Skip to main content

How to Configure a Microsoft Entra ID SSO Integration

What is this guide about?

This guide shows you how to set up Microsoft Entra ID as a single sign-on (SSO) option for meshStack yourself, directly from the Admin Area, without involving meshcloud support.

Challenge​

You want your users to sign in to meshStack with their Microsoft Entra ID (formerly Azure Active Directory) account. Previously, connecting Entra ID as an identity provider meant sharing your tenant ID, client ID, and client secret with meshcloud support and waiting for them to configure it. With a self-service Entra ID integration, your admin team configures and maintains the connection independently, and can rotate the client secret at any time without raising a support request.

Prerequisites​

  • A user with admin permissions in the meshStack Admin Area
  • Permission to create an app registration in your Microsoft Entra ID tenant
Need SCIM provisioning or custom claim mapping?

This integration covers SSO login only. If you also want to provision users and groups from Entra ID via SCIM, or need custom claim mapping (for example a dedicated euid claim for externally-provisioned identities), set up your identity provider with meshcloud support as described in Configuring your Identity Provider instead.

Step by Step Guide​

1. Register an App in Microsoft Entra ID​

  1. Sign in to the Azure Portal and open Microsoft Entra ID > App registrations.
  2. Click New registration, give it a recognizable name (for example meshStack SSO), and complete the registration.
  3. On the app's Overview page, note down the Application (client) ID and Directory (tenant) ID — you'll need both in the next step.
  4. Go to Certificates & secrets and create a new client secret. Copy its value now, as Entra ID only shows it once.
tip

Leave the redirect URI empty for now. You'll add it once meshStack has generated it for you in step 3.

2. Create the Entra ID Integration in meshStack​

  1. Navigate to the Admin Area and go to Integrations.
  2. Click Create Integration and select Microsoft Entra ID.
  3. Fill in the integration details:
    • Integration Name: A descriptive name. This name also becomes the label of the sign-in button your users see.
    • Tenant ID: The Directory (tenant) ID from step 1.
    • Client ID: The Application (client) ID from step 1.
    • Client Secret: The client secret you created in step 1.
  4. If you're already using Entra ID for SSO through an identity provider that meshcloud support configured manually for you, check Migrate from an existing identity provider and enter its Identity Provider Alias. This adopts the existing Keycloak identity provider instead of creating a new one, so your users keep signing in without re-establishing trust in Entra ID. You can find the alias in the broker redirect URI configured in your Entra ID app registration — it's the path segment between broker/ and /endpoint, for example acme-prod-idp in https://sso.example.com/auth/realms/meshfed/broker/acme-prod-idp/endpoint. The alias can't be changed after the integration is created.
  5. Click Save.

3. Add the Redirect URI to Your App Registration​

  1. Open the integration you just created for editing.
  2. Copy the Redirect URL shown on the edit page.
  3. Back in the Azure Portal, open your app registration's Authentication page, add a Web platform (if none exists yet), and add the copied URL as a redirect URI.
  4. Save the changes in the Azure Portal.

4. Test the Sign-In​

  1. Open your meshStack login page.
  2. Look for the sign-in button labeled with the integration name you chose in step 2.
  3. Sign in with a Microsoft Entra ID account and confirm you land in meshStack.
warning

Test with a non-critical account first. If sign-in fails, double-check that the redirect URI in Entra ID matches the one shown on the integration's edit page exactly.

Managing the Integration​

You can update the tenant ID, client ID, or client secret at any time by editing the integration in the Admin Area — for example to rotate an expiring client secret. Deleting the integration removes the sign-in option for your users immediately, so make sure no one still depends on it before removing it.

warning

Deleting an integration also deletes its underlying identity provider in Keycloak. For an integration that adopted an existing identity provider, that provider cannot be recreated by meshStack — only meshcloud support can reconfigure it manually.

Concepts​

Settings​

Guides​