On‑premises Oracle Hyperion EPM environments more often than not rely on an external authentication provider.

While Brovanture offers hosted Oracle Hyperion EPM solutions within OCI, some customers prefer not to establish a VPN or network tunnel back to their environment to integrate with their on‑premises Microsoft Active Directory.

So, what are the alternatives?

Oracle has confirmed that Oracle Hyperion EPM supports any header‑based authentication provider. This provides flexibility in how authentication is implemented and one common example is using Azure AD (Entra ID) as the authentication source.

Microsoft Entra Private Network Connector

Download and Install on your Foundation Server (current link April ’26)

https://download.msappproxy.net/subscription/d3c8b69d-6bf7-42be-a529-3fe9c2e70c90/connector/download

Once installed it should run neatly as a Windows Service:

Set up an Enterprise Application in Azure and Register the Server with the private connector installed:

In your application proxy, set your internal URL and external URLs in the appropriate fields

Setup your users:

We’ll use the use.mail attribute in this example

Login to Workspace – Shared Services.

Administration ->  Configure User Directories

Use the Security Options tab.  In ‘Single Sign-On- Configuration’ as below, note that SSO mechanism needs to be set to ‘Custom HTTP Header’ ->HYPLOGIN

The user must exist as a Native user and be provisioned using the full email address as the username as it will be federated

Open the External URL Defined in the Application Proxy to be prompted for authentication

Note, you can enable a MFA layer here such as code authentication delivered from the MS Authenticator App, this should be set up by your Azure admin with little to no fuss.

Pass this point – you’re in!

Considerations:

While you’re in the testing phase, I’d advise to first set the Workspace Server Setting ‘Allow Direct Logon After SSO Failure’ to ‘Yes’ as otherwise any authentication other than Azure SSO will be locked out:

 

Breakglass Solution – IcoE 😉

Before configuring SSO run the command from:

\Oracle\Middleware\user_projects\<EPM_HOME>\bin

epmsys_registry.bat view shared_services_product/@CSSConfig

This writes the file ‘Comp_1_SHARED_SERVICES_PRODUCT_CSSConfig’ in ..\Oracle\Middleware\user_projects\<EPM_HOME>\bin

Take a backup of this file.

Note that post SSO Switch-on, when running the same command the file will then contain:

</delegatedUserManagement>

<enableHTTPURLAccess>false</enableHTTPURLAccess>

<securityAgent name=”OTHER”><ssoMode>CUSTOM_HTTP_HEADER</ssoMode><ssoValue>HYPLOGIN</ssoValue></securityAgent><groupsCacheRefreshInterval>60</groupsCacheRefreshInterval></css>

Either:

• Modify to original state and update
• Update from post SSO switch on file (Comp_1_SHARED_SERVICES_PRODUCT_CSSConfig)

To update, run the command

epmsys_registry update file shared_services_product/@CSSConfig Comp_1_SHARED_SERVICES_PRODUCT_CSSConfig

Restart Services

If you are interested in moving to this authentication approach, it can typically be implemented quickly alongside your existing environment.

Please feel free to get in touch – Brovanture would be happy to help.

Until next time

Ben