---
title: "Microsoft Entra ID"
description: "Set up Microsoft Entra ID for single sign-on (SSO) in Middleware for secure and seamless user authentication."
section: "Settings"
breadcrumb: "Settings > Single Sign-On (SSO) > Microsoft Entra ID"
canonical: "https://docs.middleware.io/features/accounts/sso/microsoft-entra-id"
---
# Microsoft Entra ID

Microsoft Entra ID (formerly Azure Active Directory) is Microsoft's comprehensive cloud-based identity and access management service. This integration enables seamless Single Sign-On (SSO) authentication for Middleware, allowing your organization to centralize user authentication and access control. With Microsoft Entra ID SSO, users can access Middleware using their existing Microsoft 365 or Azure AD credentials, eliminating the need for separate login credentials while maintaining enterprise-grade security and compliance standards.

**Integrate with Microsoft Entra ID to**

- Single Sign-On (SSO) authentication using Microsoft Entra ID credentials
- Compliance with enterprise security policies and audit requirements
- Seamless integration with the existing Microsoft ecosystem and workflows.
- Supports both SAML and OIDC authentication protocols

## Prerequisits

To configure SSO, you need:

**Middleware**

- You must be an owner of the account.

**Microsoft Entra ID**

- A Microsoft Entra user account with one of the following roles: Cloud Application Administrator, Application Administrator, or owner of the service principal.

## SAML (Security Assertion Markup Language) Protocol

### Enable SSO for Middleware in Microsoft Entra ID

To enable SSO for an application:

1. Sign in to the [Microsoft Entra admin center](https://entra.microsoft.com/) as at least a [Cloud Application Administrator](https://learn.microsoft.com/en-in/entra/identity/role-based-access-control/permissions-reference#cloud-application-administrator).
2. Browse to **Entra ID** > **Enterprise apps** > **All applications**.

   ![Enable SSO for Middleware in Microsoft Entra ID](/images/settings/microsoft-entra-id/enable_sso_for_mw_in_ms_entra_id_1.png)
3. Select **New application**.
4. The **Browse Microsoft Entra Gallery** pane opens. Select **Create your own application**.
5. On the **Create your own application** pane, enter “Middleware” as the name of an app.
6. Select **Integrate any other application you don't find in the gallery (Non-gallery)**.

   ![Enable SSO for Middleware in Microsoft Entra ID](/images/settings/microsoft-entra-id/enable_sso_for_mw_in_ms_entra_id_2.png)
7. Select **Create**.
8. The app **Overview** page opens. In the left menu under **Manage**, select **Single sign-on**.
9. Under **Select a single sign-on method**, select **SAML**.

   ![Enable SSO for Middleware in Microsoft Entra ID](/images/settings/microsoft-entra-id/enable_sso_for_mw_in_ms_entra_id_3.png)
10. On the **SAML-based Sign-on** page, click on the **Edit** pencil icon of the **Basic SAML Configuration** section.

    ![Enable SSO for Middleware in Microsoft Entra ID](/images/settings/microsoft-entra-id/enable_sso_for_mw_in_ms_entra_id_4.png)
11. On the **Basic SAML Configuration** pane, enter the values described below in the respective fields, and then click **Save**.

    a. **Identifier (Entity ID)**: `https://app.middleware.io`

    b. **Reply URL (Assertion Consumer Service URL)**: `https://app.middleware.io/api/v1/auth/saml/acs`

    ![Enable SSO for Middleware in Microsoft Entra ID](/images/settings/microsoft-entra-id/enable_sso_for_mw_in_ms_entra_id_5.png)
12. In the **SAML Certificates** section, record the value of the **App Federation Metadata Url** property to be used later.

