Technical Prerequisites

This page contains details of the initial setup required by clients to enable deployment and implementation of the Blueprint software by Tiger Eye.

Verification Checklist

Deliverables to Tiger Eye

• The <API_ID> that has been generated as part of the Entra Application setup

• The <APP_TENANT_ID>, <APP_CLIENT_ID>, <APP_CLIENT_SECRET>, <APP_AUDIENCE_URL> for any enterprise applications that have been created

• The System User Id’s from Entra that have been created/used

• Access information to servers for installation and support

• The iManage Folder Id that will be used for document storage.

Infrastructure Setup

Infrastructure set up, including VMs, Network Routing, as well as Domain and SSL certificates.

Virtual Machines (VMs)

Web Server

Production VM to be set up with the following minimum specs for 200 concurrent users. This can be reduced if the expectation is to have fewer concurrent users, however specification should be confirmed with Tiger Eye prior to purchase. 

• 16 vCPU 

• 16 GB RAM 

• 50GB primary OS partition 

• 100GB non-ephemeral managed disk mounted to D: drive letter 

Staging VM can use less, depending on the number of testers who will be using the system. A recommended specification is 

• 4 vCPU 

• 8 GB RAM 

• 50GB primary OS partition 

• 50GB non-ephemeral managed disk mounted to D: drive letter 

The web server must be configured with: 

• Windows Server 2022 or newer 

• IIS installed and enabled 

• Web Development features enabled 

• WebSocket protocol enabled 

• Latest ASP.NET Core Hosting Bundle installed for v8 

Database server

You will need to be able to host databases on a separate server, complying with the following

Either

• Azure SQL Server

or a server consisting of

• 4 vCPUs 

• 16 GB RAM 

• 200GB non-ephemeral managed disk 

• MSSQL 2019 (Cumulative Update v15) or newer 

It is recommended to have a separate database server for Staging and Production for full environment segregation. 

Network Routing

The following traffic rules must be whitelisted from the host web server.

• login.microsoft.com _{(Outbound, HTTPS)}

• graph.microsoft.com _{(Outbound, HTTPS)}

• heartbeat.tigereyeconsulting.com [ 4.159.6.35 ] _{(Outbound, HTTPS)}

• cloudimanage.com _{(Outbound, HTTPS)}

  • Or an alternative iManage host location

• fonts.googleapis.com _{(Outbound, HTTPS)}

Domain and SSL Certificates

You will need to:

• Obtain a dedicated [sub]domain for hosting Blueprint e.g. blueprint.company.com

• Obtain an SSL certificate covering the chosen domain with a trusted CA for all target end-users

• Update public and/or internal DNS to ensure the domain resolves to the host web server

Enterprise Application Configuration in Entra

Entra set-up is required for Authenticating with Blueprint through Single Sign On, as well as setting permissions and roles for Users and Groups. 

Setting Up Applications in Entra

You will need to create two applications within Entra. The Blueprint server requires the specification of an ID within its configuration, which will uniquely identify the specific instance of Blueprint within your Entra organisation. This identifier will be referred to throughout this document as <API_ID>. This value is a GUID, can be generated using https://www.guidgenerator.com/ , and must be communicated back to Tiger Eye for configuration purposes. 

Blueprint API Application

Navigate to the Entra admin centre at https://entra.microsoft.com/

Create Application

• Navigate to Applications → App registrations

• Create a new application by clicking on New registration

  • Give it a meaningful name, to include the API Identifier - for example, `Blueprint Server <API_ID>

  • Check Accounts in this organisational directory only

  • The redirect URI should be left empty

  • Click Register

• On the overview page, take note of the following:

  • Application (client) ID (referred to in this document as <APP_CLIENT_ID>

  • Directory (tenant) ID (referred to in this document as <APP_TENANT_ID>

Branding

• Navigate to Branding & properties and complete the information as per your internal policies and branding [Optional]

Secrets

• Under Certificates & secrets, create a new secret by clicking New client secret

  • Call the secret Application Configuration

  • Set the expiry inline with internal token recycling policy - 12 months is the recommended default.

  • Keep the secret value aside, this will be referred to in this document by <APP_CLIENT_SECRET>

Scopes & Permissions

• Navigate to API permissions

  • Add each of the following permissions by selecting Add a permission

    • Group.Read.All (Delegated)

    • User.Read (Delegated)

    • User.Read.All (Delegated)

    • User.Read.All (Application)

    • Graph.Sites.Selected (Application) - Only for using SharePoint as a Knowledge Store

    • Graph.Files.SelectedOperations.Selected (Application) - Only for using SharePoint as a Knowledge Store

    • Sharepoint.MyFiles.Read (Delegated) - Only for using SharePoint as a Source or Knowledge Store

    • Sharepoint.AllSites.Read (Delegated) - Only for using SharePoint as a Source Store

    • Graph.Files.Read.All (Delegated) - Only for using SharePoint as a Source Store

    • Mail.Read (Application) - If utilising Exchange OAuth for email notifications

  • Grant admin consent for all permissions by clicking on Grant admin consent for <ORG>

    • Once complete, you should see Granted for <ORG> within the Status column

• Navigate to Expose an API

  • Click Add a scope

    • Set the Application ID URL to api://blueprint-<API_ID>.local and click Save and continue. This Application ID URL should be kept to the side; it will be referred to in this document by <APP_AUDIENCE_URL>.

