All Products
Search

This Product

    Identity as a Service:Bind IDaaS to Microsoft Entra ID (Azure AD)

    Document Center

    Identity as a Service:Bind IDaaS to Microsoft Entra ID (Azure AD)

    Last Updated:Aug 21, 2026

    Use the OpenID Connect (OIDC) protocol to connect Microsoft Entra ID (Azure AD) as an external identity provider (IdP) for your IDaaS EIAM user portal. Once configured, employees can log on to the IDaaS user portal using their Entra ID accounts.

    Prerequisites

    Before you begin, ensure that you have:

    How it works

    The setup involves four steps:

    1. Register an app in Microsoft Entra ID and collect three credentials: Client ID, Client Secret, and Issuer URL.

    2. Start the OIDC IdP connection in the IDaaS console.

    3. Enter the credentials in IDaaS and copy the Redirect URI back to the Entra ID app.

    4. Verify that users can log on through Entra ID.

    Step 1: Register an app in Microsoft Entra ID

    1. Go to the Microsoft Entra admin center. In the search box, type Microsoft Entra ID and select it under Services.

    2. On the Overview page, click Add > App Registration.

    3. On the Register an application page, configure the following settings, then click Register.

      Field Value
      Name IDaaS
      Supported account types Accounts in this organizational directory only
      Redirect URI type Web
      Redirect URI Leave this blank for now — copy this value from IDaaS in Step 3

    4. After the app is created, its Overview page appears. Note the Application (client) ID — this is the Client ID you will need in Step 3.

    5. Add a client secret. In the left navigation, click Certificates & secrets, then add a new client secret.

      Important

      Copy the secret value immediately after creation — it is not shown again. If the secret has an expiration date, record it and renew before it expires to avoid a service interruption.

      1. On the Certificates & secrets page, select the Client secrets tab and click + New client secret.

      2. In the Add a client secret panel on the right, enter a description and select an Expires duration.

      3. Click Add.

    6. Get the Issuer URL. Click Endpoints at the top of the Overview page, then find the OpenID Connect metadata document URL. The Issuer URL is: https://login.microsoftonline.com/common/v2.0 You now have all three pieces of information needed for Step 3: Client ID, Client Secret, and Issuer URL.

    Step 2: Start the OIDC IdP connection in IDaaS

    1. Log on to the IDaaS console. Select your IDaaS instance and click Console in the Actions column.IDaaS console

    2. In the left navigation, click IdPs > Other IdPs > OIDC IdP.

    Step 3: Connect the OIDC identity provider

    Fill in the IDaaS OIDC IdP form using the credentials from Step 1.

    Basic information

    Field Description
    Logon method icon Upload a PNG or JPG file (max 1 MB, 256 × 256 pixels recommended). This icon appears on the IDaaS logon page.
    Display name The label shown on the logon page for this authentication method. New or modified names go through a review before taking effect — the previous name remains visible during review.

    Network configurations

    Field Description
    Network access endpoint Select Shared Network Access Endpoint or Dedicated Network Access Endpoint. See Network endpoints for guidance.

    Logon settings

    Field Description
    Grant types Select Authorization Code for standard deployments. Select PKCE in addition if you require extra security verification.
    Authentication method Select client_secret_post to attach credentials in the POST request body (more common), or client_secret_basic to pass encoded credentials in the Authorization header.
    Client ID Paste the Application (client) ID from the app's Overview page in Entra ID.
    Client Secret Paste the secret value you copied in Step 1.
    Scopes Select the scopes you need. For example, select email to retrieve the user's email address.

    Endpoint configurations

    Field Description
    Issuer Paste the Issuer URL from Step 1 (https://login.microsoftonline.com/common/v2.0). Click Parse to automatically populate the remaining endpoint fields.

    After clicking Parse, confirm the populated endpoints look correct:

    The automatically populated endpoints include Authorization endpoint, Token endpoint, JWKs URI, and Userinfo endpoint.

    Click Next to proceed to scenario selection. For details, see Select a scenario.

    Copy the Redirect URI back to Entra ID

    After clicking Next, IDaaS displays the IDaaS Redirect URI.

    Copy this URI. Go back to your Entra ID app registration and add it as the Redirect URI (the field you left blank in Step 1).

    Step 4: Verify the logon flow

    1. Access the IDaaS EIAM user portal. The Entra ID logon method you configured appears on the logon page.

      At the bottom of the logon page, under Other logon methods, click Azure AD to authenticate using Azure AD.

    2. Click the logon method. The user is redirected to Entra ID for authentication. If the user is not already logged in to Entra ID, the Entra ID logon page appears.

      On the Microsoft sign-in page, enter your Email, phone, or Skype account and click Next.

    3. After authentication, the user is redirected back to IDaaS:

      • If the Entra ID account is already linked to an IDaaS account, the user logs on directly.

      • If not linked, IDaaS attempts automatic account linking. If automatic linking fails, the user must manually link accounts or have one created automatically, as configured in the scenario selection step. See Select a scenario.

    What's next