Microsoft Entra ID

Let colleagues sign in to your app with the work account they already use. No second list of users to keep up to date.

Ask Claude to connect it

Included on every plan. An admin approves it once.

What your app can do with it

✓Uses your company's own accounts, password rules and two-step sign-in
✓No separate list of users to maintain
✓Your IT team stays in charge of who has an account

For your IT admin

Setting it up

Done once, in your company's own account with Microsoft.

Create an app registration in the customer’s Entra tenant. This needs Application Administrator plus admin consent, usually from the client’s IT rather than the consultant.

Add the redirect URI your application will use.

Generate a client secret and hand it to the platform once. It is never shown again.

For developers

What your app receives

Signs an application’s end users in against the customer’s own Entra tenant, so accounts, password policy and MFA remain theirs and nobody maintains a second user list. Your application receives the tenant, the client id, a secret and its redirect URI. What it does not receive is a login screen: the variables configure an OIDC client, whether that’s an oauth2-proxy sidecar or your framework’s own, and that piece still has to exist in the application.

Microsoft Entra ID's own documentation →

ENTRA_TENANT_IDENTRA_CLIENT_IDENTRA_CLIENT_SECRETENTRA_REDIRECT_URI