    • Name your scope All

    • Set the consent to Admins only

    • Set the Admin consent display name to Provides full access to the API.

    • Set the Admin consent description to Provides full access to all endpoints, user-permissions are evaluated separately.

    • Set the User consent display name to Access the Blueprint API

    • Set the state to Enabled

    • Click Save

  • Click Add a client application under Authorised client applications

    • NOTE This requires the <APP_CLIENT_ID> of the client application configured as part of the client entra application. Complete that first and come back to this step.

Blueprint Client Application

Navigate to the Entra admin center at https://entra.microsoft.com/,

Create Application

• Navigate to Applications → App registrations

• Create a new application by clicking on New registration

  • Give it a meaningful name, to include the API Identifier of the server - for example Blueprint Client <API_ID>

  • Check Accounts in this organisational directory only

  • Redirect URI should be set Web with a value of https://<DOMAIN>/signin-oidc

  • Click Register

• On the overview page, take note of the following:

  • Application (client) ID (referred to in this document as <APP_CLIENT_ID>

    • Once found, be sure to update the authorised clients on the server application.

  • Directory (tenant) ID (referred to in this document as <APP_TENANT_ID>

Branding

• Navigate to Branding & properties and complete the information as per your internal policies and branding [Optional]

Secrets

• Under Certificates & secrets, create a new secret by clicking New client secret

  • Call the secret Application Configuration

  • Set the expiry inline with internal token recycling policy - 12 months is the recommended default.

  • Keep the secret value aside, this will be referred to in this document by <APP_CLIENT_SECRET>

Authentication

• Navigate to Authentication

• Ensure the Redirect URIs are set to https://<DOMAIN>/signin-oidc

• Ensure the Front-channel logout URL is set to https://<DOMAIN>/signout-oidc

• Ensure Access tokens and ID tokens are enabled under implicit grant and hybrid flows

• Ensure Accounts in this organizational directory only is set under Supported account types

• Click Save

Permissions

• Navigate to API permissions

  • Add each of the following Microsoft Graph permissions by selecting Add a permission and choosing Microsoft Graph

    • Group.Read.All (Delegated)

    • User.Read (Delegated)

    • User.Read.All (Delegated)

    • Blueprint Server → All (Delegated)

      • This permission can be found under the My APIs tab in the Add a permission pop-up. Ensure the correct Blueprint Server is selected here if you have multiple instances in your organisation.

      • NOTE This requires the API to be exposed for the Blueprint Server application configured as part of the server entra application. Complete that first (up to the Expose an API section) and come back to this step. You will need the <APP_AUDIENCE_URL from this server application too.

• Grant admin consent for all permissions by clicking on Grant admin consent for <ORG>

  • Once complete, you should see Granted for <ORG> within the Status column

Permission and Role Administration

Service User

Blueprint performs many background operations which need to be associated to an actual user within your organisation. For this, it typically requires the creation of a dedicated principal within your Entra which can be used as a Blueprint system user. Create a new (or choose an existing) user within your Entra which can be used to perform these background operations. The UPN would typically convey that it is for a service account, an example name would be BlueprintSystemUser, Blueprint_Svc or variations of that.

For true environment segregation, you can create environment-specific UPNs by appending the intended environment to the UPN. For example, BlueprintSystemUser_Test. Please note any User Id’s that have been created, and pass them to Tiger Eye.

Create ‘Power User’ Group

A Power User in Blueprint is a person who has all application privileges and can perform any action. This is a controlled role and is denoted by membership in a dedicated group within Entra.

• Navigate to the Entra admin centre at https://entra.microsoft.com/

• Navigate to Groups and select All groups

• Click New group

  • Set the group type to Security

  • Name the group BlueprintPowerUsers_<API_ID>

  • Set the Membership type to Assigned

  • Add the appropriate users to the Members list.

    • These will typically be leadership colleagues from the Knowledge departments within the organisation.

Server Access Configuration

Tiger Eye will require access to the Server to deploy the Blueprint application, as well as support the application once in production. 

Access should be granted as per standard client processes. Access information should be confirmed to Tiger Eye and tested to ensure it is working as expected. 

iManage Document Store Setup

iManage will need to be configured to provide a locked-down area for Blueprint to store the knowledge documents. One of the following two approaches needs to be followed

• KM Library - Recommended. A unique KM library completely segregated from the Live iManage library can be created. A single workspace and folder will need to be created for storage, with the Service Account requiring administrative rights over this folder. No standard user should have access to this library, as it’s for storing documents from Blueprint.

• KM Workspace. A single workspace within the Live library can be created with appropriate permissions set in place to restrict access to only an appropriate Service Account, which will be used by Blueprint for storing documents.

Please take note of the Folder ID that has been created, as Tiger Eye will need this when configuring this document store.

Create Service Account

An account will be required for interacting with iManage, particularly the storage and retrieval of documents by the background Blueprint application.

• Create a VIRTUAL user within iManage Control Center

• Add the user to NRTADMIN/TIER 2 ADMIN in all libraries requiring submissions from iManage.