Skip to content
Portal

Guide: Configuring Microsoft Entra ID (Azure AD/Office 365) as an OIDC Provider

This document provides a comprehensive, step-by-step guide for administrators to configure your organization's Microsoft Entra ID (the identity platform for Office 365) as an OpenID Connect (OIDC) identity provider. The goal is to enable users from your Entra ID tenant to securely authenticate with our platform using their existing Microsoft credentials.

This guide is structured to reflect the interactive setup process between Entra ID and our platform, ensuring a smooth and successful integration.

Table of Contents

  1. Introduction & Workflow Overview
  2. Glossary of Entra ID Terms
  3. Part 1: Configure Microsoft Entra ID
  4. Part 2: Find Group Object IDs
  5. Part 3: Configure Our Platform
  6. Part 4: Add Redirect URI in Microsoft
  7. Conclusion & Next Steps
  8. Troubleshooting Common Issues

1. Introduction & Workflow Overview

Goal

Leverage your existing Microsoft Entra ID tenant as a trusted identity provider for our platform so users can sign in with their Office 365 credentials (SSO). We will configure Entra ID to send a user's group memberships, allowing our platform to automatically grant access to VDI sessions and other resources based on these groups.

Workflow Overview

Configuring an OIDC provider involves a two-way trust relationship: 1. Start in Microsoft Entra ID to generate the initial credentials (Client ID, Secret, and Issuer URL). 2. Enter these credentials in our platform to get a unique Redirect URI. 3. Return to Entra ID and add this Redirect URI to complete the secure handshake.

Prerequisites

  • An active Microsoft 365 / Azure subscription.
  • Administrative access to the Entra ID tenant (e.g., Global Administrator or Application Administrator).
  • Users and relevant Security Groups already created (e.g., a VDI_Users group).

2. Glossary of Entra ID Terms

  • Microsoft Entra ID: Cloud identity and access management for Microsoft services.
  • Microsoft Entra admin center: Management portal at https://entra.microsoft.com.
  • App Registration: Creates an application identity within Entra ID.
  • Application (Client) ID: Unique app identifier (GUID).
  • Client Secret: App password used when requesting tokens.
  • Redirect URI: URL that Entra ID can send users back to after authentication.
  • Token Configuration / Claims: Rules for what information (name, email, groups) is included in tokens.
  • Object ID: Permanent unique ID for any Entra object (users/groups). We use Group Object IDs in group claims.

3. Part 1: Configure Microsoft Entra ID

  1. Sign in to the Microsoft Entra admin center (https://entra.microsoft.com).
  2. Navigate: Identity → Applications → App registrations. (or search for "App registrations" in the top bar)
  3. Click “+ New registration”.
  4. Registration form:
  5. Name: e.g., Cloud VDI Platform Integration.
  6. Supported account types: “Accounts in this organizational directory only (Single tenant)”.
  7. Redirect URI: Leave blank for now (we will add it later in Part 4).
  8. Click “Register”.

App registration

  1. On the Overview page, copy and securely store:
  2. Application (client) ID
  3. Directory (tenant) ID

Client ID and Tenant ID

  1. Go to “Certificates & secrets”.
  2. Click “+ New client secret”, add a description (e.g., VDIPlatformSecret_2025) and expiry.
  3. Click “Add”. Immediately copy the Secret “Value” and store it securely.

Client secret

Enable Group Claims in the ID Token

To allow our platform to receive users’ group memberships, enable group claims on the application:

  1. In the App Registration, open “Token configuration”.
  2. Click “+ Add groups claim”.
  3. Select “All groups”.
  4. Under “Customize token properties by type”, select “ID”.
  5. Ensure format is “Group ID”.
  6. Click “Add”.

Group claim

4. Part 2: Find Group Object IDs

  1. In Entra admin: Identity → Groups → All groups.
  2. Copy each group’s “Object ID” (this is the permanent identifier used in mapping).

Group Object ID

5. Part 3: Configure Our Platform

  1. In our platform’s console, go to Cloud admin → Settings → OIDC providers.
  2. Click “Add Provider”.
  3. Fill in:
  4. Name: e.g., Entra ID.
  5. Client ID: Application (client) ID.
  6. Client Secret: Secret Value copied in Part 1.
  7. Issuer URL: https://login.microsoftonline.com/{tenant_id}/v2.0 (replace {tenant_id} with Directory (tenant) ID).
  8. Add your group-to-role mapping using the Group Object IDs you copied in Part 2.
  9. Group claim key: typically groups.
  10. Group name/ID: paste the Group Object ID from Part 2.
  11. Organization/Role: select the internal role/organization to grant on match.
  12. Click "Create".
  13. After saving, locate the generated Redirect URI at the bottom of the page (e.g., https://<cloud-platform-url>/oidc/callback/PROVIDER_ID).
  14. Copy the entire Redirect URI for the next step.

OIDC configuration Role mapping

6. Part 4: Add Redirect URI in Microsoft

Back in the App Registration in Microsoft Entra ID:

  1. Open “Authentication”.
  2. Click “+ Add a platform” → choose “Web”.
  3. Paste the Redirect URI you copied from Part 3 into “Redirect URIs”.
  4. Under “Implicit grant and hybrid flows,” check “ID tokens”.
  5. Click “Configure”.

The secure handshake is now complete.

Adding Redirect uri

Note on Group Claims When users log in, the ID token will contain an array of Group Object IDs for all groups the user belongs to (because we enabled group claims in Part 1). Our platform uses these IDs for role mapping configured in Part 3.

7. Conclusion & Next Steps

You have successfully configured Microsoft Entra ID as a secure identity provider for our platform.

Users can now log in using their Microsoft credentials.

8. Troubleshooting Common Issues

Error (Browser/Logs) Cause Solution
AADSTS50011: The redirect URI specified… Mismatch between our app’s Redirect URI and the URI configured in Entra Authentication Paste the exact Redirect URI generated in Part 2 and save in Part 3.
AADSTS7000215: Invalid client secret… Client secret incorrect/expired or copied incorrectly Create a new client secret (Certificates & secrets), copy its Value, update our platform.
Login succeeds, but access not granted Group membership missing or wrong Group Object ID configured in rules Verify user’s group memberships and re-copy the group Object ID into the platform rules.
“Admin consent required” during login Required permission needs admin consent In App Registration → API permissions, click “Grant admin consent for ”.