> ## Knowledge Base Index > Fetch the complete knowledge base index at: https://support.stacktrack.com/sitemap.xml > Use this file to discover available pages before exploring further. > Pure-Markdown content can be obtained by appending a '.md' suffix to the content URLs listed in the sitemap (without the trailing slash). # Stacktrack IAM Services and Microsoft EntraID(formerly Azure Active Directory) Integration Configuration Guide # This guide provides the technical procedure for integrating StackTrack Identity & Access Management Services with Microsoft EntraID. ||| As a security requirement, ensure all identifiers and secrets are handled according to your organization's sensitive data policies. ###### Step 1: Application Registration(In Azure Portal) The integration begins by establishing a service presence within the Microsoft Azure portal. Navigate to the **App Registration** blade to initiate the process. At this stage, the **Redirect URI** is not required for the initial handshake and can be added later during the post-registration configuration(**defined in Step 7**). To create the application object, click **Register**. Microsoft offers the following account types: We recommend using **single-tenant**; use **multi-tenant** only if required by your specific use case. We strongly **advise against enabling** personal Microsoft accounts. * **Single tenant only - Default Directory:** This option restricts access so that **only users within your specific organization's directory** (the tenant where the app is registered) can sign in to the application. This is typically used for internal line-of-business applications. * **Multiple Entra ID tenants:** This allows users from **any Microsoft Entra ID tenant** (any organization using Azure/Office 365) to sign in to the stacktack tenants(for example Jenkins). * **Any Entra ID Tenant + Personal Microsoft accounts:** This is the most inclusive option. It allows sign-ins from **any organizational Entra ID directory** as well as **personal Microsoft accounts** (such as those used for Xbox, Skype, or Outlook.com). This is used for applications intended for both professional and consumer audiences. ![](https://storage.crisp.chat/users/helpdesk/website/-/5/2/b/7/52b79f719eb25800/image_1h8tp3d.png) ![](https://storage.crisp.chat/users/helpdesk/website/-/5/2/b/7/52b79f719eb25800/image_1ca0ald.png) ###### Step 2: Generating Client Credentials(In Azure Portal) Secure communication between Stacktrack SSO and EntraID requires a client secret. 1. Navigate to the **Client Credentials** section. 2. Select **Add Client Credentials**. 3. Click **Add** to generate the secret. **Note from the Integration Specialist:** The **Client Secret** value keep it secure and safe ![](https://storage.crisp.chat/users/helpdesk/website/-/5/2/b/7/52b79f719eb25800/image_o8a612.png) Set the client secret expiration as per your orginisation standards. ![](https://storage.crisp.chat/users/helpdesk/website/-/5/2/b/7/52b79f719eb25800/image_shmtz.png) ###### Step-3: Vital Configuration Parameters(In Azure Portal) The following technical identifiers are required to uniquely identify your EntraID tenant and the specific application instance within the Stacktrack platform: * **Client ID: 44459728-2def-4d11-87ce-248fd3c6a02a** * **Client Secret: [The secret value generated and recorded in Step 2]** ![](https://storage.crisp.chat/users/helpdesk/website/-/5/2/b/7/52b79f719eb25800/image_vt8zff.png) ###### Step-4: Add Identity Provider(In Stacktrack SSO security admin console) **Navigate to Identity Providers and select OpenID Connect v1.0** Important settings: * Choose an alais. Remember this name can't be change once created. * Use dicovery endpoint from Azure application endpoints configuration. * Client ID and Client Secret from Step-3. * Default Scopes set to **openid profile email** * Review other defaults from below screenshots. ![](https://storage.crisp.chat/users/helpdesk/website/-/5/2/b/7/52b79f719eb25800/image_1va6avj.png) ![](https://storage.crisp.chat/users/helpdesk/website/-/5/2/b/7/52b79f719eb25800/image_x1uwfz.png) ![](https://storage.crisp.chat/users/helpdesk/website/-/5/2/b/7/52b79f719eb25800/image_1ubhqkl.png =800x385) ![](https://storage.crisp.chat/users/helpdesk/website/-/5/2/b/7/52b79f719eb25800/image_cp8atg.png) ###### Step 5: Groups Claim Configuration(In Azure portal) To authorize users based on their directory memberships, you must pass group information through the identity token. 1. Navigate to the token configuration settings and select **Add Groups Claim**. 2. Under the claim settings, specifically select **Groups**. 3. Click **Add** to finalize the inclusion of these claims in the SSO token. ![](https://storage.crisp.chat/users/helpdesk/website/-/5/2/b/7/52b79f719eb25800/image_15le77h.png) ![](https://storage.crisp.chat/users/helpdesk/website/-/5/2/b/7/52b79f719eb25800/image_7vgvvk.png) ![](https://storage.crisp.chat/users/helpdesk/website/-/5/2/b/7/52b79f719eb25800/image_1b6wooz.png) ![](https://storage.crisp.chat/users/helpdesk/website/-/5/2/b/7/52b79f719eb25800/image_ykpgx1.png) ###### Step 6: Mapper Configuration and Object ID Mapping(In Stacktrack SSO security admin console) Mappers are used to synchronize EntraID groups with the internal group structures of the Stacktrack platform. 1. Click **Add mappers** and select the option to create a **New Group**. 2. In the EntraID portal, navigate to the **Overview** blade of the specific security group you wish to sync. 3. **Copy the Object Id** for that group. The **Object Id** serves as the unique source anchor for the mapping(from Step-5). It must be pasted exactly into the Stacktrack configuration to ensure that directory objects are correctly resolved during the authentication flow. ![](https://storage.crisp.chat/users/helpdesk/website/-/5/2/b/7/52b79f719eb25800/image_fsbjvc.png) ![](https://storage.crisp.chat/users/helpdesk/website/-/5/2/b/7/52b79f719eb25800/image_lerxtx.png) ###### Step 7: Configure Redirect Uri(In Azure Portal) ``` App registrations └── (your application created in step-1) └── Authentication └── Add a platform └── WebThe Redirect URI copied from stacktrack SSO console ``` ![](https://storage.crisp.chat/users/helpdesk/website/-/5/2/b/7/52b79f719eb25800/image_d7i0cs.png) ![](https://storage.crisp.chat/users/helpdesk/website/-/5/2/b/7/52b79f719eb25800/image_v3zugo.png)