> For the complete documentation index, see [llms.txt](https://docs.dispel.com/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://docs.dispel.com/secure-and-govern/identity-providers/microsoft-entra-id.md).
# Microsoft Entra ID
Use Microsoft Entra ID (formerly Azure AD) as your identity provider so users sign in to Dispel with their Microsoft credentials over OAuth (OIDC) or SAML.
## Overview
Connect Microsoft Entra ID — Microsoft's cloud identity platform, formerly known as Azure AD — as your organization's identity provider. Once connected, your users sign in to Dispel with their Microsoft credentials through single sign-on. You can connect Entra over **OAuth (OIDC)** or **SAML**.
This page covers the Entra-specific setup. For the shared behavior that applies to every provider — how users sign in, group mapping, MFA, and disconnecting — see [Identity Providers](/secure-and-govern/identity-providers.md).
{% hint style="info" %}
**Where to find it.** Sign in as an organization administrator and open **Settings → Integrations** (or the dedicated **Settings → Authentication** page). Microsoft Entra ID appears in the **Identity & Authentication (IdP / SSO)** section. Click **Connect** on its card to begin.
{% endhint %}
## Before you begin
* You'll configure the IdP side in the **Microsoft Entra admin center** (or Azure portal), so you'll need administrative access there.
* Decide on a protocol — **OAuth (OIDC)** or **SAML**. See [Choosing a protocol](/secure-and-govern/identity-providers.md#choosing-a-protocol).
* Make sure the users who will sign in via Entra are already **invited to your organization** in Dispel. SSO authenticates users but doesn't create access on its own.
{% hint style="warning" %}
**One provider at a time.** If your organization is already connected to another identity provider, disconnect it before connecting Entra.
{% endhint %}
## Connect with OAuth (OIDC)
#### In Microsoft Entra ID
1. In the Microsoft Entra admin center, go to **App registrations → New registration** and create an app for Dispel.
2. Add a **Web** redirect URI of your Dispel address followed by `/oauth/login-callback` — for example `https://app.dispel.com/oauth/login-callback`. Confirm the exact address for your environment with your Dispel representative if you're unsure.
3. Under **Certificates & secrets**, create a **client secret** and copy its value.
4. Note your **Application (client) ID** and your tenant's OAuth/OIDC endpoint.
#### In Dispel
1. Click **Connect** on the Microsoft Entra ID card and **Select Authentication Protocol → OAuth**.
2. Fill in the fields:
| Field | Value from Entra |
| --------------------------- | -------------------------------------------------------------------- |
| **Client URL** | Your tenant's OAuth/OIDC endpoint (where tokens are issued). |
| **Client ID** | The **Application (client) ID** from your app registration. |
| **Client Secret** | The client secret value you created. |
| **Organization Identifier** | A unique identifier you choose; users type it on the sign-in screen. |
3. Click **Save settings**.
## Connect with SAML
#### In Microsoft Entra ID
1. In the Microsoft Entra admin center, go to **Enterprise applications → New application → Create your own application**, then open **Single sign-on → SAML**.
2. In **Basic SAML Configuration**, paste the values Dispel shows at the top of its SAML form:
* **Identifier (Entity ID)** ← Dispel's **Service Provider (SP) Entity ID**.
* **Reply URL (Assertion Consumer Service URL)** ← Dispel's **Assertion Consumer Service URL**.
3. From the Entra SAML setup, collect:
* **Login URL** → Dispel's **SSO URL**.
* **Microsoft Entra Identifier** → Dispel's **Identity Provider Entity ID**.
* Download the **Certificate (Base64)** → Dispel's **Base64 Signing Certificate**.
#### In Dispel
1. Click **Connect** on the Microsoft Entra ID card and **Select Authentication Protocol → SAML**.
2. Copy the **Service Provider (SP) Entity ID** and **Assertion Consumer Service URL** shown at the top of the form (use **Copy ID** / **Copy URL**) into Entra, as above.
3. Fill in the fields:
| Field | Value from Entra |
| ------------------------------- | -------------------------------------------------------------------------- |
| **SSO URL** | The Entra **Login URL**. |
| **Identity Provider Entity ID** | The **Microsoft Entra Identifier**. |
| **Base64 Signing Certificate** | The downloaded Base64 certificate. Paste it or use **Upload Certificate**. |
| **Organization Identifier** | A unique identifier you choose; users type it on the sign-in screen. |
4. Click **Save settings**.
5. Click **Test connection**. Dispel redirects you to Entra to sign in, then shows the email and name it received. If the test fails, confirm the values match your Entra app and that the test user is invited to your organization.
## After connecting
* **Users sign in** by entering your Organization Identifier on the Dispel sign-in screen and authenticating with Microsoft. See [How users sign in](/secure-and-govern/identity-providers.md#how-users-sign-in).
* **Map Entra groups to Dispel groups** so membership stays in sync — see [OIDC Group Mapping](/integrate-and-administer/integrations/oidc-group-mapping.md).
* **MFA** enforced in Entra applies during sign-in; Dispel's email one-time codes don't apply to SSO users. See [SSO and multi-factor authentication](/secure-and-govern/identity-providers.md#sso-and-multi-factor-authentication).
* **To switch protocols or providers**, disconnect first. See [Switching or disconnecting a provider](/secure-and-govern/identity-providers.md#switching-or-disconnecting-a-provider).
## Frequently asked questions
Is this the same as "Azure AD"?
Yes. Microsoft renamed Azure Active Directory to Microsoft Entra ID. If your Entra console still shows "Azure AD" labels in places, the setup is the same.
Which protocol should I use with Entra?
Either works. Use whichever matches how your Entra app is configured — an OIDC app registration for OAuth, or an enterprise application with SAML single sign-on for SAML.
My SAML test connection failed. What should I check?
Confirm the SSO URL, Entity ID, and certificate match your Entra SAML app exactly, that you pasted Dispel's SP Entity ID and ACS URL into Entra's Basic SAML Configuration, and that the test user exists in Entra and is invited to your Dispel organization.
---
# Agent Instructions
This documentation is published with GitBook. GitBook is the documentation platform designed so that both humans and AI agents can read, navigate, and reason over technical content effectively. Learn more at gitbook.com.
## Querying This Documentation
If you need additional information that is not directly available in this page, you can query the documentation by asking a question.
Perform an HTTP GET request on the following URL with the `ask` and `goal` query parameters:
```
GET https://docs.dispel.com/secure-and-govern/identity-providers/microsoft-entra-id.md?ask=&goal=
```
`ask` is the immediate question: it should be specific, self-contained, and written in natural language.
`goal` is what the user is ultimately trying to achieve, the reason they need the answer. Sharing it helps GitBook give you a better, more relevant answer. A goal is most helpful when it describes the outcome the user wants rather than restating the question. For example, with `ask=how do I create an API token`, a goal like `automate deployments from our CI pipeline` lets GitBook tailor the answer to that use case.
The response will contain a direct answer to the question and relevant excerpts and sources from the documentation.
Use this mechanism when the answer is not explicitly present in the current page, you need clarification or additional context, or you want to retrieve related documentation sections.