> ## Documentation Index
> Fetch the complete documentation index at: https://docs.iru.com/llms.txt
> Use this file to discover all available pages before exploring further.

# Microsoft Entra ID

> Let users sign in to Iru Identity with their Microsoft Entra ID accounts using the built-in connection template for federated authentication and provisioning.

Connecting **Microsoft Entra ID** lets your users sign in to Iru (and reach the
apps you have assigned them) using the Microsoft accounts they already have. Iru
provides a **Microsoft Entra ID template** that pre-fills the standard
configuration, so this is one of the quickest providers to connect.

<Info>
  Most organizations that use Iru Identity as their identity provider have users
  sign in directly with a passkey or the Iru Access app. Connect Microsoft Entra
  ID when you use Iru Identity as an authentication layer into the Iru platform
  rather than your primary identity provider, or to ease a migration onto Iru
  Identity. See [Federated Authentication](/en/identity/connections/connections-overview).
</Info>

<Note>
  You need administrator access to your Iru tenant, and access to your Microsoft
  Entra ID administrator portal, to complete this connection.
</Note>

## Before you begin

<Steps>
  <Step title="Register an application in Microsoft Entra ID">
    In the Microsoft Entra admin center, **register an application** for Iru. Add
    the **redirect URI** Iru shows for this connection as a Web redirect URI,
    create a **client secret**, and grant the standard sign-in permissions
    (`openid`, `profile`, `email`, and `User.Read`), granting admin consent if
    your tenant requires it. Note the application's **client ID** and **client
    secret** and your Entra ID **domain** (for example, `contoso.onmicrosoft.com`)
    to enter into Iru. Microsoft's portal can change; follow Microsoft's current
    documentation if the steps differ.
  </Step>

  <Step title="Confirm your sign-in domains">
    Note the email **domains** your users sign in with. You can restrict the
    connection to these domains so only users in them use it.
  </Step>

  <Step title="Make sure your users exist in Iru">
    Sign-in through a connection resolves to an existing Iru user. Add or import
    your users first; see [Importing users](/en/identity/directory/importing-users)
    or [Directory Sync](/en/identity/directory/directory-sync).
  </Step>
</Steps>

## Connect Microsoft Entra ID

<Steps>
  <Step title="Add the connection">
    In **Access → Authentication**, add an **authentication method** and choose the
    **Microsoft Entra ID** template. Using the template fills in the standard
    settings for you.
  </Step>

  <Step title="Enter your Entra ID details">
    Provide your Microsoft Entra ID **domain**, the **client ID**, and the
    **client secret** from the application you registered. Iru uses these to
    establish trust with your Entra ID tenant.
  </Step>

  <Step title="Choose what the connection is used for">
    Select the connection's **use cases**: **end-user sign-in**, **device
    enrollment**, or both. Most setups enable end-user sign-in.
  </Step>

  <Step title="Restrict to your domains">
    If you want only users in specific email domains to use this connection,
    enable **domain restrictions** and add those domains.
  </Step>

  <Step title="Set user matching">
    Choose how Iru matches a Microsoft sign-in to an Iru user (by UPN, username,
    external ID, or a custom attribute). Pick a value that is unique and stable
    for every user.
  </Step>

  <Step title="Save the connection">
    Save, then sign in as a test user whose email is in an allowed domain to
    confirm the hand-off to Microsoft works end to end.
  </Step>
</Steps>

<Warning>
  If you intend to use this connection for **device enrollment**, you may need to
  enable **domain restrictions** first. Configure your domains before turning on
  the device enrollment use case.
</Warning>

<Tip>
  Test with a single user before rolling the connection out broadly. If sign-in
  fails to land on the right user, revisit your **user matching** choice; the
  matched value must be present and unique for everyone who uses the connection.
</Tip>

## How sign-in works once connected

When someone signs in, Iru hands the sign-in off to Microsoft Entra ID, Entra ID
confirms the user, and Iru continues the session before evaluating the app's
[authentication policy](/en/identity/authentication/authentication-policies)
before granting access. For the full picture, see
[System architecture](/en/identity/getting-started/system-architecture).

## Related

<CardGroup cols={2}>
  <Card title="Federated Authentication" icon="plug" href="/en/identity/connections/connections-overview">
    Use cases, domain restrictions, and user matching, explained in one place.
  </Card>

  <Card title="Google Workspace" icon="google" href="/en/identity/connections/google-workspace">
    Connect Google Workspace for sign-in with its own template.
  </Card>

  <Card title="Sign-in experience" icon="arrow-right-to-bracket" href="/en/identity/authentication/sign-in-experience">
    Shape what users see when they sign in.
  </Card>

  <Card title="Custom OIDC" icon="key" href="/en/identity/connections/custom-oidc">
    Connect an OpenID Connect provider that is not covered by a template.
  </Card>
</CardGroup>