Azure AD SSO Integration
The Azure AD SSO Integration recipe connects a Microsoft Entra ID (Azure AD) directory to one of your realms as an OpenID Connect identity provider. Once it is applied, the realm’s sign-in page offers a “Continue with Microsoft” button and work accounts sign in without a second password.
Entra ID is the current name for what Microsoft used to call Azure Active Directory. Both names refer to the same directory, and this recipe works the same either way.
Before you start
You need:
- A realm on an available cluster.
- Permission to create an app registration in your Entra directory.
- About 10 minutes.
Step 1: Name the connection and copy the redirect URI
- Open Recipes in your Skycloak dashboard, with the cluster and realm you want selected.
- Find Azure AD SSO Integration and choose Start Recipe.
- Set the provider alias. The alias is part of the redirect URI you register with Entra, so pick
it now: changing it later means updating the app registration too. The default is
azure-ad. - Set the sign-in button label your users will see. The default is “Microsoft Entra ID”.
- Copy the redirect URI shown on the same step.
Step 2: Create the Entra app registration
In the Entra admin center:
- Go to App registrations and choose New registration.
- Under Authentication, add the redirect URI you copied, with the platform set to Web.
- Under Certificates & secrets, create a client secret and copy its Value immediately. Entra shows the value once. The Secret ID is not the secret.
- Under API permissions, confirm the Microsoft Graph delegated scopes
openid,profileandemailare granted.
Step 3: Paste the three values back
Return to the wizard and enter:
| Field | Where to find it in Entra |
|---|---|
| Directory (tenant) ID | App registration Overview |
| Application (client) ID | App registration Overview |
| Client secret | The Value you copied in step 2 |
You can enter a verified domain such as contoso.onmicrosoft.com instead of the tenant ID. Enter
organizations only if you intend to accept accounts from any Entra directory rather than just your
own.
Trust email addresses from Entra is on by default. It skips the realm’s own email verification for users arriving from Entra, which already verifies the addresses in your directory. Turn it off if you want returning users to confirm their address before their accounts are linked.
Skycloak works out the rest of the configuration from your tenant, so there are no endpoint URLs to paste.
Step 4: Review and apply
Review the summary and choose Create identity provider. Applying creates the identity provider on the realm and changes nothing else.
After applying
- Test one sign-in. Open the realm’s sign-in page and complete a sign-in with an Entra account that is assigned to the app registration. This is the only way to confirm the whole round trip.
- Assign users or groups in Entra, under Enterprise applications for this app, so only the people who should reach the realm can.
- Check account linking if a user already exists in the realm with the same email address. With Entra email trusted, the accounts are linked silently. Without it, the returning user is asked to confirm their address first.
Keeping it working
The Recipes page reports the connection as Applied to this realm. If the identity provider is later deleted or disabled directly in Keycloak, the card reports configuration drift.
There is no automatic repair for this recipe, because Entra shows a client secret only once and Skycloak does not keep a copy you could replay. Fix Now reopens the wizard so you can create a fresh secret in Entra and apply it again.
SAML instead of OpenID Connect
This recipe uses OpenID Connect, which is Microsoft’s recommended protocol for new integrations and needs no certificate handling. If your organization requires SAML, set that up from the Identity Providers page for the realm, which has an Azure AD SAML template.
Related
- Enterprise SSO Setup: provider-by-provider setup reference
- Identity Providers: feature overview