Microsoft Entra ID Configuration for SSO

Microsoft Entra ID Configuration for SSO

This guide is for the team that manages your organization's Microsoft Entra ID tenant. It walks through creating the app registration AI CTRL uses for single sign-on, and ends with the three values you'll send to Expedient.

You'll need at least Application Developer privileges in Entra.

Throughout this guide, replace your-domain.com with your AI CTRL gateway address. Expedient will confirm it if you're unsure.

Step 1 · Create the web app registration

Sign in to the Microsoft Entra admin center. Go to Identity → Applications → App registrations and select New registration.

Configure the basic settings:

• Name — something meaningful, such as OpenWebUI-SSO-Production
• Supported account types — Accounts in this organizational directory only for single-tenant, or Accounts in any organizational directory if you need multi-tenant support
• Redirect URI — select Web as the platform type, and enter https://your-domain.com/oauth/microsoft/callback

After clicking Register, record the Application (client) ID and Directory (tenant) ID from the Overview page. You'll send both to Expedient.

Step 2 · Configure authentication settings

In your app registration, go to Authentication under Manage. If you didn't add a platform during registration, click Add a platform and select Web.

Redirect URIs must match exactly what AI CTRL sends. For production, add:

• https://your-domain.com/oauth/microsoft/callback

Under Implicit grant and hybrid flows, enable ID tokens to support the hybrid flow.

Set the Front-channel logout URL to https://your-domain.com/logout so sign-out works correctly across sessions.

Step 3 · Generate a client secret

Go to Certificates & secrets. Under Client secrets, click New client secret. Give it a descriptive name such as Expedient AI CTRL and choose an expiration period — Microsoft recommends 6–12 months, with 24 months as the maximum.

Copy the secret value immediately. Azure will never display it again. You need the secret value, not the secret ID. Store it in a password manager or secret vault until you send it to Expedient.

Step 4 · Set API permissions

Go to API permissions. The default User.Read permission for Microsoft Graph is usually sufficient for basic SSO.

Click Grant admin consent for [your tenant] to approve this organization-wide. Without admin consent, users are prompted to approve permissions individually on first login.

Group names and roles

If you want your Entra security groups to appear in AI CTRL as readable names rather than GUIDs, that's a separate configuration with requirements that conflict with the defaults — do it after SSO is working, following Microsoft Entra ID Group Name Sync.

Don't add a groups claim here. The group sync configuration requires groupMembershipClaims to be set to a specific value, and adding a claim during SSO setup with the default selection will work against it.

What to send Expedient

Send these to your Expedient project team through your project ticket:

Related articles

• Okta OIDC Configuration for SSO
• Duo OIDC Configuration for SSO
• Microsoft Entra ID Group Name Sync