Microsoft Entra ID

Microsoft Entra ID (formerly Azure AD) connects over OpenID Connect with two additions: the issuer is bound to a specific tenant, and auth_time has to be enabled manually as an optional claim. General requirements are on the OpenID Connect page.

Know this first#

• A specific tenant only. The Issuer URL must be exactly https://login.microsoftonline.com/<tenant-id>/v2.0. The common, organizations and consumers addresses are not accepted. Calab also checks the tid claim of every ID token against the configured Tenant ID.
• auth_time isn't sent by default. In Entra v2 it must be added as an optional claim. Without it, sign-in is rejected.
• Client authentication is client_secret_post (Calab picks it for Entra automatically).

Step 1. Register the application#

In the Microsoft Entra admin center:

1. “App registrations” → “New registration”.
2. Name — for example, Calab. Supported account types — “Accounts in this organizational directory only” (single tenant).
3. Redirect URI — the “Web” platform, address https://id.example.com/api/auth/sso/callback/<connection-id>. The connection ID appears after step 3; you can register the app without a URI and add it later under “Authentication”.
4. Click “Register” and note the Application (client) ID and Directory (tenant) ID on the “Overview” page.

Step 2. Secret and auth_time#

1. “Certificates & secrets” → “New client secret”. Copy the Value (not the Secret ID) — it's shown once.
2. “Token configuration” → “Add optional claim” → token type ID → check auth_time → “Add”.

Step 3. The connection in Calab#

Workspace settings → “SSO settings” → “SSO connection”:

Click “Save”. Then take connection.id from GET /api/workspaces/{workspace_id}/identity and add the redirect URI under the Entra app's “Authentication”.

Step 4. Link, test, activate#

As with any OIDC provider:

1. “Link corporate identity” — link your own Entra account.
2. “Test and activate” → “Test sign-in in browser”.
3. Within 5 minutes — “Activate tested connection”.

Then choose a mode under “Sign-in policy” — see modes.

Secret expiry#

Entra secrets expire. Set a reminder: before expiry, create a new secret in Entra, enter it in “Client secret”, then test and activate the connection again. Rotation revokes current SSO confirmations — see rotating the secret.

Common errors#

More in troubleshooting.