# Microsoft Entra ID

Steps verified in the identity provider's admin console.

Recommended protocol: SAML 2.0.

The identity provider can provision users and groups with SCIM 2.0.

## SAML 2.0

### Connect Microsoft Entra ID with SAML 2.0

1. In the Microsoft Entra admin center go to Entra ID \> Enterprise apps \> All applications. Open your application, or click New application \> Create your own application, enter a name, choose Integrate any other application you don't find in the gallery (Non-gallery) and click Create.

   ![Create your own application pane with the non-gallery option selected](/assets/idp-guides/entra-id/saml-1.png)

2. In the Manage section select Single sign-on and choose SAML.

   ![Single sign-on page with the SAML method](/assets/idp-guides/entra-id/saml-2.png)

3. Select Edit in Basic SAML Configuration. Click Add identifier and enter **SP entity ID** as Identifier (Entity ID), click Add reply URL and enter **ACS URL** as Reply URL (Assertion Consumer Service URL), then Save. When asked whether to test single sign-on, choose No, I'll test later.

   ![Basic SAML Configuration with Identifier and Reply URL](/assets/idp-guides/entra-id/saml-3.png)

4. Check Attributes \& Claims: Entra sends emailaddress, givenname and surname by default. For groups select Edit \> Add a group claim.

   ![Attributes and Claims with the default claims](/assets/idp-guides/entra-id/saml-4.png)

5. In SAML Certificates copy the App Federation Metadata Url, or download Federation Metadata XML, and upload it in KeenAuth.

   ![SAML Certificates with App Federation Metadata Url and Federation Metadata XML download](/assets/idp-guides/entra-id/saml-5.png)

6. In Users and groups assign the users and groups who should sign in, then use Test this application in the Entra pane and run the KeenAuth connection test.

   ![Users and groups page with Add user/group](/assets/idp-guides/entra-id/saml-6.png)


## OpenID Connect

### Connect Microsoft Entra ID with OpenID Connect

1. In the Microsoft Entra admin center go to Entra ID \> App registrations and click New registration. Enter a Name, keep Supported account types on Single tenant only, under Redirect URI select the platform Web and enter **redirect URI**, then click Register.

   ![Register an application with Single tenant only and a Web redirect URI](/assets/idp-guides/entra-id/oidc-1.png)

2. Use your own tenant's Directory (tenant) ID from the app's Overview in the issuer: `https://login.microsoftonline.com/`\<tenant\_id\>/v2.0. Do not use common, organizations or consumers.

   ![Overview essentials with the Application (client) ID and Directory (tenant) ID fields](/assets/idp-guides/entra-id/oidc-2.png)

3. Copy the Application (client) ID from Overview. Then add a credential in Certificates \& secrets. Recommended (private\_key\_jwt): open Certificates, click Upload certificate, select the KeenAuth certificate downloaded from **KeenAuth client certificate** (.pem), enter a Description and click Add; upload the new certificate too when KeenAuth rotates its key. Alternatively open Client secrets, click New client secret, choose Description and Expires, click Add and copy the Value (it is shown only once).

   ![Certificates and secrets with the Upload certificate pane](/assets/idp-guides/entra-id/oidc-3.png)

4. Enter the tenant ID and client ID in KeenAuth, and the client secret if you chose one; KeenAuth rejects tokens whose tid claim differs from the registered tenant.

## SCIM 2.0

### Provision users from Microsoft Entra ID with SCIM 2.0

1. In KeenAuth create a directory and copy the SCIM base URL **SCIM base URL** and the token **SCIM token** (shown once).
2. In the Entra enterprise application open Provisioning and click Connect your application. Keep Select authentication method on Bearer authentication, enter the base URL as Tenant URL and the token as Secret token, click Test connection, then Create.

   ![New provisioning configuration with Bearer authentication, Tenant URL and Secret token](/assets/idp-guides/entra-id/scim-2.png)

3. Under Manage \> Attribute mapping review the mappings (userName, externalId, active, name, emails).
4. In Users and groups assign users or groups, start provisioning from Overview, and check the KeenAuth directory for the first sync.

Values in bold are shown on the connection's page in the Admin Portal, where this guide has them filled in.