# Entra ID login People sign in to Straza with their Microsoft Entra ID account, in a browser on the machine they enroll, and strazad trusts your tenant's ID tokens. - Who: You, as the Entra admin and the Straza admin - Where: The Microsoft Entra admin center, strazad's configuration file, and a terminal on a person's machine - Profile: Enterprise In short: People sign in to Straza with their Entra ID account, in a browser on the machine they enroll, and Straza never holds their password. You register Straza in Entra as a public client with a 127.0.0.1 redirect and the auth_time claim, and point strazad at your tenant. Your IGA provisions the people over SCIM. YoumakeMicrosoftEntraIDtheloginproviderofanenterpriseStraza,astheadminofboth.YouregisteranappforStrazaintheMicrosoftEntraadmincenter,pointstrazadatyourtenant,andenrollamachine.AttheendpeoplesignintoStrazawiththeirEntraaccount,inabrowseronthemachinetheyenroll,andStrazaneverholdstheirpassword.NosteponthispagehasbeenfiredagainstarealEntratenantyet.TheEntrasettingsfollowMicrosoft'sdocumentation,andtheStrazasidefollowsthecode.[Keycloaklogin](https://docs.straza.ai/guides/connect-identity/keycloak-login/index.md)istheproviderthatwaswalkedendtoend.##Beforeyoustart{.nostep}-AnEntrarolethatregistersapplicationsandmanagesenterpriseapplications,suchasApplicationAdministrator.-Yourtenantid,whichtheOverviewpageofMicrosoftEntraIDshowsasTenantID.-Accesstostrazad'sconfiguration,andaperson'sLinuxmachinewiththe`straza`package,as[Enrollamachine](https://docs.straza.ai/guides/govern-an-agent/enroll-a-machine/index.md)describes.-AnidentitymanagerthatprovisionspeopleintoStrazaoverSCIM,becausetheenterpriseprofilecreatesnouseratsign-in.##WhatdependsonEntra{.nostep}Mostofthesign-inisStraza'sownandworksalikeateveryprovider.`strazaservice`runsthebrowsersign-inwithPKCE,namestheenrollingkeyinthenonce,andtakestheansweronlyon127.0.0.1.strazadchecksthatthesign-innamesthatkeyandisatmost10minutesold,applies`governance.minSignIn`,writestheauditrecords,andrefusesaperson'sbareIDtokenunderacodingharnessname.WhatdependsonEntraistheappregistration,howEntramatchestheportoftheloopbackredirect,andthe`auth_time`claim,whichEntrasendsonlywhenyouaddit.##RegistertheappIntheMicrosoftEntraadmincenter,openAppregistrations,whichthemenulistsunderIdentityandApplicationsatthetimeofwriting,andpress**Newregistration**.1.Nameit`Straza`.2.Under**Supportedaccounttypes**,pick**Accountsinthisorganizationaldirectoryonly**.3.Leave**RedirectURI**empty,becausealaterstepaddsit,andpress**Register**.TheOverviewpageofthenewappshowsits**Application(client)ID**.strazadneedsitas`oidc.clientId`,andeveryStrazaprogrampresentsit,sokeepit.Straza'sprogramsrunonpeople'smachinesandholdnosecret,soatEntratheyareapublicclient,ontheplatform**Mobileanddesktopapplications**,whichredeemsitscodewithPKCEalone.Thenextstepputstheredirectonthatplatform.Microsoftdocumentsthataredirectregisteredunderthe**Web**platforminsteadmakesEntraaskforaclientsecretthatnoStrazaprogramholds.##AddtheloopbackredirectStraza'sredirectis`http://127.0.0.1:/callback`,onaportthateachsign-inpicks.Microsoftrecommends127.0.0.1overlocalhostforaloopbackredirect,buttheportal'sformleanstolocalhost,soaddtheredirectintheapp'smanifest.Open**Manifest**andadd`http://127.0.0.1/callback`asaredirectofthepublicclient,thensave.IntheMicrosoftGraphformatofthemanifest,theredirectgoesunder`publicClient`,whichnobodyhasyetconfirmedfora127.0.0.1redirectagainstarealtenant:```json"publicClient":{"redirectUris":["http://127.0.0.1/callback"]}```IntheolderAADGraphformat,itgoesunder`replyUrlsWithType`,withthetype`InstalledClient`.Eitherway,**Authentication**thenlistsitunder**Mobileanddesktopapplications**.Aredirectregisteredonlyas`http://localhost/callback`doesnotmatch,becauseStrazaneversendslocalhost.MicrosoftdocumentsthatEntraignorestheportofalocalhostredirectofadesktopapp,andStrazareliesonthesamefor127.0.0.1untilatenantconfirmsit.Soleave`oidc.loopbackPort`at0.IfEntrarefusestheredirectbecauseofitsport,registerafixedoneinstead,suchas`http://127.0.0.1:8765/callback`,andset`oidc.loopbackPort:8765`onstrazad.