    ![Enable SSO for Middleware in Microsoft Entra ID](/images/settings/microsoft-entra-id/enable_sso_for_mw_in_ms_entra_id_6.png)

### Configure Microsoft Entra ID integration in the Middleware

To enable SSO login in the Middleware with Microsoft Entra ID:

1. Sign in to the **Middleware** as an account owner.
2. Browse to **Installation** > **Integration** > **SSO** > **Microsoft Entra ID**.

   ![Configure Microsoft Entra ID integration in the Middleware](/images/settings/microsoft-entra-id/configure_ms_entra_id_in_mw_1.png)
3. Select the **SAML** protocol.
4. Paste the **App Federation Metadata Url** that you recorded while configuring SSO in the Microsoft Entra Admin Center, and then click **Submit**.

   ![Configure Microsoft Entra ID integration in the Middleware](/images/settings/microsoft-entra-id/configure_ms_entra_id_in_mw_2.png)

## OIDC (OpenID Connect) Protocol

### Enable SSO for Middleware in Microsoft Entra ID

#### Register the application

1. Sign in to the [Microsoft Entra admin center](https://entra.microsoft.com/) as at least a [Cloud Application Administrator](https://learn.microsoft.com/en-in/entra/identity/role-based-access-control/permissions-reference#cloud-application-administrator).
2. Browse to **Entra ID** > **App registrations** > **New registration**.

   ![Configure Microsoft Entra ID integration in the Middleware](/images/settings/microsoft-entra-id/enable_sso_for_oidc_1.png)
3. On the **Register an application** pane, enter “Middleware” as the name of an app.
4. Under **Supported account types**, select the **Accounts in this organizational directory only** option.
5. For **Redirect URI**, select **Web** as the platform type and enter `https://app.middleware.io/api/v1/auth/login/oidc/microsoft_entra_id/callback` as the redirect URI.

   ![Configure Microsoft Entra ID integration in the Middleware](/images/settings/microsoft-entra-id/enable_sso_for_oidc_2.png)
6. Select **Register**.

#### Configure client credentials

1. In the registered app, navigate to **Certificates & secrets**.
2. Select **New client secret**. Add a description and select an expiration period.
3. Select **Add** and copy the secret value immediately (it can't be shown again). Store this client secret in a secure place to be used later.

   ![Configure Microsoft Entra ID integration in the Middleware](/images/settings/microsoft-entra-id/enable_sso_for_oidc_3.png)

#### Configure API permissions

1. Navigate to API permissions.
2. The `User.Read` permission for Microsoft Graph is added by default.
3. To add more permissions:

   a. Select **Add a permission**

   b. Choose **Microsoft Graph**

   c. Select **Delegated permissions**

   d. Search for and select **openid**, **profile**, and **email** permissions

   e. Select **Add permissions**

   ![Configure Microsoft Entra ID integration in the Middleware](/images/settings/microsoft-entra-id/enable_sso_for_oidc_4.png)

   ![Configure Microsoft Entra ID integration in the Middleware](/images/settings/microsoft-entra-id/enable_sso_for_oidc_5.png)

   f. Select **Grant admin consent** to approve these permissions on behalf of all users, so individual users won’t be prompted to provide access.

   ![Configure Microsoft Entra ID integration in the Middleware](/images/settings/microsoft-entra-id/enable_sso_for_oidc_5_1.png)

#### Configure claims

1. Navigate to **Token configuration**.
2. Select **Add optional claim**.
3. Select **ID** as the token type and choose the `upn`, `email`, `family_name`, and `given_name` claims to add.
4. Select **Add** to apply the changes.

   ![Configure Microsoft Entra ID integration in the Middleware](/images/settings/microsoft-entra-id/enable_sso_for_oidc_6.png)

#### Gather application details

After registration and configuration, collect the following information needed to submit it to the Middleware.

