> ## Documentation Index
> Fetch the complete documentation index at: https://docs.iru.com/llms.txt
> Use this file to discover all available pages before exploring further.

# Microsoft Entra ID

> Let people sign in to Iru Identity with their Microsoft Entra ID accounts using the built-in connection template for federated authentication and provisioning.

Connecting **Microsoft Entra ID** lets your people sign in to Iru - and reach the
apps you have assigned them - using the Microsoft accounts they already have. Iru
provides a **Microsoft Entra ID template** that pre-fills the standard
configuration, so this is one of the quickest providers to connect.

<Info>
  Most organizations that use Iru Identity as their identity provider have people
  sign in directly with a passkey or the Iru Access app. Connect Microsoft Entra
  ID when you use Iru Identity as an authentication layer into the Iru platform
  rather than your primary identity provider, or to ease a migration onto Iru
  Identity. See [Federated Authentication](/en/identity/connections/connections-overview).
</Info>

<Note>
  You need administrator access to your Iru tenant, and access to your Microsoft
  Entra ID administrator portal, to complete this connection.
</Note>

## Before you begin

<Steps>
  <Step title="Register an application in Microsoft Entra ID">
    In the Microsoft Entra admin center, **register an application** for Iru. Add
    the **redirect URI** Iru shows for this connection as a Web redirect URI,
    create a **client secret**, and grant the standard sign-in permissions
    (`openid`, `profile`, `email`, and `User.Read`) - granting admin consent if
    your tenant requires it. Note the application's **client ID** and **client
    secret** and your Entra ID **domain** (for example, `contoso.onmicrosoft.com`)
    to enter into Iru. Microsoft's portal can change - follow Microsoft's current
    documentation if the steps differ.
  </Step>

  <Step title="Confirm your sign-in domains">
    Note the email **domains** your people sign in with. You can restrict the
    connection to these domains so only people in them use it.
  </Step>

  <Step title="Make sure your people exist in Iru">
    Sign-in through a connection resolves to an existing Iru user. Add or import
    your people first - see [Importing users](/en/identity/directory/importing-users)
    or [Directory Sync](/en/identity/directory/directory-sync).
  </Step>
</Steps>

## Connect Microsoft Entra ID

<Steps>
  <Step title="Add the connection" icon="plus">
    In **Access → Authentication**, add an **authentication method** and choose the
    **Microsoft Entra ID** template. Using the template fills in the standard
    settings for you.
  </Step>

  <Step title="Enter your Entra ID details" icon="microsoft">
    Provide your Microsoft Entra ID **domain**, the **client ID**, and the
    **client secret** from the application you registered. Iru uses these to
    establish trust with your Entra ID tenant.
  </Step>

  <Step title="Choose what the connection is used for" icon="list-check">
    Select the connection's **use cases** - **end-user sign-in**, **device
    enrollment**, or both. Most setups enable end-user sign-in.
  </Step>

  <Step title="Restrict to your domains" icon="at">
    If you want only people in specific email domains to use this connection,
    enable **domain restrictions** and add those domains.
  </Step>

  <Step title="Set user matching" icon="user-check">
    Choose how Iru matches a Microsoft sign-in to an Iru user - by UPN, username,
    external ID, or a custom attribute. Pick a value that is unique and stable
    for every person.
  </Step>

  <Step title="Save the connection" icon="circle-check">
    Save, then sign in as a test user whose email is in an allowed domain to
    confirm the hand-off to Microsoft works end to end.
  </Step>
</Steps>

<Warning>
  If you intend to use this connection for **device enrollment**, you may need to
  enable **domain restrictions** first. Configure your domains before turning on
  the device enrollment use case.
</Warning>

<Tip>
  Test with a single user before rolling the connection out broadly. If sign-in
  fails to land on the right person, revisit your **user matching** choice - the
  matched value must be present and unique for everyone who uses the connection.
</Tip>

## How sign-in works once connected

When someone signs in, Iru hands the sign-in off to Microsoft Entra ID, Entra ID
confirms the person, and Iru continues the session - then evaluates the app's
[authentication policy](/en/identity/authentication/authentication-policies)
before granting access. For the full picture, see
[System architecture](/en/identity/getting-started/system-architecture).

## Related

<CardGroup cols={2}>
  <Card title="Federated Authentication" icon="plug" href="/en/identity/connections/connections-overview">
    Use cases, domain restrictions, and user matching, explained in one place.
  </Card>

  <Card title="Google Workspace" icon="google" href="/en/identity/connections/google-workspace">
    Connect Google Workspace for sign-in with its own template.
  </Card>

  <Card title="Sign-in experience" icon="arrow-right-to-bracket" href="/en/identity/authentication/sign-in-experience">
    Shape what people see when they sign in.
  </Card>

  <Card title="Custom OIDC" icon="key" href="/en/identity/connections/custom-oidc">
    Connect an OpenID Connect provider that is not covered by a template.
  </Card>
</CardGroup>