> For the complete documentation index, see [llms.txt](https://docs.silkline.ai/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://docs.silkline.ai/configuration/sso-configuration/azure-ad-oidc.md).

# Azure AD (OIDC)

Configure SSO via Microsoft Entra (Azure AD) as an OpenID Connect identity provider for Silkline

## Overview

**Time to complete:** about 15 minutes

**What this does:** This configuration allows your users to login to Silkline using their Microsoft 365 / Azure AD account.

## Steps

Since there are several steps involved in this configuration and testing is required, we recommend scheduling time to walk through these steps together.

These steps will guide you through setting up a new app registration in Microsoft Azure AD to enable Single Sign-On (SSO) into Silkline via OpenID Connect. Azure AD serves as the identity provider (IdP); Silkline's authentication service at `auth.silkline.ai` is the application Azure AD returns users to.

{% hint style="info" %}
An organization admin can complete this connection without a Silkline configuration step — see [Self-service SSO setup](/configuration/sso-configuration/self-service-sso.md). The console steps below are the same either way; only the last two steps differ.
{% endhint %}

{% stepper %}
{% step %}

#### Register a New App in Azure AD

1. **Log in to Microsoft Entra (previously Azure Active Directory) Portal**:
   * Navigate to <https://entra.microsoft.com> and log in with your Azure AD admin credentials.
2. **Go to App Registrations**:
   * In the left-hand menu, select **Azure Active Directory** → **App registrations**
   * Select **New registration** button
3. **Register the Application**:
   * **Name**: Enter a name for the app, such as `Silkline-SSO`.
   * **Supported Account Types**: Please select Single Tenant
   * **Redirect URI**: Set this to your organization's Silkline redirect URI, with type `Web`:

     | Environment | Redirect URI                                                                |
     | ----------- | --------------------------------------------------------------------------- |
     | Production  | `https://auth.silkline.ai/realms/silkline/broker/<org-id>/endpoint`         |
     | Test / Gov  | `https://dev-auth-gov.silkline.ai/realms/silkline/broker/<org-id>/endpoint` |

     Copy the exact value from **Settings → Single sign-on** in Silkline — `<org-id>` is specific to your organization.
4. **Click "Register"** to create the app.

<figure><img src="https://1158234432-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FbwxUq49WUtHgRhcDnQkz%2Fuploads%2Fgit-blob-5775e9a619bbf2beb55f9aff7350ce4c8a0bb91b%2FScreenshot%202024-12-23%20at%2012.20.29%E2%80%AFPM.png?alt=media" alt=""><figcaption><p>Example screenshot of Microsoft Entra admin center configuration</p></figcaption></figure>
{% endstep %}

{% step %}

#### Gather App Details

1. From the **Overview** page of the app registration, and note down the following:
   * **Application (client) ID**: This is the Client ID for the Silkline connection.
2. Click the “Endpoints” button and grab the **OpenID Connect metadata document URL.**\
   It should look like this:

```
https://login.microsoftonline.com/729dfe76-e026-4b14-b5f8-947f2e2af950/v2.0/.well-known/openid-configuration
```

{% endstep %}

{% step %}

#### Application Configuration

1. Go to the application **Authentication** section
2. Enable **ID Token** for implicit flow:

   ![Implict grant and hybrid flow configuration screenshot](https://1158234432-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FbwxUq49WUtHgRhcDnQkz%2Fuploads%2Fgit-blob-551849cd97f9cf595a0d4fbff1f47ada61b593d6%2Fimage%20\(1\).png?alt=media)

   1. Save the changes with the **Save** button at the top.
3. Go to the **Token configuration** section on the left.
4. Click on **Add optional claim**. Add:
   1. `email`
   2. `family_name`
   3. `given_name`
5. When clicking on **Add** will prompt for permissions for the Microsoft Graph. This is required, so accept this request.
   {% endstep %}

{% step %}

#### Silkline configuration

Under **Certificates & secrets**, create a client secret and copy its value — you will not be able to read it again.

Then either:

* **Self-service:** enter the issuer (`https://login.microsoftonline.com/<tenant-id>/v2.0`, or `login.microsoftonline.us` for Azure Government), Application (client) ID, and client secret in **Settings → Single sign-on**. See [Self-service SSO setup](/configuration/sso-configuration/self-service-sso.md).
* **Assisted:** send your Silkline POC the **Application (client) ID** and the **OpenID Connect metadata document URL**, and share the client secret through a secure channel such as a password manager. Your Silkline team will complete the configuration and reach back out when it is ready to test.
  {% endstep %}

{% step %}

#### ⏳ Wait for Silkline to complete your SSO configuration

Assisted setups only. Let us know once you've completed steps 1-4 and share the required values. We'll then complete the configuration on our end and will let you know when SSO is ready for testing. Self-service setups are live as soon as the connection is created — skip to the next step.
{% endstep %}

{% step %}

#### Test SSO Configuration

1. Go to the [Silkline application](https://app.silkline.ai/landing).
2. Initiate the login flow to ensure the SSO integration with Azure AD works as expected.
3. If issues occur, verify the client ID, client secret, and redirect URI, check Azure AD sign-in logs, and reach out to your Silkline POC.
   {% endstep %}
   {% endstepper %}

### Video overview (third-party guide)

{% embed url="<https://www.youtube.com/watch?v=X3pI4B1-Lto>" %}