SSO: OIDC with EntraID

Prerequisites

Before you begin, ensure you have admin access to your EntraID dashboard.

Step 1: Set Up an Application for Control D

1. Log in to your Azure Portal.

2. Navigate to App registrations and click New Registration.

3. Fill in the application details:

   Field	Data
   App Integration Name	Control D
   Logo (Optional)
   Redirect URI	https://controld.com/sso/callback?provider=microsoft
   Redirect URI Platform	Web

   
   

Step 2: Configure client credentials

1. Open the newly created Control D application in App Registrations.

2. Go to the Certificates & secrets tab then to Client Secrets and click New Client Secret.

3. Add the name Control D and click Add

4. Copy the new secrets Value property and store securely, you will need it in later steps.

Step 3: Collect Application details

1. Navigate to the Control D application overview page. App registrations, then Control D

2. Note the Application (client) ID and Directory (tenant) ID values.

Step 4: Create and Assign User Groups

Note: Control D supports the default controld-* and ControlD.* groups, or you can use custom group names. If you use custom names, create one group for each Control D role and enter all three names in the Owner Group, Admin Group, and Viewer Group fields in Step 6.

1. Go to Groups > New Group from your Microsoft portal home screen.

2. Create three groups for Control D access. The default names are:

   • controld-admin or ControlD.Admin
   • controld-owner or ControlD.Owner
   • controld-viewer or ControlD.Viewer

3. Assign users to these groups based on their roles and responsibilities within Control D.

❗️

Learn about the different roles and permission levels here: https://docs.controld.com/docs/org-members-permissions#permission-levels

Step 5: Set Application Group Claim

1. Navigate to App registrations, select Control D then API Permissions
2. Click Add Permission
3. Select Microsoft Graph then Delegated Permissions
4. Search for Group
5. Select Group.Read.All then click Add Permission
6. You will now need to grant admin consent by selecting the new Group.Read.All permission from the list, then click Grant Admin Consent next to the Add Permission button.
7. Click to Yes in the dialog popup to confirm Admin consent

Step 6: Add SSO Configuration in Control D

1. Log in to the Control D.

2. Navigate to My Organization, scroll to SSO Provider, and select Microsoft.

3. Fill in the required fields:

   • Microsoft Tenant ID: The value from previous steps
   • Client ID: The value you copied from the application.
   • Client Secret: The value you copied from the application client secrets tab.
   • Email Domains: Enter the domains associated with your organization, e.g., example.com. This is necessary to map email domains to your Control D customer account so that login attempts are redirected to the correct Microsoft tenant authentication server.
   • Owner Group, Admin Group, and Viewer Group: To use custom group mappings, enter the corresponding Entra ID group display name in all three fields. When adding SSO without a custom mapping, leave all three fields blank to use the default Control D group names.

4. Click Save to enable EntraID SSO for your organization.

Step 7: Test SSO Login

1. Log out of Control D and navigate to the login page.
2. Enter your Microsoft Organizations email address, leaving the password blank.
3. Click the Log in with SSO button.
4. You will be prompted to login to your Microsoft account.
5. Verify role-based access permissions by testing users in each of the three configured groups.

Troubleshooting

If you encounter any issues:

1. Verify the Redirect URI in your App Registration settings.
2. Ensure the user groups are correctly assigned in the Microsoft panel.
3. Check the SSO configuration in the Control D Admin Panel for typos or missing fields.
4. Refer to the Microsoft logs for debugging SSO errors.

For additional support, contact Control D Support.