Microsoft Entra ID
Connect Microsoft Entra ID (formerly Azure AD) as your SSO identity provider.
Microsoft Entra ID sign-in uses an app registration in your tenant. Only people in that tenant can sign in through it.
Register the app in Entra
- In the Microsoft Entra admin center, go to App registrations and click New registration.
- Name: for example
ArmorIQ. - Supported account types: Accounts in this organizational directory only (Single tenant).
- Redirect URI: platform Web, with the Redirect URI shown on the ArmorIQ setup page:
https://sso.armoriq.ai/callback- Click Register. On the app's Overview, copy the Application (client) ID and the Directory (tenant) ID.
- Go to Certificates & secrets → Client secrets and click New client secret. Choose an expiry and click Add.
- Copy the secret's Value right away. Entra only shows it once. Do not copy the Secret ID.
Client secrets in Entra expire. Note the expiry date and update the secret in ArmorIQ before it expires, or SSO sign-in stops working.
The app needs Microsoft Graph's User.Read permission, which new registrations include by default. If your tenant requires admin consent for apps, grant it under API permissions.
Connect it in ArmorIQ
- In Settings → Single sign-on, under Identity provider, choose Microsoft Entra ID.
- Directory (tenant) ID: paste the tenant ID. It looks like
00000000-0000-0000-0000-000000000000. - Client ID: paste the Application (client) ID.
- Client secret: paste the secret's value.
- Name on the sign-in page (optional): for example
Acme Microsoft. - Click Save connection.
ArmorIQ signs people in by their Entra sign-in name (user principal name). It must be on one of your verified domains: jane@acme.com works when acme.com is verified, but jane@acme.onmicrosoft.com does not.
Rotate the client secret
Create a new client secret in Entra, then in ArmorIQ paste it into Client secret and click Save connection. Saving turns SSO off until a new test sign-in passes, so run the test and turn SSO back on straight away.