Skip to main content

Configuring Microsoft Entra ID

You can configure user authentication with Microsoft Entra ID as your IdP using OpenID Connect.

info

The users defined in Entra ID are automatically added to the AtScale Identity Broker when they log in for the first time. All users are added to the everyone group, which includes the query_user role. If you need to add users to other groups or assign them additional roles, you must do so from within the Identity Broker. For more information, see Managing Users with the Identity Broker.

Prerequisites​

This procedure assumes that you have an enterprise application set up for AtScale in Entra ID, and that it is configured with OpenID Connect. For more information, refer to the Microsoft Entra ID documentation.

Additionally, you must be logged in as an admin user.

Configure authentication with Entra ID​

To configure authentication using Microsoft Entra ID:

  1. In AtScale, in the left-side navigation, click Security. The Identity Broker opens.

  2. Log in using your AtScale admin username and password.

  3. Select the atscale realm if it is not already selected.

  4. In the left-hand navigation, select Identity providers, then click OpenID Connect v1.0.

  5. On the Add OpenID Connect provider page, complete the following fields:

    • Redirect URI
    • Alias
    • Display name
    Important

    If you plan on using Microsoft Power BI Service with token-based authorization, you must set Alias to azure-ad-oidc. This value is required to fully configure Power BI Service integration. It cannot be edited once your IdP has been added.

    If you want to configure Power BI Service integration and you did not set Alias to azure-ad-oidc when adding your IdP, you must delete and re-add your IdP.

  6. In a new browser tab, log in to the Microsoft Entra admin center, locate the OpenID Connect metadata document URL for the AtScale application, and copy it. For instructions on locating this information, refer to the Microsoft Entra ID documentation.

  7. In the Identity Broker, paste the URL in the Discovery endpoint field. The Identity Broker validates the URL and displays a checkmark if it passes.

  8. Go back to the Microsoft Entra admin center, locate the Application (client) ID for the AtScale application, and copy it.

  9. In the Identity Broker, paste the client ID in the Client ID field.

  10. In the Microsoft Entra admin center, locate and copy the client secret for the AtScale application.

  11. In the Identity Broker, paste the client secret into the Client Secret field.

  12. Click Add.

  13. Click on the newly-added IdP.

  14. Expand the Advanced section. In the Scopes field, add the following scopes: openid profile email offline_access.

  15. Click Save.

  16. Scroll down to the Advanced settings section and enable the Store tokens and Stored tokens readable settings.

  17. Click Save.

  18. Enable fine-grained permissions for the IdP:

    1. Go to the Permissions tab and enable the Permissions enabled option.
    2. In the Permissions list section, click the token-exchange permission.
    3. In the Policies field, add the public-api-token-exchange policy.
    4. Click Save.

  19. Test your configuration:

    1. Open a new browser tab and navigate to your AtScale instance. The Sign in to your account window appears.
    2. Click the option to log in with Entra ID and enter your credentials.

Configure groups in Entra ID​

Once you have set up authentication with Entra ID, you should ensure your Entra ID user groups are properly configured so they can be mapped to AtScale groups in the Identity Broker.

When the Identity Broker's OIDC broker is configured to match a user's group membership via a groups claim in the token (as the Identity Broker's Advanced Claim to Group mappers do), it relies on Entra ID to include that group's Object ID in the token. However, Entra ID only does this reliably when the user belongs to 200 or fewer groups. Past that threshold, instead of listing the groups directly, Entra ID replaces the entire groups claim with an "overage" indicator (_claim_names/_claim_sources) that points to a Microsoft Graph endpoint. The Identity Broker's mapper doesn't call Graph to resolve this, so the claim appears to be absent, and no group mapper can ever match.

To avoid this issue, AtScale recommends using the Groups assigned to the application option for the groups claim. You can configure this in Entra ID by going to App registrations > Token configuration > Add groups claim. This mode only evaluates the set of groups explicitly assigned to the Enterprise Application (via Enterprise Applications > application > Users and groups), and not the user's full group list.

Note

When using the Groups assigned to the application option, every Entra ID group referenced by a mapper in the Identity Broker must be explicitly added to that Enterprise Application's assignment list.

For more information on configuring group claims in Entra ID, refer to the Microsoft Entra ID documentation.

Once your groups have been properly configured in Entra ID, you should map them to AtScale groups in the Identity Broker. For instructions, see Configuring Mappers in the Identity Broker.