Set up OIDC SSO with Microsoft Entra ID (formerly Azure AD)
Configure Entra ID as your GraphOS organization's identity provider
This guide walks through configuring Microsoft Entra ID (formerly known as Azure Active Directory) as your GraphOS organization's identity provider (IdP) for OIDC-based SSO.
If you're migrating your SSO configuration, see the self-service instructions .
Setup
OIDC-based SSO setup in Entra ID has these steps:
Create an app registration for Apollo GraphOS in Entra ID.
Retrieve your Entra client ID, client secret, and issuer.
Configure API permissions in Entra ID.
Send your Entra ID's app registration's OIDC metadata to Apollo.
Setup requires at least a Cloud Application Administrator role.
Step 1. Create an Entra ID app registration
Send a request to your Apollo contact to configure an OIDC SSO integration. Include the organization name(s) you are setting up SSO for and the email domains you want to associate with the organization. Your Apollo contact will respond with:
A redirect URI
A link to a form where you can submit your SSO information to Apollo. You'll use this form in the last setup step.
ⓘ noteThe redirect URI differs for each GraphOS organization. If setting up SSO for multiple organizations, repeat the following steps for each organization using different values.Go to your Microsoft Entra admin center . Alternatively, you can sign in to the Azure Portal and then go to Microsoft Entra ID.
In Entra, go to Identity > Applications > App registrations. If accessing Entra from the Azure Portal, go to Manage > App registrations. Select +New registration in the top menu.
On the Register an application page, provide the following information:
Enter a descriptive name for your application, such as
Apollo GraphOS
.Under Supported account types, select which Microsoft account types should have access to GraphOS.
For Redirect URI, select Web and enter the redirect URI provided by your Apollo contact.
Click Register.
Step 2. Retrieve app registration data
From the Overview section of your newly created app registration, copy and paste your Application (client) ID into a local text file.
Next to Client credentials, click Add a certificate or secret and create a new secret.
Copy and paste the secret's Value to the text file you created earlier.
Back in the Overview section, select Endpoints from the top menu.
Copy and open the OpenID Connect metadata document URL in a new browser tab. Find the
issuer
value. It should be formatted likehttps://login.microsoftonline.com/unique-value/vx.x
. Copy and paste this URL into your text file.
Step 3. Configure API permissions
From the API permissions section of your app registration, check whether
User.Read
is listed by default. If it isn't, add it manually:Select + Add a permission > Microsoft Graph > Application permissions.
Search for
User
, expand, and selectUser.Read.All
. Click Add permissions.Save your changes.
Also from the API Permissions section, select Grant admin consent for Default Directory next to the + Add a permission button. Doing this ensures that your users don't need to grant consent during SSO.
From the Manifest section of your app registration, find the
groupMembershipClaims
property. Change its value fromnull
to either"All"
or"SecurityGroup"
. These values ensure that the access token includes the group membership claim during SSO.Save your changes.
Step 4. Send OIDC metadata to Apollo
To complete the configuration, complete the Apollo-provided link provided in step 1 with the appropriate information:
Client ID: the Application (client) ID you copied
Client Secret: the secret value you copied
Apollo encrypts this value and stores it securely.
Issuer: the issuer value you copied from the OpenID Connect metadata document
Discovery URL: you don't need to enter this since the OpenID Connect metadata document URL follows the standard
/.well-known/openid-configuration
format
Once submitted, inform your Apollo contact. They will then be able to complete your SSO setup.
Once your SSO setup is finalized, you need to assign users to your GraphOS app in Entra.
Assign users in Entra ID
Once you've set up your Apollo GraphOS application in Entra ID, you need to assign users to it so they can access GraphOS. You can assign individual users or groups from the User and groups page of your Apollo GraphOS application in Entra ID.
You may want to begin by adding yourself individually and then testing SSO by clicking Test at the bottom of the Single sign-on page. Once you've successfully tested your own user's ability to use SSO, add any applicable users or groups.
If team members could previously login before you implemented SSO, they must re-login to GraphOS Studio via SSO. Signing in creates a new user profile for them. Any personal API keys associated with their previous user profile will be lost. (Graph API keys ) are unaffected and remain functional.) Additionally, you must reassign any GraphOS roles associated with their previous user profile.
Once you've confirmed the new configuration works for your users, remove any legacy Apollo GraphOS applications in Entra ID or app registrations in Azure AD if you have them.
