> ## Documentation Index
> Fetch the complete documentation index at: https://docs.truu.ai/llms.txt
> Use this file to discover all available pages before exploring further.

# Enabling PRT support for Username and Password user for Entra ID Domains Federated to TruU

**SCRIPTS PENDING UPDATE**

## Prerequisites:

1. Hybrid Federated Environments: Ensure your setup involves a hybrid federated environment where user accounts are synchronized from an on-premises Active Directory to Entra ID using Entra ID Connect. Password access is only possible under these conditions
2. Password Hash Synchronization: Verify that Password hash synchronization is enabled in Entra ID Connect
3. Multi-Factor Authentication (MFA): Ensure that MFA is not enabled for Entra ID users. TruU utilizes the OAuth 2.0 ROPC (Resource Owner Password Credentials) flow to verify passwords, which does not support MFA

## Verify that Entra ID Connect synchronizes password hashes

To verify that Entra ID Connect synchronizes password hashes from an on-premises AD to Entra ID, follow these steps:

1. Open the Entra ID Connect application on a Windows machine
2. Click on **Configure**
3. Select **Customize synchronization options** and then click **Next**
4. Log in to Entra ID using a global administrator account and proceed through all steps up to the "Optional Features" section. Ensure that the **Password hash synchronization** option is enabled at this stage

## Configuring Home Realm Discovery policy

As mentioned earlier, the Home Realm Discovery (HRD) policy enables TruU to authenticate passwords within a federated environment. This policy needs to be specifically applied to the client—TruU's application registered in Entra—configured within the TruU Management console's directory settings. Without this setup, the policy will not take effect. Below is an example demonstrating the creation of an HRD policy using the Entra ID PowerShell module for the TruU IDS Application.

## **Creating an HRD Policy**

To create a new Home Realm Discovery (HRD) policy, follow this *script*:

```powershell theme={null}
$AzureADPreview = Get-Module AzureADPreview
if($AzureADPreview.Name -eq "AzureADPreview"){
    Write-Host "AzureADPreview is installed, moving forward for authentication"}
else{
Write-Host "AzureADPreview is not installed, Installing ...."
Install-Module AzureADPreview
}

#Connect-AzureAD  user willl be prompted to enter 

$TruUApp = Read-Host "Enter the name of TruU IDS Application that you created during the directory setup for TruU"

$AzureADServicePrincipal = Get-AzureADServicePrincipal -SearchString $TruUApp

Write-Host "Creating New HomeRealmDiscoveryPolicy for TruU"

$HomeRealmDiscoveryPolicy = New-AzureADPolicy -Definition @("{`"HomeRealmDiscoveryPolicy`":{`"AllowCloudPasswordValidation`":true}}") -DisplayName TruUPasswordAuth -Type HomeRealmDiscoveryPolicy -IsOrganizationDefault $false

Write-Host "Deploying HomeRealmDiscoveryPolicy with $TruUApp"
Add-AzureADServicePrincipalPolicy -Id $AzureADServicePrincipal.ObjectId -RefObjectId $HomeRealmDiscoveryPolicy.id
```

## **Removing the HRD Policy**

If you need to disable password verification later, you can remove the HRD policy by using the following *command*:

```powershell theme={null}
$AzureADPreview = Get-Module AzureADPreview
if($AzureADPreview.Name -eq "AzureADPreview"){
    Write-Host "AzureADPreview is installed, moving forward for authentication"}
else{
Write-Host "AzureADPreview is not installed, Installing ...."
Install-Module AzureADPreview
}

#Connect-AzureAD  user willl be prompted to enter 

#$TruUApp = Read-Host "Enter the name of TruU IDS Application that you created during the directory setup for TruU"

#$AzureADServicePrincipal = Get-AzureADServicePrincipal -SearchString $TruUApp

$AzureADpolicies =Get-AzureADPolicy
if($AzureADpolicies -eq $Null){
write-host "Unabel to find TruUPasswordAuth policy"
}
ForEach($AzureADPolicy in $AzureADpolicies)
{
if($AzureADPolicy.DisplayName -eq "TruUPasswordAuth"){
    write-host "Removing TruUPasswordAuth policy"
    Remove-AzureADPolicy -Id $AzureADPolicy.Id
    }
 else{write-host "Unabel to find TruUPasswordAuth policy"}
 }
```

## **Approving a Delegated Permission in Entra**

The ROPC OAuth 2.0 flow used by TruU for password verification requires the "user.Read" scope to function correctly. This permission must also be granted to the application in Entra.

To configure this permission:

1. Open the **Microsoft Entra ID service** (former Azure AD) in Entra Portal
2. Go to **App registrations**, then navigate to {APPNAME}, then **API permissions**
3. Click **Add a Permission** to proceed

This process allows you to grant the necessary permission for the application

4. Add a new Microsoft Graph delegated to “User.Read” permission as you can see below
5. After adding the permission, you must grant administrative consent to the permission
6. Click the **Grant admin consent for …** button