> ## Documentation Index
> Fetch the complete documentation index at: https://docs.qumo-deploy.com/llms.txt
> Use this file to discover all available pages before exploring further.

# Microsoft Entra ID

> Set up your organization's OIDC connection with Microsoft Entra ID.

# Microsoft Entra ID

This page covers the Microsoft Entra ID side. Saving, testing and activating the connection
are in [Single Sign-On (OIDC)](https://docs.qumo-deploy.com/guides/sso/overview.md).

## Register the app

1. In the Microsoft Entra admin center, go to **App registrations** and select
   **New registration**.
2. Under **Supported account types**, choose **Accounts in this organizational directory
   only** (single tenant).
3. Under **Redirect URI**, choose the **Web** platform and enter the connection's redirect
   URI: `https://<console host>/oauth/sso/callback`. Register.
4. On the app's **Overview**, copy the **Application (client) ID** and the **Directory
   (tenant) ID**.
5. Under **Certificates & secrets**, add a **New client secret** and copy its **Value** (not
   its Secret ID). Entra shows the value only once, and the secret expires: before it does,
   add a new one and save it on the connection.

## Issuer

```
https://login.microsoftonline.com/<tenant-id>/v2.0
```

`<tenant-id>` is the Directory (tenant) ID. Use the tenant ID itself, not `common` or
`organizations`: the issuer must match the one in the tenant's discovery document.

## Claims

Entra does not send `email_verified`, and sends `email` only as an optional claim, so two
settings are needed:

1. Under **Token configuration**, select **Add optional claim**, token type **ID**, and add
   `email` and `xms_edov` (email domain owner verified). If Entra offers to turn on the
   Microsoft Graph `email` permission, accept.
2. On the connection, map `email_verified` to `xms_edov`:

```json theme={null}
{
  "issuer": "https://login.microsoftonline.com/9188040d-6c67-4c5b-b112-36a304b66dad/v2.0",
  "client_id": "6f1c2a3b-4d5e-4f60-8a7b-9c0d1e2f3a4b",
  "client_secret": "<client secret value>",
  "claims": { "email_verified": "xms_edov" }
}
```

The `email` claim comes from the user's **Email** (mail) attribute. A user without one gets
an ID token with no email, and the test login reports `email_missing`.

### Groups

To send groups, under **Token configuration** select **Add groups claim** and choose the
group types, for example **Security groups**. Entra sends them in the `groups` claim as group
object IDs, not names.

## Scopes

The default scopes, `openid email profile`, are enough.

Then run a test login and activate the connection; see
[Single Sign-On (OIDC)](https://docs.qumo-deploy.com/guides/sso/overview.md#3-run-a-test-login).


This documentation is built and hosted on [Mintlify](https://mintlify.com), a developer documentation platform.