Sign in with Microsoft
How to register Curupira in Microsoft Entra ID (formerly Azure AD) so your tenant's users can sign in with a Microsoft account.
Portal: portal.azure.com → Microsoft Entra ID → App registrations → New registration.
| Curupira detail | Value |
|---|---|
| Type | OpenID Connect (signed id_token, verified) |
| Callback URL to register | https://auth.curupira.api.br/sso/microsoft/callback |
| Default scopes | openid email profile |
1 · Register the application
App registrations → New registration.
| Field | What to put |
|---|---|
| Name | Your app's name |
| Supported account types | Pick deliberately — this drives the token issuer: single-tenant (only your org), multitenant, or multitenant + personal accounts |
| Redirect URI | Platform Web → https://auth.curupira.api.br/sso/microsoft/callback |
Register. Then copy the Application (client) ID and note the Directory (tenant) ID from the Overview page.
2 · Create a client secret
Certificates & secrets → Client secrets → New client secret. Add a description and expiry, then
copy the Value immediately — Microsoft shows it only once (copy the Value, not the
Secret ID).
3 · API permissions
API permissions → Add a permission → Microsoft Graph → Delegated permissions. Add openid,
email, profile, User.Read, then Grant admin consent for your org.
4 · Enterprise (single-tenant) vs consumer
"Supported account types" (step 1) drives the id_token issuer:
- Single-tenant (recommended for one organization): when you create the connection, provide your
Directory (tenant) ID so the issuer is pinned to your org — nobody outside it can sign in. For
a strict, org-locked enterprise connection, use the dedicated
microsoft-entraprovider, which templates the issuer to your tenant and supports an allowed-organizations restriction. - Multitenant /
common: any Microsoft organization (and personal accounts, if you enabled them) can sign in. There is no single static issuer to pin, so use this only if you intend broad access.
:::warning Email claim
Entra doesn't always emit an email claim. For work/school accounts, Entra includes email only
when the user's mail attribute is set. If your users have no mailbox, add email as an
optional claim (App registration → Token configuration → Add optional claim → ID → email) and
ensure the mail attribute is populated — otherwise there's no email to sign in with. If Microsoft
logins are refused for a missing/unverified email, contact your Curupira administrator.
:::
5 · Add the connection in Curupira
In the admin dashboard → SSO Connections, choose your tenant and Add SSO Connection:
- Provider: Microsoft (or Microsoft (Entra) for a strict single-tenant enterprise connection)
- Client ID: the Application (client) ID from step 1
- Client Secret: the secret Value from step 2 (stored encrypted, never shown again)
- Scopes: leave blank to use the defaults (
openid email profile) - Enabled: on
- For single-tenant / Entra: also provide your Directory (tenant) ID for the strict issuer
Then test at https://auth.curupira.api.br/sso/microsoft/authorize?tenant=<your-tenant-slug>.
:::note Account linking If Microsoft returns an email that matches an existing password account, sign-in is refused — sign in with your password first, then connect SSO from your account settings. A brand-new email creates an SSO-only user automatically. :::
Checklist
- App registered; Supported account types chosen deliberately
- Redirect URI (Web)
https://auth.curupira.api.br/sso/microsoft/callback(exact) - Client secret Value copied (not the Secret ID)
- Delegated Graph permissions
openid email profile User.Read+ admin consent granted - Tenant ID noted for a single-tenant / Entra connection
-
emailoptional claim added if users are managed accounts without a mail attribute - Entered in SSO Connections