Documentation

Entra ID (Azure Active Directory) IdP | Entitle

Suggest Edits

Overview

Entra ID (Azure Active Directory) IdP Connection enables you to use managed domain services—such as Windows Domain Join, group policy, LDAP, and Kerberos authentication—without having to deploy, manage, or patch domain controllers.

Entitle populates the following resource types in the Entra ID Directory connection:

  • Groups
  • Users
  • Managers (optional)

This page will provide you with instructions on how to integrate Entitle and Entra ID as an IdP, both for populating the above resource types as well as for creating IdP-initiated login flows to the Entitle web app.

General guidelines

You can set up Entra ID as an Identity Provider (IdP), the source of truth for Entitle users, groups, and organizational structure, using the instructions below.

ℹ️

In case you have already integrated Entra ID with Entitle using this guide, you can use the same Entra application configuration and continue to the Entitle setup section.

To integrate your Entra ID with Entitle, you will need to:

  • Create an application on Entra ID, and extract Client and tenant IDs.
  • Create a secret, and extract its value.
  • Provide Entitle with adequate permissions for the application.

Stage 1: Create an application

  1. Go to the Microsoft Azure portal.

  2. Click on Microsoft Entra ID.

  3. Click on the App registrations tab in the left-side menu.

  4. Then, click on New registration.

  5. Give your app a Name and leave the rest as is. Then, click on Register.

  1. Keep your Application (client) ID and Directory (tenant) ID for later. Then, click on Add a certificate or secret on the right side.

✅

Choose your authentication method

You should now choose whether to create a client secret or federated credentials.

  • Client secret: The simplest option. Create a secret through the Azure portal user interface. This method works for most cases and takes only a few minutes to set up.
  • Federated credentials: A more advanced option that uses Azure identity federation to avoid long-lived secrets and strengthen your security posture.
    • Support OIDC-based federation for Azure applications.
    • Work alongside existing client-secret methods without affecting current setups.
    • Enable access to common Azure resources through role assignments.
    • Prevent cross-tenant access by isolating each customer's service principal.
    • Automatically remove temporary onboarding credentials after setup.

Federated credentials are supported only for integrations saved on Entitle's Cloud or on an on-premises agent hosted in Amazon Elastic Kubernetes Service (EKS).

Create a client secret
  1. Click on New client secret.

  1. In the pop-up window, choose a Description that you will remember and an expiration time and click Add.

  2. Click on the Copy icon to copy your new Client Secret Value and keep it for later.

Create federated credentials for an ephemeral account
  1. Click on the Federated credentials tab, then click Add credential.
  1. In the Federated credential scenario dropdown, select Kubernetes accessing Azure resources.

  1. On the Add a credential page, fill out the fields as needed.

    • Cluster issuer URL:
      • If you're using Entitle Europe:
        https://oidc.eks.eu-west-1.amazonaws.com/id/7104B0E9ED58DCD19AE0DC0EC7D46D5D
      • If you're using Entitle USA:
        https://oidc.eks.us-east-1.amazonaws.com/id/E1F031C91539B03EE726ED530E719F4C
      • If you're using an EKS hosted agent on your AWS account, run this command on your cluster and use its output:
        aws eks describe-cluster --name <CUSTOMER_CLUSTER_NAME> --query "cluster.identity.oidc.issuer" --output text --region <CUSTOMER_CLUSTER_REGION>
    • Namespace: Enter entitle.
    • Service account name:
      • When using a Cloud agent, enter ichilov.
      • When using an EKS hosted agent on your AWS account, use entitle-agent-sa.
    • Subject identifier: This is automatically generated and should not be edited.
    • Name: Enter a name to help identify this credential.
    • Description: You may enter a description to help identify the purpose of this credential.
    • Audience: Click the Edit link, then enter sts.amazonaws.com.

  2. Click Add. Your federated credential now appears on the Certificates & secrets page.

✅

You must now create a temporary secret for onboarding. This secret is short-lived and will be removed automatically after setup.

You can create it either through the Azure portal (easier, but with a minimum lifetime of one day) or using PowerShell commands (slightly more complex, but more secure with a lifetime of two hours or less).

