---
title: "Setting Up Microsoft Entra ID for SSO in Express View (OIDC)"
slug: "setting-up-microsoft-entra-id-for-sso-in-express-view-oidc"
updated: 2025-09-25T20:36:40Z
published: 2025-09-25T20:36:40Z
canonical: "docs.unqork.io/setting-up-microsoft-entra-id-for-sso-in-express-view-oidc"
---

> ## Documentation Index
> Fetch the complete documentation index at: https://docs.unqork.io/llms.txt
> Use this file to discover all available pages before exploring further.

# Setting Up Microsoft Entra ID for SSO in Express View (OIDC)

## Overview

In this article, you'll learn how to use Microsoft Entra ID as an SSO (single sign-on) provider, using the OIDC (OpenID Connect) authentication method. Microsoft Entra ID acts as the OP (OpenID Provider) and Unqork is the RP (Relying Party). You'll set up your OIDC configuration on Unqork's Single Sign-On (SSO) Management page.

You can set up SSO configurations for:

- **Express View** **access**: For authentication into the front-end of an application in your environment.
- **Designer access**: For authentication in your Unqork environment, known as Designer.

This article shows you how to set up a OIDC configuration using Microsoft Entra ID as the SSO provider in Express View.

> To connect Microsoft Entra ID to your Unqork application as an SSO provider, your Microsoft Entra ID administrator needs to set up your application as a new app registration in Microsoft Entra ID. To learn more, see Microsoft Entra ID's **Quickstart: Register an application with the Microsoft identity platform** article here: [https://docs.microsoft.com/en-us/azure/active-directory/develop/quickstart-register-app](https://docs.microsoft.com/en-us/azure/active-directory/develop/quickstart-register-app).

## How Settings Map Between Microsoft Entra ID and Unqork

In the following table and images, you can see how key OIDC configuration settings in Microsoft Entra ID map to the OIDC configuration fields in Unqork.

| # | Unqork Setting | Related Microsoft Entra ID Setting |
| --- | --- | --- |
| 1 | OIDC OP Discover URL/Issuer | Microsoft Entra ID OpenID Connect Metadata Document |
| 2 | OIDC OP Client ID | Application (Client) ID |
| 3 | OIDC OP Client Secret | Client Secret (Value) |
| 4 | Redirect URI | Redirect URI |

![](https://cdn.us.document360.io/15548f06-2fba-434c-b0c1-5df88317dbd7/Images/Documentation/O01007B_Azure-AS-SSO-OIDC-Express_thumb_0_0.jpg?sv=2026-02-06&spr=https&st=2026-11-11T02%3A55%3A44Z&se=2026-11-11T03%3A55%3A44Z&sr=c&sp=r&sig=vTsW%2FbPwZhsbgpVvGxSZ%2F0plS3yJwrxQ2TiGwDppzEc%3D)

![](https://cdn.us.document360.io/15548f06-2fba-434c-b0c1-5df88317dbd7/Images/Documentation/sso_azure_unqorkOidcSide_02_thumb_0_0.jpg?sv=2026-02-06&spr=https&st=2026-11-11T02%3A55%3A44Z&se=2026-11-11T03%3A55%3A44Z&sr=c&sp=r&sig=vTsW%2FbPwZhsbgpVvGxSZ%2F0plS3yJwrxQ2TiGwDppzEc%3D)

![](https://cdn.us.document360.io/15548f06-2fba-434c-b0c1-5df88317dbd7/Images/Documentation/sso_azureAd_settingMappings_OIDC2_thumb_0_0.jpg?sv=2026-02-06&spr=https&st=2026-11-11T02%3A55%3A44Z&se=2026-11-11T03%3A55%3A44Z&sr=c&sp=r&sig=vTsW%2FbPwZhsbgpVvGxSZ%2F0plS3yJwrxQ2TiGwDppzEc%3D)

## Setting Up Microsoft Entra ID as an OIDC Configuration in Environment Administration

This is a step-by-step walkthrough of how to set up Microsoft Entra ID as an OIDC configuration. This is one example of how you might configure Microsoft Entra ID for SSO in Express View. This approach ensures Microsoft Entra ID is the single source of truth for your end-user's permissions.

> To learn more about all the OIDC configuration settings in Environment Administration, visit our [OpenID Connect (OIDC)](/v1/docs/openid-connect-oidc) article. To learn more about using the Single Sign-On (SSO) Management dashboard, view our [Single Sign-On (SSO) Management](/v1/docs/single-sign-on-ssomanagement) article.

### What You Need

For this sample configuration, you need the following information:

- The OpenID Connect Metadata Document.
- The Application (Client) ID.
- The Client Secret.
- A list of scopes to request access to.
- A list of claims to map to Unqork attributes.

> [!NOTE]
> Specific values for each setting vary based on your use case. Work with the Microsoft Entra ID administrator to ensure both sides are clear on what information your application needs to access.

To add an OIDC configuration to your environment:

### Start the Configuration

1. At the top right of the Unqork Designer Platform, click the **Settings** drop-down.
2. Click **Administration**.
3. Under Environment, select **Single Sign-On (SSO)**.
4. Click **+ New SSO**.
5. From the + New SSO drop-down, select **Express**.

### Basic Information Tab

The Basic Information tab is the first tab you see when the New Express SSO configuration modal opens. In this tab, you name your configuration and assign end-user permissions.

To add basic information to your OIDC configuration:

1. In the **SSO Name** field, enter a unique name for your configuration.
2. From the **Default Role** drop-down, select a role.

