Set up single sign-on with Microsoft Entra ID

This guide covers the Microsoft Entra ID side of single sign-on: registering Astrato as an application, creating its client secret and letting your users through. It then hands back to the Astrato steps, which are the same for every provider.

Before you start

• You meet the requirements in Set up single sign-on, and have read Do not lock yourself out.
• You can register applications in the Microsoft Entra admin center, for example with the Application Administrator role.
• The people who will sign in have an email address on their Entra account. Astrato identifies people by email, so an account without one cannot sign in.

Values you will bring back to Astrato

Astrato Setup field	Where it comes from in Entra
Issuer URL	https://login.microsoftonline.com/<tenant-id>/v2.0, where <tenant-id> is the Directory (tenant) ID
Client ID	The app registration’s Application (client) ID
Client secret	The Value of the client secret you create (not its Secret ID)
Identity provider domains	The email domains your people sign in with, for example example.com

Copy the callback URLs from Astrato

1. In Astrato, open Administration → Enterprise Connection and stay on Login connections.

2. Select Add connection and choose Microsoft Entra ID in Select a Login provider.

3. Leave the Configuration tab open. It lists two callback URLs, the sign-out redirect URL and the scopes openid profile email.

   

Choose Microsoft Entra ID rather than Open ID Connect. Both ask for the same fields, but only a Microsoft Entra ID login connection can later be used for Snowflake’s Entra ID token exchange.

Register Astrato in Entra

1. In the Microsoft Entra admin center, open App registrations and select New registration.
2. Give it a name your users will recognise, such as Astrato.
3. Under Supported account types, choose the accounts in your organisational directory only.
4. Under Redirect URI, choose the Web platform and paste the first callback URL from Astrato’s Configuration tab. Select Register.
5. Open the new registration’s Authentication page, add the second callback URL as another Web redirect URI, and save.
6. On Overview, copy the Application (client) ID and the Directory (tenant) ID.

Microsoft’s own guide to these screens is Register an application in Microsoft Entra ID.

Create the client secret

1. In the registration, open Certificates & secrets and select New client secret.
2. Give it a description and an expiry, then select Add.
3. Copy the secret’s Value now. Entra shows it only once.

When the secret expires, sign-in through Astrato stops. Create a new one before then and enter it in Astrato with Replace secret on the connection’s Setup tab.

Decide who can sign in

By default every account in your directory can sign in through the registration. To limit it to chosen people or groups:

1. Open Enterprise applications and select the application with the same name.
2. On Properties, set Assignment required? to Yes and save.
3. On Users and groups, add the people or groups who should use Astrato.

Anyone you leave out is refused by Entra before they reach Astrato.

Finish in Astrato

Go back to the Add connection dialog and select Continue to Setup. Fill in the values from the table above, then follow the rest of Set up the connection, Verify the connection and Test a normal sign-in.

If sign-in fails

What you see	Likely cause	What to do
Entra says the redirect URI does not match	A callback URL is missing from the registration, or differs from Astrato’s	Add both callback URLs from Astrato’s Configuration tab as Web redirect URIs
Entra says the user is not assigned to a role for the application	Assignment required? is Yes and the user is not assigned	Add the user, or a group they are in, on the enterprise application’s Users and groups
Entra rejects the client secret	The Secret ID was entered, or the secret has expired	Create a new secret and enter its Value with Replace secret in Astrato, then save
The user signs in to Entra but not to Astrato	Their Entra account has no email address	Add an email address to the account

For errors on the Astrato side, see Common errors.

What next

• Test a normal sign-in before you clear Allow users outside the identity provider domain to sign in without SSO.
• Provision users and groups from Entra with SCIM
• Sync groups and roles from your provider