Microsoft Entra ID

With Microsoft Entra ID (formerly Azure AD), users sign in to Eurion with their Microsoft account. Sign-in uses OpenID Connect with PKCE; Eurion checks the ID token's signature, validity period and nonce.

The examples use the domain example.se.

1. Register an app in Entra ID

In the Microsoft Entra admin center: App registrations → New registration.

Field	Value
Name	For example Eurion
Supported account types	Accounts in this organizational directory only
Redirect URI	Platform Web, address https://api.example.se/v1/auth/azure/callback

After the registration:

1. Note the Application (client) ID and Directory (tenant) ID under Overview.
2. Under Certificates & secrets → New client secret: create a secret and copy the Value straight away (it is only shown once). Note when it expires.
3. Under API permissions: the permissions openid, profile, email and offline_access (Microsoft Graph, delegated) are enough for sign-in.

The e-mail address

Eurion identifies the user by the email claim, or preferred_username if email is missing. So users need an e-mail address or a UPN that is their real address.

2. Set up Eurion

Sign in at https://admin.example.se and open Identity Providers → Microsoft Azure AD → Configuration.

Field	Value
Enable Azure AD Sign-in	On
Tenant ID	Directory (tenant) ID
Client ID (Application ID)	Application (client) ID
Client Secret	The secret's Value. Stored encrypted. Leave empty to keep a stored secret.
Callback URI	Pre-filled: https://api.example.se/v1/auth/azure/callback. Must be exactly the same as in Entra ID.
Post-logout Redirect URI	Pre-filled: https://app.example.se
Groups Claim Name	groups (only used for group mapping)
Default Roles	Roles that every new Entra user gets, default member

Choose Save Configuration. The Authority URL box shows https://login.microsoftonline.com/<tenant>/v2.0.

3. Test

Open https://app.example.se in a private browser window. The sign-in page now has the Microsoft Entra ID button. Sign in with a test account that is not an administrator in Eurion.

How accounts are linked

The first time someone signs in with Microsoft, Eurion does this:

Situation	Result
There is already a Eurion account with the same e-mail address	The account is linked to the Microsoft account. From then on the user signs in with Microsoft, and the roles are replaced with Default Roles plus mapped groups.
There is no account	A new account is created with Default Roles plus mapped groups.

Later sign-ins update the name and profile picture from Entra ID and add roles from new group mappings. Roles are never removed automatically.

New accounts and the organisation

In 1.6.4, an account that is created at the first Microsoft sign-in is not automatically placed in your organisation in Eurion. Accounts that already exist and are linked (the first row in the table) keep their organisation. Contact support before you let many users sign in with Microsoft for the first time.

Keep a local super administrator

Never sign in with Microsoft on the local super administrator account

If the super administrator's e-mail address also exists in Entra ID and someone signs in with Microsoft using that address, the account is linked. Then:

• the roles are replaced with Default Roles (plus mapped groups), so the account can lose the super administrator role, and
• the account no longer has a password in Eurion, so it cannot confirm its password and cannot install updates.

Use an e-mail address for the local super administrator that does not exist in Entra ID, for example eurion-admin@example.se.

Group mapping

Under Identity Providers → Microsoft Azure AD → Group Mappings you can grant roles based on groups in Entra ID.

1. In Entra ID: the app's Token configuration → Add groups claim, choose Security groups and Group ID. The ID token then contains the groups claim with the groups' Object IDs.
2. In Eurion: Add Mapping with the group's Object ID (and preferably a display name) and the role it grants: member, developer, admin, super-admin, moderator or guest.

The roles are added at the next sign-in. Under Users in the same view you can see who has signed in with Entra ID, their groups and the latest synchronisation.

WARNING

Do not map a group to super-admin or admin unless you know exactly who is in the group. Roles are not removed automatically when someone leaves the group; remove them by hand in Eurion.

When the secret expires

Create a new secret in Entra ID before the old one expires, paste it into Client Secret and save. Without a valid secret every Microsoft sign-in fails; local accounts still work.

Troubleshooting

Error	Cause
The button is not shown	The provider is not switched on, or Tenant ID / Client ID is missing.
Azure AD is not fully configured	The secret is missing or could not be read. Paste it in again.
Microsoft shows redirect URI mismatch (AADSTS50011)	The Callback URI in Eurion and the Redirect URI in Entra ID are not identical.
ID token missing email claim	The user has neither email nor preferred_username.
Linked Eurion account is inactive or deleted	The Eurion account is blocked or deleted.

The log is in identity-service: sudo eurion-ctl logs identity-service --no-follow -n 200.