> For AI agents: [llms.txt](https://docs.trustedauth.com/llms.txt) provides a Markdown index of this documentation.

# Microsoft Entra ID

Microsoft Entra ID is Microsoft's cloud-based identity and access management service. You can integrate Microsoft Entra ID with IDaaS. When integrated, your users can log in using IDaaS authentication or log in using their Microsoft Entra ID credentials.

## Step 1: Open two browser windows

1. In one browser window, log in to your IDaaS administrator account.
2. In the other browser, log in to your Microsoft Entra ID administrator account.

## Step 2: Copy the Redirect URI from IDaaS

1. In IDaaS, click Menu icon **>** **Security > Identity Providers**. The **Identity Providers List** page appears.
2. Click **Add** and select **Microsoft OIDC** from the drop-down list. The **Add Identity Provider** page appears.
3. Enter a **Name** for your Identity Provider, for example, `Microsoft Entra ID`.
4. Locate the **Redirect URI** and copy it to a text file. You need this value in _Step 4: Create an App Registration and application secret._
5. Keep this page open. You need it for _Step 5: Add Microsoft Entra ID to IDaaS_.

## Step 3: Create an App Registration and application secret in Microsoft Entra ID

1. Log in to your Microsoft Entra ID account portal.

2. Select **Microsoft Entra ID** to go to the **Microsoft Entra ID** page.

3. Under **Manage**, select **App registration**. The **Register an application** page appears.

4. Click **New registration**. The **Register an application** page appears.

5. Enter a **Name** that your users see that identifies the application.

6. In the **Redirect URI** field, select **Web** as the platform and enter the Redirect URI you copied in _Step 1: Copy the Redirect URI from IDaaS._

7. Click **Register**. The **App** page appears.

8. Copy the following values and save them to a text file. You need them in _Step 4: Add Microsoft Microsoft Entra ID to IDaaS_

   - Application (client) ID
   - Directory Tenant ID

tip
Include the name so that you can identify the value when you need to enter it in the corresponding fields in _Step 4: Add Microsoft Entra ID to IDaaS._ You only need to copy the value into the fields. The name is to help ensure that you enter the correct value in the correct field.

9. In the menu pane, click **Token configuration**. The **Token configuration** page appears.

10. Click **Add optional claim** to add the upn optional claim for an ID token.

11. Under **Token type**, select ID, then select upn checkbox.

12. Click **Add** to add the optional claim.

13. In the menu pane, click **Certificates & secrets**. The **Certificates & secrets** page appears.

14. Under **Client Secrets**, click **New client secret**. The **Add a client secret** dialog box appears.

15. Add a **Description** for the client secret, for example, IDaaS IDP secret.

16. Click **Add** to add the client secret to the **Client secrets** list.

17. Copy the **Value** and save it to the text file you created in step 8, above. This is the client secret. Include a name for the value as you did in step 7 (see the tip). You need this value in _Step 5: Add Microsoft Entra ID to IDaaS_.

18. Leave this page open and continue to _Step 4: Create new users in Microsoft Entra ID_.

## Step 4: Add Microsoft Entra ID as an Identity Provider in IDaaS

1. Return to the browser window that displays the **IDaaS Identity Provider** page that you opened in _Step 2: Copy the Redirect URI from IDaaS_.

2. Open the text file you created in _Step 3: Create an app and registration secret in Microsoft Entra ID._

3. In the **Client ID** field, paste the **Application (client) ID** that you copied from _Microsoft Entra ID_.

4. In the **Client Secret** field, enter the Value (client secret) that you copied from _Microsoft Entra ID_.

5. In the **Issuer** field, enter `https://login.microsoftonline.com/<tenantID>/v2.0` where `<tenantID>` is the Microsoft Entra ID (tenant) ID that you copied from _Microsoft Entra ID_.

6. Click **Fetch Configuration** to populate the fields for the **OIDC Endpoints** and the **Scopes**.

7. Enter the **Requested information from the Identity Provider**.

   1. Accept the default **Scopes**.

      Associated with each scope are claims. The Identity Provider returns multiple claims based on the requested scopes. The openid scope is mandatory to do authentication or verification.

   2. Enter the **ID Tokens** **Claims**. Separate each value with a space. Leave this setting blank to omit the feature.

      Id token claims requests from the Identity Provider define specific claims that can also be requested for inclusion in the returned `id token`. This can be used in addition to the requested scopes.

   3. Enter the **User Information Claims**. Separate each value with a space. Leave this setting blank to omit the feature.

      User information claims requests from the Identity Provider define specific claims that can also be requested for inclusion in the returned `userinfo` response. This can be used in addition to the requested scopes.

8. Enter the **Auth Context Request Values** that are used by your Identity Provider. Separate each value with a space. Leave this setting blank to omit this feature.

9. Enter the **Auth Method Request values** that are used by your Identity Provider. Separate each value with a space. Leave this setting blank to omit this feature.