Legacy setup
Click to see legacy instructions
PingConnect
) might already be used by another application in your organization.1. Create an Azure AD app registration
- Go to your Azure Portal and then navigate to Azure Active Directory.
- In the left pane, select App Registrations. Then in the top ribbon click + New Registration.
- On the Register an application page, provide the following information:
- Provide a friendly name for the PingOne client (such as
Apollo GraphOS
orPingOneConnect
). - Under Supported account types, select which Microsoft account types will have access.
- Leave Redirect URI empty. You'll provide this information later.
- Provide a friendly name for the PingOne client (such as
2. Retrieve your endpoint URL and client ID
- From the Overview section of your newly created app registration, copy and paste your Application (client) ID into a local text file.
- Still in the Overview section, select Endpoints from the top menu.
- Copy and paste the OpenID Connect metadata document URL into the same local text file:
3. Create a client secret
- From the Certificates & secrets section of your app registration, click + New client secret and create a new secret.
- Copy and paste the secret's Value field to the same text file you created earlier:
4. Configure API permissions
- From the API permissions section of your app registration, check whether
User.Read
is listed by default. If isn't, add it manually:- Select + Add a permission > Microsoft Graph > Application permissions.
- Search for
Group
, expand, and selectGroup.Read.All
. - Save your changes.
- If
User.Read
was not auto created, repeat this process forUser.Read
.
- Also from the API Permissions section, select Grant admin consent next to the + Add a permission button. This ensures your users don't need to grant consent during SSO.
- From the Manifest section of your app registration, find the
groupMembershipClaims
property. Change its value fromnull
to eitherAll
orSecurityGroup
.- These values ensure that the group membership claim is included in the access token during SSO.
- Save your changes.
5. Integrate PingOne with Azure AD
- After you receive your PingOne SSO invitation email, click the enrollment link to create a new account or sign in with an existing account.
- On the landing page, click Setup on the top ribbon.
- Select Connect to an Identity Repository > Microsoft Azure AD and click Next.
- From the Configure Your Microsoft Azure Connection modal:
- Copy and paste the endpoint URL, client ID, and client secret values saved earlier from Azure AD.
- Select Verify. PingOne will verify that it can query the endpoint(s) you've specified.
- For Scope, select the OAuth scopes to include in authentication requests.
- Click Next.
- In Step 2 of the wizard, copy the PingOne Redirect URI and paste it on the Azure AD app registration.
- Redirect URIs can be configured from the Overview section of your app registration under the Essentials menu in Azure AD.
- Select Redirect URIs > Add a platform > Web and enter the Redirect URI you copied from PingOne. Select Configure to save changes.
- Back on the PingOne configuration wizard, select Next after copying and pasting the URI.
- In Step 3 of the wizard, configure the Map Attributes section by mapping the incoming attributes or claims from Azure AD to PingOne. You can leave this with the default Attribute Mapping.
- In Step 4 of the wizard, choose whether or not to synchronize your user groups from Azure AD to your PingOne user groups.
- The permissions
User.Read
andGroup.Read.All
are required for synchronization to be successful. - Any PingOne user groups that do not exist in your Azure provider will be replaced by the Azure groups.
- Each of your Azure group members are automatically added to the corresponding PingOne groups when the user initially signs on (SSO) to PingOne. This is PingOne's just-in-time user provisioning.
- The permissions
- Click Save to finish connecting Azure AD to PingOne.
6. Configure the OIDC application
After you successfully configure the identity bridge between Azure AD and PingOne, you need to configure and enable Apollo as an OIDC application. The configuration for this application should already be initialized, and you can access it via the Complete your Application Configuration reminder under Applications in the PingOne admin console.- Select Meteor Development Group - GraphOS Studio under Complete your Application Configuration.ⓘ noteIf the Add OIDC Application wizard doesn't automatically pop-up, select the SAML tab and then select the OIDC tab.
- In Step 1 of the Add OIDC Application wizard, configure the application name, description, category, and icon (optional).
- Click Next for Steps 2-5 (these are configured by default).
- In Step 6 of the wizard (Attribute Mapping), you must map
email
toemail
andsub
topreferred_username
. You can optionally map more attributes for given name, family name, and others. - In Step 7 of the wizard (Group Access), select whichever groups should receive SSO access to Apollo.
- Click Done to complete the configuration.