--- title: MS Azure AD OIDC slug: import-test-pdf/ms-azure-ad-oidc createdAt: 2025-10-23T07:50:10.190Z --- The following procedure creates an OIDC SSO configuration for your Enterprise organization. ## Prerequisites - `Owner` or `admin` role in an Enterprise organization - Administrative access to your organization's Microsoft Azure AD portal ## Supported features This configuration supports the following: - Service provider initiated SSO - Single Log Out \[optional] ## Configuration steps Before configuring SSO, you need to assign a namespace and make files of your service provider certificate and private key. These steps provide the information you need to enter later. Create your namespace: 1. Go to **Organization > SSO**. 2. Under **Namespace**, enter the namespace you want for your organization, for example, `acmecorp`. Your organization members enter this namespace when they log in via SSO. 3. Under **SSO type**, select **Oauth2**. ### Steps on Microsoft Azure AD ### Create an OIDC application on Microsoft Azure AD 1. Log in to Microsoft Azure AD and go to **Manage Microsoft Entra ID**. 2. Click **Enterprise applications**. 3. Click **+ New Application**. 4. Click **+ Create your own application**. 5. Enter a name for your app and select **Register an application to integrate with Microsoft Entra ID (App you're developing)**. 6. Click **Create**. 7. Enter and select the following: | Section on *Register an application* page | Required information | | ----------------------------------------- | -------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- | | **Name** | Enter a name for your OIDC SSO app | | **Supported account types** | Select the option best for your use case.
For example, use **Accounts in this organizational directory only** if your application is only for internal use within your organization. | | **Redirect URI (optional)** | Although Microsoft marks this field as optional, successful implementation with requires the following:
Select a platform - Web



https\://next.integromat.com/sso/login | 8. Click **Register**. ### Create your client credentials 1. In the Microsoft Azure AD portal go to **Home > Enterprise applications > \{your OIDC app} > Single Sign-on** and click **Go to application**. 2. Under **Essentials**, find **Application (client) ID**. Copy this value and save it in a secure place. This is the required information for the **Client ID** field in your SSO configuration. 3. In the lefthand menu under **Manage**, click **Certificates & secrets**. 4. Click **+ New client secret**. 5. In the new dialogue, enter a short description and click **Add**. 6. Find the new client secret on the list. Copy the **Value** and save it in a secure place. This is the required information for the **Client secret** field in your SSO configuration. ### Configure tokens and optional claims 1. In the lefthand menu under **Manage**, click **Token Configuration**. 2. Click **+ optional claim**. 3. In the new dialogue, select **ID**. 4. A list appears. Select **Email**. ### Add API permissions 1. In the lefthand menu under **Manage**, click **API Permissions**. 2. Click **+ Add permission**. 3. In the new dialogue, click **Microsoft Graph**. 4. Click **Application permissions**. 5. Use the search bar to find `User.Read.All`. 6. Select `User.Read.All` and click **Add permissions**. :::hint{type="success"} ### Tip You can select `User.Read` instead of `User.Read.All` ::: ### Add users to your application To provide access to your organization members, you need to add these users to your app in the MS Azure portal. 1. In the Microsoft Azure AD portal go to **Home > Enterprise applications > \{your OIDC app}**. 2. Click **Users and groups**. 3. Click **+ Add user/group** to add the users you want to access your organization. ### Steps in 1. Enter the following information on the SSO tab of your organization's dashboard: | Field on SSO tab | Value to enter | | ----------------------------------- | ------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------ | | **User information URL** | `https://graph.microsoft.com/v1.0/me` | | **Client ID** | Enter the **Application (client) ID** you copied in step 2 of **Create your client credentials**. | | **Token URL** | `https://login.microsoftonline.com/1234etc/oauth2/v2.0/token` | | **Login scopes** | `User.Read.All` | | **Scopes separator** | Enter a single space. | | **Authorize URL** | To find your Authorize URL:
1. In the Microsoft Azure AD portal go to **Home > Enterprise applications > \{your OIDC app} > Single Sign-on** and click **Go to application**.
2. Click **Endpoints**. A window appears.
3. Find **OAuth 2.0 authorization endpoint (v1)**. Copy and paste this URL into your configuration. | | **Client secret** | Enter the **Value** you copied in step 6 of **Create your client credentials**. | | **User information IML resolve** | \{"id":"{{id}}","email":"{{mail}}","name":"{{givenName}}"} | | **Redirect URL** | No action required | | **Team provisioning for new users** | Select an option based on your needs. | 2. Click **Save**. ## Service provider initiated SSO 1. Go to ['s login page](https://www.make.com/en/login). 2. Click **Sign in with SSO**. 3. Enter the namespace you chose for your organization. 4. Log in using your Microsoft credentials and consent to 's access to your user data. ## Troubleshooting When you save the SSO configuration, you automatically receive an email with a link to bypass SSO login. Use this link to log in and adjust your configuration as needed.