Microsoft Entra ID

Microsoft Entra ID#

sysman sysadmin

With the Microsoft Entra ID provider, users sign in to Allegra with their Microsoft accounts. The login page shows the button Continue with Microsoft Entra ID.

In the Microsoft Entra admin center, register an application for Allegra with a web redirect URI set to the callback URL shown in the provider form (see Callback URL), and create a client secret.

Note

The Microsoft Entra ID provider is also the prerequisite for the Microsoft Exchange Online email integration (see Incoming email connection and MS Exchange Server). If you use it, register {ALLEGRA_URL}/msExchangeAuthCallback.action as an additional web redirect URI in the app registration.

In Allegra, go to Administration > Users & Groups > Authentication > OpenID providers and add the provider Microsoft Entra ID. Unlike the other provider types, Microsoft Entra ID has its own configuration form.

In the fieldset Microsoft Entra ID configuration you enter:

  • Application (client) ID — from the app registration.

  • Application (client) secret — the client secret. After saving it is only displayed masked; to replace it, remove it first with the Remove client secret button.

  • Directory (tenant) ID — your Entra tenant. Without it, the provider is not offered for sign-in.

  • Service Desk Application (client) ID — optional; only needed for the Service Desk single sign-on, not for Allegra single sign-on.

The fieldset Microsoft Single Sign On configuration contains the SSO activated check box, the callback URL, and the user matching and auto-registration settings described in User matching and auto-registration. In addition:

  • MS Azure Authority URL — default https://login.microsoftonline.com.

  • MS Azure logout URL suffix — default /oauth2/v2.0/logout.

  • MS Azure application scopes — default openid profile. The scope profile is re-added automatically if removed.

There is no issuer URL field: it is derived from the authority URL and the tenant ID. Likewise, the logout endpoint is the authority URL plus the logout URL suffix.

Note

Microsoft sign-in always shows the Microsoft account picker, so users with several Microsoft accounts can choose the right one.

For user matching, Microsoft Entra ID reports the preferred_username claim of the Microsoft account.

Note

Entra configurations created before Allegra 9.0.2 keep the old redirect URI msAzureSsoCallback.action; the Azure app registration needs no change. Newly created providers use /sso/callback.