---
title: "Microsoft Entra ID Configuration for SSO"
slug: "microsoft-entra-id-configuration-for-sso"
updated: 2026-08-14T20:23:51Z
published: 2026-08-14T20:23:51Z
canonical: "kb.expedient.com/microsoft-entra-id-configuration-for-sso"
---

> ## Documentation Index
> Fetch the complete documentation index at: https://kb.expedient.com/llms.txt
> Use this file to discover all available pages before exploring further.

# Microsoft Entra ID Configuration for SSO

## Microsoft Entra ID Configuration for SSO

This guide is for the team that manages your organization's Microsoft Entra ID tenant. It walks through creating the app registration AI CTRL uses for single sign-on, and ends with the three values you'll send to Expedient.

You'll need at least **Application Developer** privileges in Entra.

> Throughout this guide, replace `your-domain.com` with your AI CTRL gateway address. Expedient will confirm it if you're unsure.

## Step 1 · Create the web app registration

Sign in to the [Microsoft Entra admin center](https://entra.microsoft.com). Go to **Identity → Applications → App registrations** and select **New registration**.

Configure the basic settings:

- **Name** — something meaningful, such as `OpenWebUI-SSO-Production`
- **Supported account types** — *Accounts in this organizational directory only* for single-tenant, or *Accounts in any organizational directory* if you need multi-tenant support
- **Redirect URI** — select **Web** as the platform type, and enter `https://your-domain.com/oauth/microsoft/callback`

After clicking **Register**, record the **Application (client) ID** and **Directory (tenant) ID** from the Overview page. You'll send both to Expedient.

## Step 2 · Configure authentication settings

In your app registration, go to **Authentication** under Manage. If you didn't add a platform during registration, click **Add a platform** and select **Web**.

Redirect URIs must match exactly what AI CTRL sends. For production, add:

- `https://your-domain.com/oauth/microsoft/callback`

Under **Implicit grant and hybrid flows**, enable **ID tokens** to support the hybrid flow.

Set the **Front-channel logout URL** to `https://your-domain.com/logout` so sign-out works correctly across sessions.

## Step 3 · Generate a client secret

Go to **Certificates & secrets**. Under **Client secrets**, click **New client secret**. Give it a descriptive name such as `Expedient AI CTRL` and choose an expiration period — Microsoft recommends 6–12 months, with 24 months as the maximum.

> **Copy the secret value immediately.** Azure will never display it again. You need the secret *value*, not the secret ID. Store it in a password manager or secret vault until you send it to Expedient.

## Step 4 · Set API permissions

Go to **API permissions**. The default **User.Read** permission for Microsoft Graph is usually sufficient for basic SSO.

Click **Grant admin consent for [your tenant]** to approve this organization-wide. Without admin consent, users are prompted to approve permissions individually on first login.

## Group names and roles

If you want your Entra security groups to appear in AI CTRL as readable names rather than GUIDs, that's a separate configuration with requirements that conflict with the defaults — do it after SSO is working, following [Microsoft Entra ID Group Name Sync](https://kb.expedient.com/docs/microsoft-entra-id-group-name-sync).

> **Don't add a groups claim here.** The group sync configuration requires `groupMembershipClaims` to be set to a specific value, and adding a claim during SSO setup with the default selection will work against it.

## What to send Expedient

Send these to your Expedient project team through your project ticket:

| Value | Where to find it |
| --- | --- |
| Application (client) ID | App registration → Overview |
| Directory (tenant) ID | App registration → Overview |
| Client secret value | Generated in Step 3 — copy it at creation |

## Related articles

- [Okta OIDC Configuration for SSO](https://kb.expedient.com/docs/okta-oidc-configuration-for-sso)
- [Duo OIDC Configuration for SSO](https://kb.expedient.com/docs/duo-oidc-configuration-for-sso)
- [Microsoft Entra ID Group Name Sync](https://kb.expedient.com/docs/microsoft-entra-id-group-name-sync)