> For clean Markdown of any page, append .md to the page URL.
> For a complete documentation index, see https://docs.itential.com/llms.txt.
> For AI client integration (Claude Code, Cursor, etc.), connect to the MCP server at https://docs.itential.com/_mcp/server.

# Configure Azure AD

> How to configure the Azure AD server and set up adapter-azure_aaa for Itential Platform SSO over OpenID Connect.

The Azure adapter allows SSO (single sign-on) in Azure over the OpenID Connect (OIDC) protocol. Use this guide to configure the Azure AD server and set up `adapter-azure_aaa` for Itential Platform.

The information provided was developed in a lab environment. Input for various settings and fields should be populated with details specific to your production environment.

This page outlines the process and permissions required for the Azure AAA adapter to communicate with the Azure AD system.

Admin privileges in the Azure AD system are required to perform the initial setup.

## Create a new application

#### Open App Registration

Log in to the Azure AD system and access the Azure AD page. Select the **App Registration** section and click **New registration**.

Create a separate application for each environment so that passwords and configurations are unique to each environment.

![](/_fern-img/1d9985e5fbfe34532ac6941cf50c971dd7f3ddf3d9f122314efae690d345abce.webp)

#### Complete the application fields

Fill in the registration form. For example:

* **Name**: `Itential Automation Platform - Production`
* **Supported Account Types**: Default
* **Redirect URI**: Leave blank; you will update it later.

Click **Register**.

#### Record the Application ID and Tenant ID

Review the application details. Record the **Application ID** — it will be used by the adapter as the `client id`. Record the **Tenant ID** — it will be used by the adapter as the `tenant id`.

![](/_fern-img/1f1ef09c7f12507c670c67803091a5c074977697ba290abb20822f76ad146a29.webp)

## Configure authentication settings

#### Set redirect URIs

Go to the **Authentication** section. Verify the Redirect URIs. These are the acceptable return URIs after authentication. If a redirect is attempted to a URI that does not exist here, the redirect will fail. Pay close attention to ports — you must have a URI for each port.

Typically the URL is the same as the sign-on URL, or a sign-on URL with a specific SSO page. For example:

* `https://itential.customer.com/login`
* `https://localhost:3443/login`

![](/_fern-img/f4f9a9f45680d66968f90f26b5066876fe673f717a17d5189676b01172e05d78.webp)

#### Enable ID tokens

Enable the ID tokens under **Advanced settings**.

![](/_fern-img/cf254d4db0cc7b1bba313b22967ab7ca621bfc613412941a4a83cd1e476d1777.webp)

## Set application permissions

#### Add API permissions

Go to the **API Permissions** section. Click **+ Add a permission**. Find and select **Microsoft Graph API** from the list.

#### Select required permissions

From the list of **Application Permissions**, check the following:

* `Directory.Read.All`
* `Group.Read.All`
* `User.Read.All`

No delegated permissions are required. Click **Add Permission**.

![](/_fern-img/23c392632d148ea4e134c922a3e338f1eb179c7d68984e70c7c055c2ec2147ed.webp)

#### Grant admin consent

Click **Grant admin consent** and then click **Yes**.

## Set the API key

#### Create a new password

Go to **Settings > Keys** and create a new password by completing the following fields:

* **Description**: `IAP API Key`
* **Expires**: `Never`
* **Value**: `<super_secret_password>`

![](/_fern-img/7ce183ed448f0aad418a73dcc97e4e480ea6cc80d845538e751e82bf7b86ae71.webp)

Expiration policies vary across organizations. Follow the guidelines for your organization.

#### Save the value

Click **Add**. A warning message displays reminding you to keep a safe copy of the **Value**, which has been encrypted. This value is used in the `secret` field by the Azure AAA adapter.

![](/_fern-img/dcca50ce24b482e70c8998d4153c9c5899677cdf5cac96435c5c00e280901cd8.webp)

## Add optional claims (Access Token v2.0)

If you have configured your registered application **Manifest** to use `accessAcceptedTokenVersion: 2`, you must create an optional claim for `upn` on your ID tokens and access tokens. The `upn` claim is used by the Azure adapter internally to handle account routing in Itential Platform and is required.

![](/_fern-img/7fbed729ded0a73618f9aa7d47e98681cce8b0b41bb48eb7c07a2959e09449e8.webp)![](/_fern-img/65be4ad77f9b85a41021e4935ab8698567c8dd4f824c65d7125941c8770d1a9b.webp)