Skip to main content
This guide walks you through setting up OpenID Connect (OIDC) single sign-on between TrueFoundry and Microsoft Entra ID (formerly Azure Active Directory). Once finished, members of your Entra tenant can sign in to TrueFoundry through a Login with Entra ID button. For SAML 2.0 instead of OIDC, see SAML with Microsoft Entra ID.

​
Prerequisites

  • A TrueFoundry tenant with Admin access to Settings → Security & Access → SSO.
  • A Microsoft Entra tenant with permission to create App registrations.

​
Step 1 — Register an application in Entra

1

Open App registrations

Sign in to the Microsoft Entra admin center as an administrator.In the left navigation, expand Identity → Applications, select App registrations, then click New registration.
Microsoft Entra admin center App registrations page with the New registration button highlighted

App registrations page in the Microsoft Entra admin center

2

Configure the registration

Fill in:
  • Name — a lowercase alphanumeric label, for example truefoundry-oidc.
  • Supported account types — choose Single tenant only.
  • Redirect URI — set the platform to Web and the URL to:
Click Register.
Entra Register an application form with Single tenant only selected and the TrueFoundry OAuth callback redirect URI configured

Register an application — Single tenant only and Web redirect URI

3

Note the Client ID and Tenant ID

On the application Overview page, copy the Application (client) ID and the Directory (tenant) ID. You’ll use them in TrueFoundry.
Entra app registration Overview page with the Application (client) ID highlighted

App registration Overview page showing the Application (client) ID and Directory (tenant) ID

​
Step 2 — Create a client secret

1

Open Certificates & secrets

From your app registration, click Certificates & secrets in the left sidebar, then click New client secret under Client secrets.
Entra Certificates and secrets page with the New client secret button highlighted under Client secrets

Certificates & secrets page in the Entra app registration

2

Generate the secret

Add a description (for example TrueFoundry SSO), choose an expiry that matches your security policy, and click Add.
Entra Add a client secret panel with Description and Expires fields and the Add button highlighted

Add a client secret side panel — description and expiry, then Add

3

Copy the secret value

Copy the secret’s Value field — not the Secret ID. The value is only visible immediately after creation.
Entra Certificates and secrets page showing a newly created client secret with the Value column highlighted

Newly created client secret — copy the Value column, not the Secret ID

Once you leave this page, the secret value can never be displayed again. If you lose it you must create a new client secret.
By default, Entra issues an ID token that doesn’t include the user’s email address. Adding the email claim lets TrueFoundry match the user to a TrueFoundry account.
1

Open Token configuration

From your app registration, click Token configuration in the left sidebar, then click Add optional claim.
Entra Token configuration page with the Add optional claim button highlighted

Token configuration page — click Add optional claim

2

Add ID token claims

Choose ID as the token type and select the following claims:
  • email
  • family_name
  • given_name
Click Add. When prompted, enable Turn on the Microsoft Graph email, profile permission so the requested scopes have permission to return these claims.
Entra Add optional claim panel with ID selected and email, family_name and given_name claims ticked

Add optional claim panel — select ID token type and the email, family_name, given_name claims

Entra prompt asking to turn on the Microsoft Graph email, profile permission for the selected claims

Confirmation prompt — enable the Microsoft Graph email, profile permission

​
Step 4 — Add the redirect URI again on the Authentication page (if needed)

If you skipped setting Redirect URI during registration:
1

Open Authentication

From the app registration, click Authentication in the left sidebar, then Add a platform → Web.
2

Add the callback URL

Set Redirect URIs to:
Click Configure.
To enable the Device Code sign-in flow (used by some CLIs that don’t have access to a browser), expand Advanced settings on the Authentication page and toggle Allow public client flows on.

​
Step 5 — Configure TrueFoundry

1

Open SSO settings

In TrueFoundry, go to Settings → Security & Access → SSO.Click the + icon labeled Add New SSO Config.
TrueFoundry SSO settings page with the Add New SSO Config plus button highlighted

SSO page in TrueFoundry — click the + icon to add a new SSO configuration

2

Fill in the SSO form

  • Enabled: turn this on.
  • Name: a lowercase alphanumeric label — for example, entraoidc.
  • SSO Provider: select Azure AD.
  • Authentication Configuration: choose OIDC.
  • Client ID: the Application (client) ID from Entra.
  • Client Secret: the client secret Value from Entra.
  • Discover endpoints: leave enabled.
  • Issuer URL:
    Replace <tenant-id> with the Directory (tenant) ID you copied in Step 1.
  • Scopes (optional): leave blank to use the default openid email. Add profile if you want first and last name in the token.
3

Save

Click Save. TrueFoundry validates the issuer URL and stores the credentials.

​
Step 6 — Assign users in Entra

For single-tenant configurations with Assignment required enabled, Entra only allows assigned users to sign in.
1

Open the enterprise application

Back in the Entra admin center, navigate to Enterprise applications and select the app registration you created.
Entra Enterprise applications page with the search filter applied to locate the registered application

Find your application in Enterprise applications

Entra enterprise application Users and groups page with the Add user/group button highlighted

Users and groups tab inside the enterprise application

2

Add users and groups

Click Users and groups → Add user/group, pick the users or security groups that should be able to sign in to TrueFoundry, and click Assign.
Entra Add Assignment page with the Users selector showing None Selected

Add Assignment — click Users to open the picker

Entra Add Assignment page with 1 user selected and the Assign button highlighted

With users selected, click Assign to grant access

​
Step 7 — Test single sign-on

  1. Open a private/incognito window and visit your TrueFoundry login page.
  2. Click Login with Entra ID.
  3. Authenticate with an assigned user.
You should land in the TrueFoundry dashboard. New users are created automatically if JIT provisioning is enabled.

​
Optional next steps

​
Troubleshooting

The Issuer URL in TrueFoundry points to the wrong tenant. Double-check the Directory (tenant) ID and re-construct the issuer as https://login.microsoftonline.com/<tenant-id>/v2.0.
Either the secret expired or only the Secret ID was copied. Generate a new client secret in Certificates & secrets, copy the Value field immediately, and update TrueFoundry.
Make sure you added the email optional claim in Token configuration and enabled the email, profile Microsoft Graph permission when prompted. Then add profile email to Scopes on the TrueFoundry SSO form.
Either disable Assignment required on the Enterprise application’s Properties page, or assign the user/group under Users and groups.