.com/0/lsa/common/saml/sp

    3. Paste one of the following URLs into the Reply URL (Assertion Consumer Service URL) field:
      1. For Americas: https://api-lsa.lenovosoftware.com/0/lsa/common/saml/acs
      2. For EMEA: https://api-lsa-emea.lenovosoftware.com/0/lsa/common/saml/acs
      3. For Premier: https://api-lsa-premier.lenovosoftware.com/0/lsa/common/saml/acs
      4. For APAC: https://api-lsa-apac.lenovosoftware.com/0/lsa/common/saml/acs

    4. Click Save, and then click X  in the top right after saving. If a message that asks if you want to test displays, click No, I’ll test later.



  5. From the SAML Signing Certificate section of the Set Up Single Sign-on with SAML page, copy the URL from the App Federation Metadata URL field.



  6. Return to the SSO Configuration page in LanSchool Air.
  7. Paste the URL into the App Federation Metadata URL field and click Update.



Enabling User Account Provisioning

  1. Return to Azure Active Directory, and then click Users and Groups from the left menu.



  2. Click +Add User/group.



  3. Click None Selected under Users and groups.
  4. Search for a new user(s) and click Select.
  5. Click Assign.
  6. Click Provisioning in the left pane.
  7. Select Start Provisioning.

Removing Azure AD Integration

  1. Log into LanSchool Air as Site Admin.
  2. Select the menu at the top left and go to Settings.



  3. Select SSO Configuration.



  4. Select Remove Connection at the bottom.



  5. Type 'Confirm' and select Remove Connection.


  6. All user accounts that were provisioned in LanSchool Air from Azure AD will be deleted.

Azure FAQ

How do users sign into LanSchool Air?

Assigned users will log into LanSchool Air with Single Sign-On using their Azure AD credentials. To confirm a user was assigned, in LanSchool Air go to Settings>People. The user will appear with Azure AD listed under Source.

Users with "LanSchool Air" listed as the source will continue to login with their LanSchool Air password and not Azure AD SSO.

How often does Azure provision users?

Users will be added/removed every 40 minutes (by default). To immediately provision users, select Stop Provisioning and then select Start Provisioning.

What happens if a user is deleted in Azure?

If a user is deleted in Azure, the user will appear as "disabled" in LanSchool Air for 30 days and then deleted.

What happens if a user is unassigned from the app in Azure?

If a user is unassigned from the app in Azure, the user will be disabled in LanSchool Air.

What if there are local user accounts in LanSchool Air?

If you already have local users in LanSchool Air, with Source listed as "LanSchool Air" under Settings>People, you will first have to delete the local accounts before assigning the user to the app in Azure.

Deleting the local account(s) will remove all manually created classes and the user will have to recreate them once signed in using their Azure AD credentials.

    • Related Articles

    • Adding New Instructors and Site Admins to LanSchool Air

      When a LanSchool Air organization is first created, it contains a single user account that is assigned a Site Admin role. One of the site admin's primary tasks is to invite instructors or other site admins to use LanSchool Air. Add Users Individually ...
    • LanSchool Air Release Notes

      LanSchool Air Release Notes Updates to LanSchool Air are applied automatically and rolled out globally over a period of 1 to 2 weeks, so the latest updates noted in the release notes might not be available in your region for a few more days. ...
    • LanSchool Air User Guide

      Who Should Use this Guide? Teachers who have received an invitation from a site admin to create a LanSchool Air account Site admins who are setting up an account for a teacher What Does this Guide Cover? This guide provides instructions for: ...
    • LanSchool Air Setup Guide

      Who Should Use this Guide? LanSchool Air site administrators responsible for installing LanSchool Air on student devices, configuring admin settings, and inviting instructors. What Does This Guide Cover? This guide provides instructions for: ...
    • Logging in to LanSchool Air with a Google Account

      Before you can login to LanSchool Air, your organization's LanSchool Site Admin will need to add your email address to the organization as an instructor. You will receive an email invitation with an activation link to create your account. See Adding ...
    • Popular Articles

    • Mass Deploying LanSchool Air for Chromebook Student

      This guide walks site administrators through the process of deploying the LanSchool Air app to students using Chromebooks and getting LanSchool Air ready for instructors to use. For information on installing the LanSchool Air app to Windows or Mac ...
    • Using Web Limiting

      Overview To block troublesome or distracting websites or limit students to a select few websites pertinent to the class, use the Web Limiting feature in LanSchool Air. There is currently no limit on the number of URLs that can be added to the block ...
    • Using Blank Screen

      Overview LanSchool Air's customizable Blank Screen feature enables you to push a Blank Screen to your students' computers. When you enable Blank Screen, students are not able to view or listen to anything on their device until the Blank Screen is ...
    • Installing LanSchool Air for Windows Student

      Overview This article explains how to install the Windows client on an individual student device. For instructions on deploying the Windows client to a large number of student devices, see Mass Deploying LanSchool Air for Windows Student. This option ...
    • Viewing Student Client Status

      Overview If a student device is appearing as offline, check the status of LanSchool Air client installed on the student's device to make sure it's provisioned and connected. To see the current status of the student client, open the LanSchool Air chat ...
    • Recent Articles

    • Integrating LanSchool Air with Azure Active Directory

      This feature is currently in Early Access. To request this feature be enabled for your LanSchool Air organization, please contact the Customer Success team. Overview This article explains how to integrate LanSchool Air with Azure Active Directory for ...
    • Deploying LanSchool Air Using Group Policy

      Overview The LanSchool Air for Windows agent supports a number of different deployment methods and tools using a basic EXE or an advanced MSI installer. See Mass Deploying LanSchool Air for Windows for more detailed instructions. Please note that our ...
    • Managing Instructor Profile Settings

      Overview Instructors may want to change their name or the display name that the student sees in LanSchool Air.  This can be done using the Edit Profile option. User can also manage their LanSchool Air password and their communication preferences. ...
    • Sharing Instructor Screen with the Class

      Overview When a class is started, the instructor has the ability to broadcast their screen to the student devices. The instructor can choose to share their entire screen with the class, only an application window or a specific browser tab. This is a ...
    • Lenovo VR Classroom 2 Headset Support

      The LanSchool support team can assist with questions related to the LanSchool Air integration.  For more information and headset support please see the Lenovo VR Classroom 2 site. If you need help with the headset or anything non-LanSchool Air ...