##AddtheconsoleaddressTheconsoleandtheself-servicepagesigninwithinthebrowsertab,andEntrasendsthetabbacktotheaddresspeopleopentheconsoleat,normallyyourstrazadpublicURL,followedby`/console/signin`.Becausethetabbuildsthataddressfromitsownorigin,aserverthatpeopleopenundertwoaddressesneedsboth.Entraletsthetabredeemthecodeitselfonlyforaredirectontheplatform**Single-pageapplication**.Open**Authentication**,addaplatformofthetype**Single-pageapplication**,andenterthataddress,suchas`https://straza.example.com/console/signin`.Addoneaddressforeachaddresspeopleopentheconsoleat,oneachStrazaserver.Keep`http://127.0.0.1/callback`under**Mobileanddesktopapplications**,because`strazaenroll`stillusesit.##Addtheauth_timeclaimOpen**Tokenconfiguration**,press**Addoptionalclaim**,pickthetokentype**ID**,tick`auth_time`,andpress**Add**.EntrathensaysineachIDtokenwhenthepersonsignedin.Withouttheclaim,Strazarefuseseverybrowsersign-inforamachine,becauseitcannottellthatthepersonsignedinjustnow.Ifthisfails:``Strazarefusedthissign-inbecausetheidentityprovidersentnoauth_timeclaim,soStrazacannottellthatyousignedinjustnow.AskITtoaddtheauth_timeclaimtotheIDtokenoftheStrazaapp,thenrun`strazaenroll`again.``:Theapp'sIDtokenslack`auth_time`.Addtheoptionalclaimasthisstepshows.##Grantthesign-inpermissionsOpen**APIpermissions**,press**Addapermission**,pick**MicrosoftGraph**,then**Delegatedpermissions**,andtick`openid`and`profile`under**OpenIdpermissions**.Thenpress**Grantadminconsent**foryourtenant,sonobodyisaskedtoconsentattheirfirstsign-in.Strazaasksforbothscopesoneverysign-in.With`profile`,Entraputs`preferred_username`intheIDtoken,whichstrazadmatchestotheaccountyouridentitymanagerprovisioned.##RequireassignmentIn**Enterpriseapplications**,open**Straza**,then**Properties**,set**Assignmentrequired**to**Yes**,andsave.ThenaddthepeopleandgroupswhouseStrazaunder**Usersandgroups**.EntrasignsinnobodyelsetoStraza,andanunassignedpersonseesEntra'sownrefusalinthebrowser.##Allowsign-inwithacodeSkipthisstepunlesspeopleneedit.Amachinewithnodisplayenrollswith`strazaenroll--use-device-code`,whichneedsthedevicecodeflow,whichEntraallowswhenyouset**Allowpublicclientflows**to**Yes**under**Authentication**,in**Advancedsettings**.Thatsettingalsoallowsthepasswordgrantforthisapp,whichhandsaperson'spasswordtowhateverprogramasks,soleaveitoffwhennobodyneedsthecode.Microsoft'smanagedConditionalAccesspolicyBlockdevicecodeflowturnsitselfoninsometenants,andthen`--use-device-code`failswhatever**Allowpublicclientflows**says.Amachineenrolledwithacodeisstillrefusedwhile`governance.minSignIn`is`browser`,theenterprisedefault,soloweritto`code`onlywhenyouacceptasign-inthatcannotshowwhichmachineitwasapprovedfor.##PointstrazadatEntraThe`oidc`blockofstrazad'sconfigurationnamesyourtenant'sissuerandtheapp'sclientid.Putyourtenantidandtheapp'sApplication(client)IDinplaceofthetwonamesinanglebrackets.```yamloidc:issuer:https://login.microsoftonline.com//v2.0clientId:jitProvision:false````STRAZA_OIDC_ISSUER`and`STRAZA_OIDC_CLIENT_ID`aretheenvironmentformsofthefirsttwokeys.Writetheissuerexactlyasabove,with`/v2.0`andnotrailingslash,becauseitmustequaltheissuerinEntra'sIDtokens.strazadreadsthetenant'sdiscoverydocumentwhenitstartsandrefusestostartwhenitcannotreachit.Restartstrazadafterthechange.##Howatokenfindsitsaccount{.nostep}Thefirstsign-inlinksanaccountthatyouridentitymanagerprovisionedbymatchingtheIDtoken's`preferred_username`totheaccount's`userName`,andonlywhiletheaccounthasno`externalId`.Entra's`preferred_username`isusuallytheperson'suserprincipalname,soprovision`userName`withthesamevalue.Entra'sownSCIMprovisioningsends`mailNickname`as`externalId`bydefault.ThatneverequalstheIDtoken's`sub`,whichEntramakesdifferentforeachapp,sosuchapersonisrefusedatthefirstsign-in.strazad'slognamesthecauseinaline`enroll:loginnotaccepted`whoseerrorsays`username...isboundtoanotheridentity`.StrazadoesnotlinkonEntra's`oid`claimyet.Untilitdoes,provisionpeoplewithout`externalId`,andthefirstsign-inlinkseachaccountbyusername.