Connecting Azure AD as an Auth Provider

Azure AD (now branded Microsoft Entra ID) is the most common identity provider for B2B SaaS — most corporate customers already use Microsoft 365. This article walks through registering ActiveManage as an Azure application and wiring it up as an authentication provider.

In the Azure Portal

1. Sign in to portal.azure.com as a Global Admin (or someone with App Registration permission).
2. Navigate to Azure Active Directory → App registrations → New registration.
3. Give the app a name (e.g. “ActiveManage Production”).
4. Set supported account types — usually “Single tenant” unless you serve other Microsoft tenants too.
5. Redirect URI: choose Web and enter https://yourdomain/auth/callback/azure.
6. Register, then note the Application (client) ID and Directory (tenant) ID.
7. Under Certificates & secrets, create a new client secret. Copy the value immediately — it's only shown once.
8. Under API permissions, add Microsoft Graph > User.Read (delegated) and grant admin consent.

In ActiveManage

1. Open Architect Panel → Authentication Methods → Add Provider and choose Azure AD.
2. Paste the client ID, tenant ID and client secret.
3. Map Azure AD attributes:
   • preferred_username → email
   • given_name → first name
   • family_name → last name
4. Optionally map Azure AD group membership to ActiveManage security groups.
5. Save and click Test — you'll be redirected to Microsoft, sign in, and bounced back with a success message.

Worked Examples

• Single-tenant SaaS: One Azure AD app, only your own staff sign in.
• Multi-tenant SaaS: One Azure AD app set to “Multi-tenant”; each customer admin consents to it once. Their staff sign in transparently afterwards.
• Group mapping: Azure group aad-admins maps to the platform's Administrators security group; aad-marketing maps to Marketing.