PowerShell method (recommended)

🚧

Important information

Using this method deletes all previously issued client secrets for this app registration. Any other integrations or scripts that rely on those secrets will stop working.

This is an intentional security measure. If an unauthorized user were to learn your app ID and tenant ID, they could attempt to create their own integration and misuse your Azure resources.

Entitle uses your new secret only during the first authentication with your Azure tenant and does not store it in the rest of your configuration. The secret is automatically deleted after your setup is complete.

  1. Go to the Overview page from the left navigation.
  2. Under Essentials, copy the Application (client) ID to your clipboard.
  1. Go to Certificates & secrets from the left navigation.
  2. Click the Cloud Shell icon in the top right bar.
  1. Run this command, first replacing <APP_ID> with the Application (client) ID you just copied.
$appId="<APP_ID>"
$end_date="$(date -u -d '120 minutes' +"%Y-%m-%dT%H:%M:%SZ")"
az ad app credential reset `
--id $appId `
--display-name "Entitle Nonce (expiry: $end_date)" `
--end-date "$end_date"
  1. The output gives you the app ID, password, and tenant. The password is your new nonce value. Safely store it for later use.

Azure portal method
  1. Click on New client secret.
  1. In the pop-up window, choose a Description that you will remember and an Expires duration and click Add. The duration should be as short as possible.
  1. Click on the Copy icon to copy your new Client Secret Value and keep it for later.

Stage 2: Assign permissions to Graph API

  1. Go to API permissions.
  1. Remove the existing default permission by clicking on the ellipses … on the right, then click Remove permission > Yes, remove.
  1. Now, click Add a Permission.
  1. From the Request API permissions pane, click Microsoft Graph.
  1. Select Application permissions.
  1. Using the search bar that appears, find and select the following permission to allow Entitle to connect with your Entra ID tenant:
    • Directory.Read.All

      ℹ️

      If you plan to set up Entra ID as an integration in Entitle, replace the above permission with the following:

      • GroupMember.ReadWrite.All
      • User.Read.All
    • Application.ReadWrite.OwnedBy (for federated credentials)
    • Application.Read.All (for federated credentials)

      ℹ️

      Application.ReadWrite.OwnedBy applies only to federated credential scenarios. It allows Entitle to delete the temporary onboarding secret immediately after setup is complete for the highest security.

      If this permission is disallowed, the secret remains available until its configured expiration.

      Application.Read.All is required to validate configuration details during setup.

  2. When you are done selecting the permissions, click Add permissions at the bottom of the screen.
  3. You will now see the added permissions in the table under Configured permissions.
  4. Click on Grant admin consent for Default Directory > Yes.
  1. If you are using a client secret, you can continue with Connect your IdP in Entitle. If you are using federated credentials with the Application.ReadWrite.OwnedBy permission, continue below.
For federated credentials

✅

The optional steps below are for additional security. When the integration setup is complete, Entitle immediately deletes the one-time secret created for the initial authentication to your Azure tenant.

If you choose not to run this command, the one-time secret remains active until it expires.

  1. Click the Cloud Shell icon in the top right bar.
  1. Run this command, first replacing <APP_ID> with your Application (client) ID.
$appId=<APP_ID>
$appServicePrincipalId=$(az ad sp list --filter "appId eq '$appId'" --query "[0].id" -o tsv)
az ad app owner add --id $appId --owner-object-id $appServicePrincipalId

Connect your IdP in Entitle

  1. Log in to Entitle and go to the Org Settings page.

  2. Under the System integrations section, click the + Add button and select Azure AD from the list of IdPs.

✅

Follow the steps for your chosen authentication method: client secret or federated credentials.

Client secret

  1. In the pop-up window Configure Microsoft Entra ID - Azure AD, fill in the required details:

    • Display Name: Enter a name to identify this integration.

    • Tenant: Your Directory (tenant) ID, found on the Overview page.

    • Authentication mode: Select Secret.

    • Client ID: Your Application (client) ID, found on the Overview page.