> [!NOTE]
> When setting up SSO for Express View, select a default role with the lowest-level permissions. This lets you rely on the value stored in Microsoft Entra ID to determine higher-level permissions.
3. From the **Default Groups** list, select one or more groups.

> [!NOTE]
> Adding Default Groups is optional. By default, no groups are selected.
4. Click **Next**.

You progress from the Basic Information tab to the Configure Protocol tab.

### Configure Protocol Tab

Now, select the OIDC protocol from the Configure Protocol tab and set up the OIDC configuration. These settings are fairly standard and tend to have predictable values regardless of your use case. However, be mindful of listing the appropriate scopes to give you access to the necessary claims in the JWT.

1. Select **OIDC** as the **Protocol**.
2. In the **OP Discovery URL / Issuer** field, enter https://<host>/oauth2/default/.well-known/openid-configuration .
3. In the **OP Discovery URL / Issuer** field, replace <host> with your Microsoft Entra ID Domain.
4. In the **OP Client ID** field, enter your Client ID.
5. In the **OP Client Secret** field, enter your Client Secret.
6. From the **Scope** field, select or enter a scope. If the scope you want isn't in the default drop-down, type the scope in the **Scope** field and press **Enter/Return** or select **Create {scope name}**. You can add as many scopes as you want.

> [!NOTE]
> The default scope value is openid. But, it's best practice to still select openid in the Scope field.

> [!TIP]
> The profile scope typically acts as the Microsoft Entra ID profile, and contains associated key information. By default, the profile scope contains basic information about the user. But, the profile scope can include a more complex list of custom claims as well.
7. In the **Redirect URI** field, enter your environment-specific Redirect URI. In most cases, your value looks like this: https://<host>/auth/oidc/<OIDCname>/cb, where <host> is the domain of your environment and <OIDCname> is the name of your OIDC configuration.

> [!NOTE]
> The Redirect URI in Unqork must match the Sign-In Redirect URI in Microsoft Entra ID

> [!TIP]
> Be sure to use the Express View-specific host value. For example unqork-uat**x**.unqork.io, not unqork-uat.unqork.io.
8. Click **Next**.

You progress from the Configure Protocol tab to the Attribute Mapping tab.

> [!NOTE]
> The Configure Protocol tab has several advanced settings you can enable. To access these settings, click **Show Advanced Settings**. Whether or not you need to adjust these settings depends on your use case. For this Microsoft Entra ID configuration, using any Advanced Settings is not required. Visit the [OpenID Connect (OIDC)](/v1/docs/openid-connect-oidc) article for more information.

### Attribute Mapping Tab

Next, map claims in the JWT sent by the OP to Unqork attributes in the session's currentUser object. For example, mapping the OP-provided email address to the Unqork attribute email.

> You can create dynamic, conditional, or static attribute mappings. See the **Creating Attribute Mappings** section in our [OpenID Connect (OIDC)](/v1/docs/openid-connect-oidc) article for more information and detailed examples.

To add an attribute mapping:

> [!CAUTION]
> By default, the Attribute Mapping tab includes the mapping **{{sub}}** to **userId**. Do not delete this mapping or your SSO configuration can fail.

1. Click **+ Add Attribute Mapping**.
2. Complete the **OIDC Claim** side of the mapping.
3. From the **Unqork Attribute** drop-down, select a default Unqork attribute. Or, enter the attribute's name in the **Unqork Attribute** field then press **Enter/Return** or select **Create {scope name}**.
4. Repeat the above steps as needed.

#### User Management

These user management settings are more variable and highly dependent on your unique use case. However, in this configuration Microsoft Entra ID is the single source of truth for authentication. This means the user doesn't need to exist in Unqork, as Unqork isn't acting as the user management system. So, consider the following settings:

1. Click **Show User Management**.
2. Verify **Disable New User Creation** is selected.
3. Click **Create SSO**.

> [!NOTE]
> Verify the SSO configuration in Environment Administration matches the SSO configuration in Single Sign-On (SSO) Management. If you are encountering issues, visit the [Troubleshooting Tips](/v1/docs/setting-up-microsoft-entra-id-for-sso-in-express-view-oidc#troubleshooting-tips) section below.

Your SSO configuration is now complete. The configuration modal closes and returns your focus to the Single Sign-On (SSO) Management dashboard.

## Testing Your Configuration

You're ready to test your configuration.

> [!NOTE]
> You need a set of test credentials from the Microsoft Entra ID administrator. The test user must be assigned to the Enterprise Application linked to your app registration in Microsoft Entra ID, on the Users and Groups page.

1. At the top right of the Unqork Designer Platform, click the **Settings** drop-down.
2. Click **Administration**.
3. Under Environment, select **Single Sign-On (SSO)**.
4. In the SSO dashboard, find the SSO configuration to preview.
5. Under the Actions column, click **Manage**.
6. From the Manage drop-down, right-click **Preview**.
7. Click **Open Link in Incognito Window**.
8. Open a new Incognito window of your browser.
9. Paste the Unqork entrypoint URL into the browser.

> [!TIP]
> By default, the Unqork entrypoint URL uses 123 as the module ID. To test access to an actual module in your application, replace 123 at the end of the URL with your module's module ID.
10. Log in using your test credentials.

If you see an error page, there are issues with your configuration. If you can successfully log in to Unqork, your OIDC configuration of Microsoft Entra ID as SSO provider is complete.

### Troubleshooting Tips

Understanding what's causing an error is one of the most frustrating parts of creating a new configuration. One of the most common sources of error is not using the Express View-specific host value in the **OIDC Redirect URI** field.