1. Navigate to the **Overview** page.
2. Copy the **Application (client) ID** and **Directory (tenant) ID**.

   ![Configure Microsoft Entra ID integration in the Middleware](/images/settings/microsoft-entra-id/enable_sso_for_oidc_7.png)

### Configure Microsoft Entra ID integration in the Middleware

To enable SSO login via the OIDC protocol in the Middleware with Microsoft Entra ID:

1. Sign in to the **Middleware** as an account owner.
2. Browse to **Installation** > **Integration** > **SSO** > **Microsoft Entra ID**.

   ![Configure Microsoft Entra ID integration in the Middleware](/images/settings/microsoft-entra-id/configure_ms_entra_id_in_mw_1.png)
3. Select the **OIDC** protocol.
4. Paste the **Client ID**, **Client Secret**, and **Tenant ID** that you recorded while configuring SSO in the Microsoft Entra Admin Center, and then click **Submit**.

   ![Configure Microsoft Entra ID integration in the Middleware](/images/settings/microsoft-entra-id/enable_sso_for_oidc_8.png)

## Enable users from Microsoft Entra to authenticate with Middleware

In this section, you enable users within your tenant to access Middleware.

1. Sign in to the [Microsoft Entra admin center](https://entra.microsoft.com/) as at least a [Cloud Application Administrator](https://learn.microsoft.com/en-us/entra/identity/role-based-access-control/permissions-reference#cloud-application-administrator).
2. Browse to **Entra ID** > **Enterprise apps** > **Middleware** (or the name you have given while configuring the app).
3. On the app's overview page, under **Manage**, select **Users and groups**.
4. Select **Add user/group**.

   ![Enable users from Microsoft Entra to authenticate with Middleware](/images/settings/microsoft-entra-id/enable_users_in_ms_entra_id_1.png)
5. On the **Add Assignment** page, select the link under the **Users** field.

   ![Enable users from Microsoft Entra to authenticate with Middleware](/images/settings/microsoft-entra-id/enable_users_in_ms_entra_id_2.png)
6. In the **Users** pane, you'll see a complete list of all users in your tenant. Select the users you want to give access to, then click the **Select** button.
7. Finally, click the **Assign** button.

## Just-in-Time (JIT) User Provisioning

JIT provisioning allows you to automatically create user accounts in Middleware without manual setup.

You just need to add new users to your Middleware application in Microsoft Entra ID as described in the above section. When users log in to Middleware for the first time, their account is automatically created.

New users receive:

- Standard "user" role permissions
- Access to all available projects

> **Note:** JIT provisioning is only available through IdP-initiated login. New users must sign in using an IdP-initiated flow to be automatically created in Middleware. Until a user is provisioned this way, they will not be able to log in using the SP-initiated flow.

## Login

Users must have the same email domain as of account owner to login.

### SP-initiated login

SP-initiated, or Service Provider-initiated, means login initiated from Middleware.

1. Select the **Microsoft Entra ID** icon on the [sign-in](https://app.middleware.io/auth/login) or [sign-up](https://app.middleware.io/auth/register) page.

   ![Middleware Microsoft Entra ID: SP-initiated login](/images/settings/microsoft-entra-id/login_1.png)
2. In the displayed pop-up, enter your **Email Address** and click Submit.

   ![Middleware Microsoft Entra ID: SP-initiated login](/images/settings/microsoft-entra-id/login_2.png)
3. The system will initiate the authentication with Microsoft Entra ID via the configured protocol to verify your identity. If you're already signed in to your Microsoft account, you'll be automatically authenticated without any action required. If not, you'll be prompted to enter your Microsoft credentials and complete the login process. Once authentication is successful, you'll be automatically redirected back to Middleware’s home page.

### IDP-initiated login

IdP-initiated, or Identity Provider-initiated, means login initiated from the Microsoft App Dashboard portal.

1. Go to your [My Apps](https://myapplications.microsoft.com/) page in Microsoft.
2. Click on the **Middleware** app.
3. Once authentication is successful, you'll be automatically redirected back to Middleware’s home page.

**Note:** IDP-initiated login is only supported with the SAML protocol.