    • Secret: Your Client secret, found on the Certificates & secrets page.

    • User identity source: Choose what will serve as the identifier for your users in Entra ID:

      • UPN (User Principal Name) – default
      • Email

    • Use as direct manager source: Select this option if you want managers to participate in Access Request approvals or serve as User Access Review reviewers.

      ℹ️

      When this option is selected, Entitle pulls direct manager information from the default Entra ID field. If you prefer to use a custom field, contact Entitle Support.

      A common example of when you might use this is when you want the direct manager field in Entra ID to synchronize with the Active Directory extension attribute.

      This option is currently available only for Entitle Cloud deployments and requires the manager’s value to be in email format.

    • Save on: Choose whether you would like this integration to be saved on your own hosted agent or in Entitle’s cloud.

  2. Click Save.

Federated credentials

  1. In the pop-up window Configure Microsoft Entra ID - Azure AD, fill in the required details:

    • Display Name: Enter a name to identify this integration.

    • Tenant: Your Directory (tenant) ID, found on the Overview page.

    • Authentication mode: Select Federated credentials.

    • Client ID: Your Application (client) ID, found on the Overview page.

    • Nonce ID: Your Secret ID, found on the Certificates & Secrets page. Refresh your browser to see the secret ID.

    • Nonce value: Your Nonce value, found in your Cloud Shell instance.

    • User identity source: Choose what will serve as the identifier for your users in Entra ID:

      • UPN (User Principal Name) – default
      • Email

    • Use as direct manager source: Select this option if you want managers to participate in Access Request approvals or serve as User Access Review reviewers.

      ℹ️

      When this option is selected, Entitle pulls direct manager information from the default Entra ID field. If you prefer to use a custom field, contact Entitle Support.

      A common example of when you might use this is when you want the direct manager field in Entra ID to synchronize with the Active Directory extension attribute.

      This option is currently available only for Entitle Cloud deployments and requires the manager’s value to be in email format.

    • Save on: Choose whether you would like this integration to be saved on your own hosted agent or in Entitle’s cloud.

      🚧

      Important information

      Federated credentials work only for integrations that are saved on Entitle's Cloud or on an on-premises agent that is hosted in Amazon Elastic Kubernetes Service (EKS)

  2. Click Save.

Test your IdP connection

  1. After being redirected to the Org Settings page, you should be able to see that the Entra ID directory is now Connected.

  2. Your data synchronizes within a few minutes. Go to Approval workflows and click New approval workflow at the top right. You should now see that all groups have been fetched. If not, wait a few more minutes and refresh the page.

Set up an Entitle SSO tile in Entra ID

Optionally, you can set up Entitle as an Entra ID SSO tile for IdP-initiated login flow using the instructions below.

ℹ️

This use case is not applicable when Entitle operates as part of Pathfinder, as all authentication is handled through Pathfinder. See Entitle on Pathfinder for more details.

  1. Log in to your Microsoft Entra Admin Center.

  2. Select Applications under the Identity section.

  3. Expand Applications to choose Enterprise applications.

  4. Click New application.

  5. Click Create your own application.

  6. Choose a name for the application, and select Integrate any other application you don’t find in the gallery (non-gallery). Then click Create.

    You are now redirected to your new application’s Overview page.

  7. Select Assign users and groups to set an owner for the application and grant access permissions to specific users.

  8. Set the application logo in the application properties.

  9. Return to your application’s Overview page, and select Set up single sign on.

  10. Select Linked from the available sign-on options.

  11. Copy the following URL and paste it in the Sign on URL field.

    https://login.microsoftonline.com/common/oauth2/v2.0/authorize?client_id=40653a07-6423-4c6b-9e40-7ce34c8656d6&scope=User.Read&redirect_uri=https://app.entitle.io/api/v1/signIn/microsoft&response_type=code

  12. Click Save.

  13. Your Entitle SSO application now appears as a new tile in your Microsoft My Apps portal.

Test your SSO tile

  1. Locate the Entitle application in your Microsoft My Apps portal.
  2. Open the application. You should now be logged in to the Entitle app.

Updated about 1 month ago