Set up IDP of OIDC for Microsoft Entra ID¶

To setup an identity provider of type OIDC, follow these steps:

1. Create an application in Microsoft Entra ID, if one does not already exist.

   • Open the Azure portal to sign-in Microsoft Entra ID.
   • For first-time access, select "More services" from the navigation menu on the left.

   • Navigate to "Enterprise applications" and select the relevant application from the displayed list.

     

   • In the application's overview page, expand the "Manage" section.

   • To launch the application, click "Single sign-on".

   • Click "Go to Application".

     

2. In the overview page, click the "Endpoints" tab in the application.

   

3. Copy the "OpenID Well-known Configuration" URL and open it in another browser tab.

   

4. Ensure the "OpenID Well-known Configuration" is available to serve as the discovery URL for IDP setup in Insights Hub.
   https://login.microsoftonline.com/<<Entra Directory tenant ID>>/v2.0/.well-known/openid-configuration.

5. Copy the Logout URL (end_session_endpoint) for use during the Insights Hub IdP configuration process.

   

6. Copy the "Application (client) ID" from the "Application Overview" for the Insights Hub IDP configuration.

   

7. Add the attributes in the Microsoft Entra ID application:

   • Select "Token Configuration".
   • Click "Add Optional Claims".
   • Select "ID" token and "Access" token.
   • Select the attributes email, family_name and given_name.

   

8. Navigate to the "Manage" tab and click "Certificates & secrets" to get the "Client Secret".

   

9. Select "New client secret" to generate a new credential. Copy the secret, as it will not be visible in Microsoft Entra ID after the initial display.

   

10. To add a user in the Microsoft Entra application, select the "Users and groups" tab and click "Add user/group".

    

    Note

    Ensure the same user is registered in the Insights Hub tenant.

11. After obtaining the Discovery URL, Logout URL, Client ID and Client Secret, proceed with the IDP configuration in Insights Hub:

    • Login to Insights Hub (IH) tenant.
    • Navigate to the "Settings App" in the System Tools tab.
    • Click "Identity Provider Federation".

    

12. Click "Configure Custom Identity Provider".

    

13. Select "Open ID" as the Provider Type.

    

14. Enter all required fields:

    • Attribute for Email: email
    • Attribute for First Name: given_name
    • Attribute for Last Name: family_name
    • Attribute for Username: email
    • Origin Key: It can be any valid string. For example, firstapp

    • Discovery URL: The Discovery URL is obtained from the Microsoft Entra application. (refer to step 3)

      

15. Register the Callback and Redirect URLs in Microsoft Entra ID prior to IDP activation.

16. Access the "Authentication" section of the Microsoft Entra ID application. If required, select 'Add a platform' to establish a Web platform and register the Redirect URLs.
    Origin Key: Same as added in application in Insights Hub https://<<Tenant ID>>.ciam.eu1.sws.siemens.com/login/callback/<<Origin Key>>.

    

17. Once the Callback URLs have been added, proceed to activate the Identity Provider in the Insights Hub tenant.

    

18. Log-in to acknowledge the activation. Once confirmed, the IDP is successfully activated. If login issues occur via the custom IDP, verify that the attribute mappings are correctly configured by your provider.

    

19. Ensure the Azure OIDC IDP application is configured according to the following specifications:

    • Verify that the email, family_name and given_name attributes are in the Microsoft Entra ID application.

      • Select "Token Configuration".
      • Click "Add Optional Claims".
      • Select "ID tokens".
      • Select attributes email, family_name and given_name.

      

    • Confirm that the attribute mappings are properly configured in the Insights Hub.

      

    • Ensure that the email address in the user profile matches the email used for logging into the OIDC IDP.

      

Except where otherwise noted, content on this site is licensed under the Development License Agreement.