---
alias: operation-guide-security-portal-strategy-azuread
description: "Configure the Security Portal to sign in users with their Microsoft Entra ID account through OpenID Connect."
---

# Microsoft Entra ID

There is no dedicated strategy for Microsoft Entra ID. To sign in users with their Microsoft Entra ID account, use the [[operation-guide-security-portal-strategy-openidconnect|OpenID Connect]] strategy, provided by the `@criticalmanufacturing/auth-plugin-openidconnect` plugin.

## Configuration

Available out of the box through the OpenID Connect strategy: enable and configure it in DevOps Center during the installation, with the metadata URL and client ID described below. DevOps Center doesn't set a client secret, so the strategy uses PKCE. To use a client secret, configure the strategy through a customization package. See [Deployment via CmfEntrypoint](https://developer.criticalmanufacturing.com/explore/guides/customizations/securityportal/configuration/#deployment-via-cmfentrypoint) in the Developer Portal.

In this section, `<Security Portal URL>` is the public address of the Security Portal, for example `https://mes.example.com/SecurityPortal`.

To set up the strategy:

1. [Register an application in Microsoft Entra ID](https://learn.microsoft.com/en-us/graph/auth-register-app-v2), with the redirect URI `<Security Portal URL>/tenant/<TenantName>/login/callback`.
2. From the application, copy the **Application (client) ID** and the **Directory (tenant) ID** from the **Overview** page. If the application uses a client secret, also copy it from **Certificates & secrets**. Without a client secret, register the application as a **Mobile and desktop application**, so that the Security Portal can use PKCE.
3. In DevOps Center, enable the OpenID Connect strategy, and set **Metadata URL** to `https://login.microsoftonline.com/<DirectoryID>/v2.0/.well-known/openid-configuration` and **Client ID** to the Application (client) ID. The [example](#example) shows the resulting strategy entry. For all the parameters, see [[operation-guide-security-portal-strategy-openidconnect|OpenID Connect]].

### Example

```json
{
  "id": "EntraID",
  "type": "open-id-connect",
  "config": {
    "metadataUrl": "https://login.microsoftonline.com/<DirectoryID>/v2.0/.well-known/openid-configuration",
    "redirectUrl": "<Security Portal URL>/tenant/<TenantName>/login/callback",
    "clientId": "<ApplicationID>"
  }
}
```

If Microsoft Entra ID identifies users by email address, configure the `userAccountFallbackField` property as described in [Sign-In with Email Address](security_portal_strategy_openidconnect.md#sign-in-with-email-address).