Skip to main content

Microsoft Entra ID

This short tutorial shows how to set up Flow's OIDC login provider with Microsoft Entra ID. Users from the Microsoft Entra ID tenant then should be able to log in Flow.

Prerequisites​

This tutorial assumes the following setup:

  • A provisioned Flow server with a valid licence and reachable web interface
  • Azure account with permissions to create an "App registration" within the Microsoft Entra ID tenant

Configuration​

  1. Sign in to the Microsoft Entra admin center and ensure you are in the tenant in which you want to register the Flow application.
  2. Browse to Entra ID > App registrations and select New registration.
  3. Enter a meaningful Name for the app. This is for your reference and users can see this name.
  4. Under Supported account types, select who can use the application. We recommend Single tenant only - <your tenant>.
  5. For Redirect URI select Web in the dropdown as platform (application type) and enter the correct redirect URI.
  6. Select Register to complete the app registration.
  7. Note down the Application (client) ID. You will need it later to configure Flow.
  8. Select Certificates & secrets > Client secrets > New client secret.
  9. Add a description for the secret for your internal reference.
  10. Select an expiration for the secret. You need to make sure that you issue a new secret and update it in the Flow configuration before it expires.
  11. Select Add.
  12. Record the client secret Value for configuration in Flow. This secret value is never displayed again after you leave the page.

If user consent for applications is disabled or restricted, an administrator must grant consent for the newly created application. Without this consent, users cannot log in to Flow and instead see a prompt indicating that administrator approval is required.

  1. Browse to Entra ID → Enterprise applications → All applications.
  2. Search for the Flow application you created and select it from the results.
  3. Under Security in the left-hand navigation, select Permissions.
  4. Select Grant admin consent. This opens a consent prompt listing all requested permissions.
  5. Select Accept to grant tenant-wide admin consent.

For reference also consult the official guides from Microsoft: