Skip to main content

Microsoft Entra ID (Azure AD) ↔ Enterpret: End-to-End SSO Setup Guide (OIDC)

Step-by-step guide to configure OpenID Connect (OIDC)-based Single Sign-On between Microsoft Entra ID (Azure AD) and Enterpret.

Written by Vaishnavi [Enterpret]

Overview

Single Sign-On (SSO) allows users to log in to Enterpret using their organization's Microsoft Entra ID (formerly Azure Active Directory) credentials. Enterpret supports OpenID Connect (OIDC) for SSO, providing a modern, secure authentication flow.

This guide walks you through the complete, end-to-end process to configure OIDC-based SSO between Microsoft Entra ID and Enterpret, including testing and optional My Apps tile access.

🔐 Understanding OIDC SSO Login Flow (Read This First)

OIDC is always app-initiated — the login flow always starts from Enterpret, even when users click the Enterpret tile in the Azure My Apps portal. Microsoft simply redirects them back to Enterpret, which then initiates the login.

This means:

  • ✅ No RelayState is required

  • ✅ No distinction between SP-initiated and IdP-initiated flows

  • ✅ Less ambiguity compared to SAML

How the OIDC Flow Works

  1. User navigates to Enterpret (directly or via My Apps)

  2. Enterpret redirects the user to Microsoft Entra ID

  3. Entra ID authenticates the user

  4. Entra ID redirects back to Enterpret with an ID token

  5. Enterpret validates the token and logs the user in

👉 In all cases, Enterpret controls the login flow.

Prerequisites

Before starting, ensure you have:

  • Admin access to Enterpret

  • Admin access to the Microsoft Entra admin center

  • Permission to register applications in your Azure tenant

  • User emails in Enterpret that exactly match the emails in Entra ID

High-Level Setup Flow

  1. Register an application in Microsoft Entra ID

  2. Copy Client ID, Client Secret, and Issuer URL

  3. Configure OIDC SSO in Enterpret

  4. Test login

  5. (Optional) Enable My Apps tile access

Step 1: Register an Application in Microsoft Entra ID

1. Create the App Registration

  1. Sign in to the Azure portal and search for Microsoft Entra ID in the top bar.

  2. In the left sidebar, go to Manage → App registrations → New registration.

  3. Fill in the registration form:

    • Name: Enterpret Inc

    • Supported account types: Select the option matching your organization (typically Accounts in this organizational directory only)

    • Redirect URI: Select platform Web, then enter:
      ​https://enterpret-prod.auth.us-east-2.amazoncognito.com/oauth2/idpresponse

  4. Click Register.

⚠️ Make sure to select Web as the platform for the Redirect URI — not SPA or Mobile.

Step 2: Copy Required Values from Azure

Enterpret requires three values from your app registration.

1. Client ID

  1. From the app's Overview page, copy the Application (client) ID.

2. Client Secret

  1. In the left sidebar, click Certificates & secrets → New client secret.

  2. Enter a description (e.g. Enterpret SSO) and choose an expiry duration.

  3. Click Add, then immediately copy the Value column.

⚠️ Azure only shows the secret value once. Copy it before navigating away. Note that you need the Value, not the Secret ID.

3. Issuer URL

  1. From the app's Overview page, click Endpoints in the top toolbar.

  2. Find the OpenID Connect metadata document URL. It will look like:
    ​https://login.microsoftonline.com/<tenant-id>/v2.0/.well-known/openid-configuration

  3. Remove the trailing /.well-known/openid-configuration. Your Issuer URL is:
    ​https://login.microsoftonline.com/<tenant-id>/v2.0

⚠️ Use the /v2.0 endpoint. Do not use the legacy https://sts.windows.net/<tenant-id>/ format — it will not work correctly.

Value

Where to Find It in Azure

Client ID

App Overview → Application (client) ID

Client Secret

Certificates & secrets → New client secret → copy Value

Issuer URL

Endpoints → OpenID Connect metadata document URL, remove /.well-known/openid-configuration

Step 3: Configure OIDC SSO in Enterpret

  1. Log in to Enterpret.

  2. Click your organization logo (bottom-left).

  3. Go to Settings → Access Settings → SSO & SCIM Settings.

  4. Click Configure.

  5. Select OIDC.

  6. Enter your Client ID, Client Secret, and Issuer URL.

  7. Click Submit. ✅

OIDC SSO is now configured 🎉

Step 4: Test OIDC SSO

  1. Log out of Enterpret.

  2. Go to the Enterpret login page.

  3. Click Sign in with SSO.

  4. You will be redirected to Microsoft's login page — authenticate with your Entra ID credentials.

  5. Confirm you are returned to Enterpret and successfully logged in.

Step 5: Enable My Apps Tile (Optional)

You can allow users to launch Enterpret from the Azure My Apps portal (myapps.microsoft.com).

Make the App Visible in My Apps

  1. In the Entra admin center, go to Enterprise applications → All applications and open your Enterpret Inc app.

  2. Under Manage → Properties, set Visible to users? to Yes.

  3. Save the changes.

Assign Users or Groups

  1. Under Manage → Users and groups, click Add user/group.

  2. Select the users or groups who should have access and click Assign.

When a user clicks the Enterpret tile in My Apps, they are redirected to Enterpret's login page, which initiates the OIDC flow back to Entra ID automatically.

⚠️ If Assignment required is enabled on the app, only assigned users will be able to authenticate. Users not assigned will see an access error.

Troubleshooting Checklist

  • ✅ Emails match exactly in Entra ID and Enterpret

  • ✅ User is assigned to the Enterpret Inc app (if Assignment required is enabled)

  • ✅ Client ID, Client Secret (Value, not Secret ID), and Issuer URL are correct

  • ✅ Redirect URI platform is set to Web and the URI matches exactly

  • ✅ Issuer URL uses the /v2.0 endpoint, not the legacy sts.windows.net format

  • ✅ Client secret has not expired — check the expiry date under Certificates & secrets

Key FAQs

Do I need to configure an email attribute claim?
Not by default. Microsoft Entra ID includes the email claim in the ID token for most tenants. If users encounter an email-mismatch error, confirm that the user's email or UPN in Entra ID exactly matches their email in Enterpret.

My client secret expired — what do I do?
Generate a new secret under Certificates & secrets, then update the Client Secret value in Enterpret's SSO & SCIM Settings. The old secret will stop working on its expiry date, so set a calendar reminder before the expiry.

Can I enforce SSO so users can only log in via Entra ID?
Yes — enable Enforce SSO in Enterpret's Access Settings. Once enabled, all users must authenticate through Entra ID and password-based login is disabled.

What is RelayState? Do I need it?
No. RelayState is a SAML concept and is not used in OIDC flows.

Can I use a certificate instead of a client secret?
Enterpret's OIDC configuration currently requires a Client Secret. Certificate-based authentication is not supported on the Enterpret side.

Related Articles
Did this answer your question?