##SigninOnaperson'smachine,inadesktopsession,enrollthemachine.Terminal,ontheperson'smachine:```shstrazaenroll--serverhttps://straza.example.com```Enrollnamesyourtenantinalinethatstarts`Signinginatyouridentityprovider:https://login.microsoftonline.com/`,thenopensthebrowseratMicrosoft'ssign-inpage.EntraasksthepersontosigninagainevenwhenthebrowserissignedintoMicrosoftalready,becauseStrazaasksforafreshsign-in,andyourConditionalAccesspoliciesdecidewhichfactorsthatsign-inneeds.Thebrowserthenreturnsto`strazaservice`onthemachine.Youshouldsee:`Enrolledas`andtheperson'susername,then`TheStrazabackgroundserviceholdsthismachine'skey.`Intheconsole,**Signin**takesthetabtoMicrosoft'ssign-inpageandbacktothepagethepersonstartedon.Theconsoledoesnotaskforafreshsign-in,soEntramaysendabrowserthatissignedintoMicrosoftstraightback.Ifthisfails:EntrashowstheerrorAADSTS50011inthebrowser,aboutaredirectURIthatdoesnotmatch:Theapplacks`http://127.0.0.1/callback`,orEntracomparedtheport.Addtheredirectinthemanifest,orfixtheportwith`oidc.loopbackPort`astheredirectstepshows.Thecommandgivesupafter5minutes.Asentencethatstarts`Youridentityproviderrefusedthesign-inandsaid:`andnamesAADSTS7000218:Entraaskedforaclientsecret,whichMicrosoftdocumentsforaredirectunderthe**Web**platform,thoughthisanswerhasnotbeenseenfromarealtenantyet.Moveitto**Mobileanddesktopapplications**throughthemanifest.EntrashowstheerrorAADSTS50105inthebrowser:Thepersonisnotassignedtotheapp.Addthem,oragrouptheybelongto,under**Usersandgroups**.`Thesign-indidnotcomebackfromyouridentityprovider.Ifitshowedanerroraboutaredirectaddress,youradministratormustaddhttps://straza.example.com/console/signintoStraza'sregistrationthere.PressSignintotryagain.`:Theconsolesaysthis,withyourserver'saddress,afterEntrarefuseditsredirect,usuallywithAADSTS50011.Addtheaddressunder**Single-pageapplication**,astheconsoleaddressstepshows.Aconsolesentencethatstarts`Youridentityprovider`andsaysitrefusedthesign-inordidnotletthispagefinishit:Theconsoleaddresssitsonaplatformotherthan**Single-pageapplication**,whereMicrosoftdocumentsthatEntrarefusesacodethatabrowserredeems.Thisanswerhasnotbeenseenfromarealtenantyet.Movetheaddressto**Single-pageapplication**.``loginnotaccepted:run`strazaenroll`again``:strazaddidnotaccepttheIDtoken.Lookinstrazad'slogfortheline`enroll:loginnotaccepted`,or`sessionexchange:loginnotaccepted`foraconsolesign-in.Whenitserrorsays`username...isboundtoanotheridentity`,theprovisionedaccountcarriesan`externalId`thatisnottheIDtoken's`sub`,asthesectiononhowatokenfindsitsaccountexplains.##Caveats{.nostep}DisablingapersoninEntrastopsnewsign-insandenrollmentsandnothingmore.YourIGA'sSCIMdeactivationcutstheperson'srunningStrazasessionsandrefuseseverycheck-infromtheirmachinesuntilyourIGAreactivatesthem,soaleaverflowtriggersboth.WhileEntracannotsignanyonein,thebreak-glassadminstillsignsinthrough**Emergencysign-in**ontheconsole'ssign-incard,whichopensStraza'sownsign-inpage,andmintsatokentherewhenstrazactlisneeded.##Next{.nostep}-[Enrollamachine](https://docs.straza.ai/guides/govern-an-agent/enroll-a-machine/index.md)walkstheenrollmentandeveryrefusalitcanmeet.-[Oktalogin](https://docs.straza.ai/guides/connect-identity/okta-login/index.md)setsupthesamesign-inatOkta.-[Configuration](https://docs.straza.ai/reference/configuration/index.md)lists`oidc.loopbackPort`and`governance.minSignIn`withtheirdefaults. Walked on v1.0.0-1577-ged23b225-dirty on 2026-10-22, except every Entra step, which has not run against a real tenant. Not walked. The Entra steps follow Microsoft's documentation as read on 2026-10-22, and the Straza side follows the code of the working tree of the browser sign-in before its commit. No step ran against an Entra tenant. The console address step and the console's sign-in were written from the code on 2026-10-22 and not walked.