Microsoft Entra ID#

There is no dedicated strategy for Microsoft Entra ID. To sign in users with their Microsoft Entra ID account, use the OpenID Connect strategy, provided by the @criticalmanufacturing/auth-plugin-openidconnect plugin.

Configuration#

Available out of the box through the OpenID Connect strategy: enable and configure it in DevOps Center during the installation, with the metadata URL and client ID described below. DevOps Center doesn't set a client secret, so the strategy uses PKCE. To use a client secret, configure the strategy through a customization package. See Deployment via CmfEntrypoint ↗ in the Developer Portal.

In this section, <Security Portal URL> is the public address of the Security Portal, for example https://mes.example.com/SecurityPortal.

To set up the strategy:

1. Register an application in Microsoft Entra ID ↗, with the redirect URI <Security Portal URL>/tenant/<TenantName>/login/callback.
2. From the application, copy the Application (client) ID and the Directory (tenant) ID from the Overview page. If the application uses a client secret, also copy it from Certificates & secrets. Without a client secret, register the application as a Mobile and desktop application, so that the Security Portal can use PKCE.
3. In DevOps Center, enable the OpenID Connect strategy, and set Metadata URL to https://login.microsoftonline.com/<DirectoryID>/v2.0/.well-known/openid-configuration and Client ID to the Application (client) ID. The example shows the resulting strategy entry. For all the parameters, see OpenID Connect.

Example#

{
  "id": "EntraID",
  "type": "open-id-connect",
  "config": {
    "metadataUrl": "https://login.microsoftonline.com/<DirectoryID>/v2.0/.well-known/openid-configuration",
    "redirectUrl": "<Security Portal URL>/tenant/<TenantName>/login/callback",
    "clientId": "<ApplicationID>"
  }
}

If Microsoft Entra ID identifies users by email address, configure the userAccountFallbackField property as described in Sign-In with Email Address.