> ## Documentation Index
> Fetch the complete documentation index at: https://doc.quippy-lab.com/llms.txt
> Use this file to discover all available pages before exploring further.

# Microsoft Entra ID

> Configure Microsoft Entra ID (formerly Azure AD) as your Quippy identity provider.

Entra ID supports both OIDC and SAML. OIDC is the shortest path and the one
we recommend. Grab your **OIDC Redirect URL** (or **SAML ACS URL** and
**SAML Entity ID**) from the **Endpoints for your IdP** card in the Quippy
admin portal before you begin.

## 1. In Entra ID

<Tabs>
  <Tab title="OIDC (recommended)">
    1. In the Azure portal, open **Microsoft Entra ID → App registrations →
       New registration**.
    2. Name it "Quippy".
    3. **Supported account types** — "Accounts in this organizational directory
       only" (single-tenant) unless you have a specific reason otherwise.
    4. **Redirect URI** — platform **Web**, URL = the **OIDC Redirect URL**
       from Quippy.
    5. After creating the app, open **Certificates & secrets → New client
       secret**. Copy the **Value** immediately — Azure only shows it once.
    6. From the **Overview** page, copy:
       * **Application (client) ID**
       * **Directory (tenant) ID**

    <Frame>Entra ID — App registration Overview.</Frame>
  </Tab>

  <Tab title="SAML 2.0">
    1. **Microsoft Entra ID → Enterprise applications → New application → Create
       your own application**. Choose "Integrate any other application you
       don't find in the gallery".
    2. Under **Single sign-on**, choose **SAML**.
    3. In **Basic SAML Configuration**:
       * **Identifier (Entity ID)** — the **SAML Entity ID** from Quippy.
       * **Reply URL (ACS)** — the **SAML ACS URL** from Quippy.
    4. In **SAML Signing Certificate**, download **Certificate (Base64)**.
    5. Copy the **Login URL** and **Microsoft Entra Identifier** from the
       **Set up** section.
    6. Assign users or groups under **Users and groups**.
  </Tab>
</Tabs>

## 2. In Quippy

<Tabs>
  <Tab title="OIDC">
    | Quippy field      | Value from Entra                                     |
    | ----------------- | ---------------------------------------------------- |
    | **Issuer URL**    | `https://login.microsoftonline.com/<tenant-id>/v2.0` |
    | **Client ID**     | Application (client) ID                              |
    | **Client Secret** | The secret **Value** (not the Secret ID)             |

    Replace `<tenant-id>` with the Directory (tenant) ID you copied from the
    Overview page.
  </Tab>

  <Tab title="SAML 2.0">
    | Quippy field            | Value from Entra                                 |
    | ----------------------- | ------------------------------------------------ |
    | **IdP Entry Point**     | **Login URL** from the **Set up** section        |
    | **IdP Entity ID**       | **Microsoft Entra Identifier**                   |
    | **Signing Certificate** | The downloaded Base64 certificate, PEM-formatted |
    | **Signature Algorithm** | `SHA-256`                                        |
  </Tab>
</Tabs>

## 3. Test connection

Click **Test connection**. You should get a green confirmation; then enable
SSO. [Keep a backup admin](/sso/setup#step-5) until your first SSO sign-in
succeeds.

## Common gotchas

<AccordionGroup>
  <Accordion title="Pasted the Secret ID instead of the Secret Value">
    Entra shows two fields after creating a client secret — a **Secret ID**
    (a GUID, visible later) and the **Value** (the actual secret, shown
    **once**). Paste the **Value** into Quippy's **Client Secret** field.
  </Accordion>

  <Accordion title="Tenant mismatch in the issuer URL">
    The issuer URL must include your tenant ID — not `common` or
    `organizations` — or Quippy won't be able to validate the token
    signature against your tenant's keys.
  </Accordion>

  <Accordion title="Missing admin consent">
    If your tenant requires admin consent for new apps, click **Grant admin
    consent** on the app's **API permissions** page so sign-in doesn't prompt
    every user.
  </Accordion>
</AccordionGroup>