Microsoft Entra ID

This page covers the Microsoft Entra ID side. Saving, testing and activating the connection are in Single Sign-On (OIDC).

Register the app

In the Microsoft Entra admin center, go to App registrations and select New registration.
Under Supported account types, choose Accounts in this organizational directory only (single tenant).
Under Redirect URI, choose the Web platform and enter the connection’s redirect URI: https://<console host>/oauth/sso/callback. Register.
On the app’s Overview, copy the Application (client) ID and the Directory (tenant) ID.
Under Certificates & secrets, add a New client secret and copy its Value (not its Secret ID). Entra shows the value only once, and the secret expires: before it does, add a new one and save it on the connection.

Issuer

https://login.microsoftonline.com/<tenant-id>/v2.0

<tenant-id> is the Directory (tenant) ID. Use the tenant ID itself, not common or organizations: the issuer must match the one in the tenant’s discovery document.

Claims

Entra does not send email_verified, and sends email only as an optional claim, so two settings are needed:

Under Token configuration, select Add optional claim, token type ID, and add email and xms_edov (email domain owner verified). If Entra offers to turn on the Microsoft Graph email permission, accept.
On the connection, map email_verified to xms_edov:

{
  "issuer": "https://login.microsoftonline.com/9188040d-6c67-4c5b-b112-36a304b66dad/v2.0",
  "client_id": "6f1c2a3b-4d5e-4f60-8a7b-9c0d1e2f3a4b",
  "client_secret": "<client secret value>",
  "claims": { "email_verified": "xms_edov" }
}

The email claim comes from the user’s Email (mail) attribute. A user without one gets an ID token with no email, and the test login reports email_missing.

Groups

To send groups, under Token configuration select Add groups claim and choose the group types, for example Security groups. Entra sends them in the groups claim as group object IDs, not names.

Scopes

The default scopes, openid email profile, are enough. Then run a test login and activate the connection; see Single Sign-On (OIDC).

​Microsoft Entra ID

​Register the app

​Issuer

​Claims

​Groups

​Scopes