This guide walks you through the process of configuring Single Sign-On (SSO) between Microsoft Azure Active Directory (Azure AD) and Keycloak using the OpenID Connect (OIDC) protocol.
⚠️ To complete this setup, you must have permissions to create and manage enterprise applications in Azure AD.
Step-by-Step Instructions
Sign in to Microsoft Azure
Go to https://portal.azure.com and sign in with an account that has the necessary admin permissions.
Navigate to Microsoft Entra ID.
Click on Enterprise Applications on the side menu.
1. Create a New Application
Click + New application at the top of the page.
2. Register a Custom Application
Select Create your own application
Choose Register an application to integrate with Microsoft Entra ID (App you're developing)
3. Configure Application Settings
Name: Provide a descriptive name for the application.
Supported account types: Select Accounts in any organizational directory (Any Microsoft Entra ID tenant - Multitenant)
Redirect URI:
https://keycloak.{ENVIRONMENT_NAME}.corti.live/realms/{ENVIRONMENT_NAME}/broker/oidc/endpoint
⚠️ The redirect URI will be provided to you by Corti. You can leave this field blank for now if it's not yet available.
4. Save Application Details
After registration, go to the app’s Overview and copy the following values:
Application (client) ID
Directory (tenant) ID
5. Configure API Permissions
Click on Single sign-on, then select Go to application
Navigate to API permissions
Click + Add a permission
Select Microsoft Graph → Delegated permissions
Add the following scopes:
emailopenidprofile
Click Add permissions, then Grant admin consent
6. Generate a Client Secret
Go to Certificates & secrets
Click + New client secret
Add a description and select an expiration period
⚠️ If the secret expires, SSO will break and the secret must be updated manually. For simplicity, we recommend selecting no expiration.
Copy the client secret immediately after it's created — you won't be able to retrieve it again later.
7. Share Credentials with Corti
Send Corti the following information:
Application (Client) ID
Client Secret