Configure OAuth or OpenID Connect SSO with Microsoft Entra ID
Question details
The user needs to set up OAuth 2.0 or OpenID Connect Single Sign-On for a third-party application using Microsoft Entra ID.
- Product
- Microsoft Entra ID
- Device & OS
- not provided
- Scenario
- Integrating an application that supports OAuth or OpenID Connect (but not SAML) with Microsoft Entra ID for user authentication.
- Observed behavior
- The application requires proper registration and configuration of endpoints, redirect URIs, and scopes within the Entra ID tenant to successfully authenticate users.
Before starting, ensure you have Global Administrator or Application Administrator privileges in your Microsoft Entra ID tenant and have access to the third-party application's SSO documentation.
Gather Requirements and Register Application in Entra ID
Collect the necessary protocol details from your application vendor and register the application in the Microsoft Entra admin center.
Because the setup depends heavily on the vendor's supported protocol, you must first confirm whether they use OpenID Connect, OAuth 2.0 authorization-code flow, or delegated API authorization before proceeding with the configuration in Microsoft Entra ID.
Ask the application vendor for the redirect URI, client authentication method, required scopes, issuer/endpoint requirements, and logout behavior.
Sign in to the Microsoft Entra admin center, navigate to 'App registrations', and select 'New registration'. Enter the application name and select the supported account types.
In the application registration screen, input the redirect URI provided by the vendor and save the configuration.
Navigate to 'API permissions', add the required scopes (such as OpenID, profile, and email), and click 'Grant admin consent' if required for your tenant.
Initiate the sign-in flow from the application to verify that the authentication successfully redirects to Entra ID and logs the user in.
Secure and Manage Your Documents with WPS Office
While you manage your organization's identity infrastructure with Microsoft Entra ID, consider WPS Office as a lightweight, secure, and highly compatible alternative to Microsoft Office. It easily handles daily document tasks with familiar interfaces and zero migration cost.
Frequently Asked Questions
What is the difference between OAuth 2.0 and OpenID Connect?
OAuth 2.0 is primarily an authorization framework used to grant access to resources, while OpenID Connect is an authentication layer built on top of OAuth 2.0 that allows clients to verify the identity of the end-user.
Why does my application support OAuth but not SAML?
Modern applications, especially mobile apps and single-page web applications (SPAs), often prefer OAuth 2.0 and OpenID Connect over SAML because they use lightweight JSON tokens rather than bulky XML, making them faster and easier to implement in modern web architectures.
How do I grant admin consent for API permissions in Microsoft Entra ID?
Go to the Microsoft Entra admin center, select your registered application, navigate to 'API permissions', and click the 'Grant admin consent for [Your Tenant]' button. You must be signed in as a Global Administrator, Privileged Role Administrator, or Application Administrator.
Where can I find the endpoints for my Entra ID tenant?
In the Microsoft Entra admin center, go to 'App registrations' and click the 'Endpoints' button on the top menu. This will display all relevant endpoints, including the OAuth 2.0 authorization endpoint and OpenID Connect metadata document.