10. Configure **Branding** as follows:

    1. Enter the **Login Button Text**. This is the text that appears on the IDaaS log in page.
    2. If your Identity Provider has a login button image, enter the URL in the **Login Button Image** field. The login button appears on the IDaaS log in page.

11. Configure **User Management**.

    1. Select **Create User** to create the user whose information is returned from the Identity Provider if it does not already exist.

    attention
    **Create user** allows anyone with access to your chosen Microsoft Entra ID to create a user in your IDaaS account. Depending on your IDaaS configuration, new users created by your IDP will be able to access all the resources controlled by your IDaaS account. This may be a concern if your Identity Provider has no limits on who can create an account or if it has a large userbase. Analyze the risks before enabling this option.

    2. Select **Update User** **(Authentication)** to update the IDaaS user to match the Identity Provider during authentication.

       If you select **Update User (Authentication)**, the IDaaS system user attributes and any existing IDaaS custom user attributes can be set based on claim mappings. After user authentication, if the user exists in IDaaS, IDaaS compares the attributes of the existing user to the claims returned from Microsoft Entra ID. If they are different, the IDaaS user attributes are updated with the claim values.

    3. The following system attributes are mandatory in IDaaS by default:

       - Email: `email`
       - First name: `given_name`
       - Last name: `family_name`

    4. If they do not exist in your Microsoft Entra ID account, you must add them to your user profiles or make them optional in IDaaS. See your Microsoft Entra ID documentation for information on how to add a new user or update an existing user profile.

    5. Optional. Select **Update User** **(Verification)** to update the IDaaS user to match the Identity Provider during Identity Provider verification (if verification is used by the Identity Provider).

       If you select **Update User (Verification)**, the IDaaS system user attributes and any existing IDaaS custom user attributes can be set based on claim mappings. After user verification, the IDaaS user attributes are updated with the claim values.

12. In the **Group Mapping** field, enter the claim containing the group membership for users.

    Only existing groups are mapped. If a group is not found, it is not mapped. The mapping does not remove any existing groups. If group mapping is not configured, existing groups remain.

attention
**Group Mapping** allows anyone with access to this Identity Provider to have their IDaaS groups include the groups defined by the Identity Provider. Groups set the policies applied to users. Enabling this setting could result in users having access to unexpected policies, especially if the Identity Provider has different user access policies than IDaaS. Analyze the risks before configuring this option.

13. In the **Role Mapping** field, enter the claim containing the role membership for users.

    Only existing roles are mapped. If the role is not found, it is not mapped. The mapping does not remove an existing role. If a role is mapped and is different from the existing role, the existing role is replaced. If role mapping is not configured and if there is an existing role exist, the existing role remains.

warning
**Role Mapping** allows anyone with access to this Identity Provider to have their IDaaS account role defined by the Identity Provider, including the super administrator role that has access to all the resources controlled by your IDaaS account. Enabling this setting could result in unexpected access, especially if your identity provider has different user access policies than IDaaS. Analyze the risks before configuring this option.

note
If any system attributes are mandatory, a claim value must be mapped if users are being created. If is a claim value is not mapped, then user creation fails. In addition, claim values must be valid (for example, the Email attribute requires a valid email address). Before mapping claims to attributes, ensure that the claim value exists with your Identity Provider, this includes mandatory custom user attributes.

14. Configure **User Authentication** as follows:

    1. Select **Enabled for User Authentication**.

       During authentication, the Identity Provider returns a claim value that is used to find the IDaaS user based on a user attribute. The attribute mappings in the claim must uniquely identify the IDaaS user for mapping to be successful. If mapped successfully, the Identity Provider can be used as an alternative authentication method.

    2. In the **Domains** field, enter the domains returned from the OIDC Identity Provider after authentication. When set, any user ID ending with the domain (for example `user@mycompany.com`), or one of the domains is linked to the Identity Provider. Separate each domain with a space.

    3. From the drop-down list, select the **User Attribute used to identity the user** to map a claim returned from the Identity Provider to the IDaaS user (for example, `User ID/Alias`).

    4. Enter the **Claim used to identify the user**, (for example, `email`).

       > **Example:** If you set `User ID/Alias` as the user attribute, and you set `email` as the claim to use, the email address is then used to locate the user in IDaaS using the user's `User ID/Alias` value.

    5. Optional. Configure **System User Matching** and **Custom** **User Match Mapping**.

       - Every configured attribute must match the corresponding Identity Provider claim value and the IDaaS user attribute, which must both exist and match.
       - User matching is case-insensitive.

15. Optional (if user verification is used with the Identity Provider). Under **User Verification**, do the following:

    1. Select **Enable for User Verification** if you want the Identity Provider to be used for verification (for example, allowing an Open ID Connect Identity Provider to validate a user's photo or private identification information).
    2. Configure at least one **User Match Mapping**.
       - Users must already exist in IDaaS.
       - Every configured attribute must match both IDaaS and the Identity Provider.
       - User match attributes are case insensitive.

info
See [Manage policies, registration, and verification](/docs/people-and-access/manage-user-policies.md) for more information on the verification process.

16. Click **Save**.