Set up SSO with Microsoft Entra ID

This page covers the Entra half of an SSO connection. The Bird half (verifying a domain, testing, activating, and requiring SSO) is the same for every provider and lives on SSO and provisioning.

Entra and Bird each need values from the other, so where you start depends on the protocol. Keep both open as you work.

Start in Bird for SAML. A SAML connection's Entity ID and Assertion Consumer Service URL derive from the connection itself, so create it with I have not set up my provider yet, register the values it then shows, and come back to Supply the details. Setting up SAML without placeholder values walks through that flow.

Entra's field names do not match Bird's:

Whether you fill in Sign on URL decides how the My Apps tile behaves. Set it, and the tile starts the sign-in at Bird, which then asks Entra for an assertion. Leave it empty, and the tile posts an assertion to Bird unprompted. Bird accepts both, provided the connection allows identity-provider-initiated sign-in.

Entra's federation metadata advertises no NameID format at all. Bird reads the format from metadata where a provider publishes one, so an Entra connection is keyed on a permanent identifier by default, and the first test then fails because the format Entra actually sends does not match.

Open Edit on the connection and set Identify members by to the member's email address before you run the first test. In Entra, set the Unique User Identifier (Name ID) claim to user.mail, with the name identifier format set to Email address.

Okta and Google both advertise a format, so this step is specific to Entra.

Leave Sign SAML response off, so Entra signs the assertion rather than the response around it. With response signing on, the assertion inside is unsigned and Bird refuses every sign-in with a signature error that reads like a certificate problem.

Entra signs assertions valid from five minutes before issue until 60 minutes after, a wider window than Okta's or Google's, which Bird accepts.

Rotate with an overlap. Add the new certificate to the Bird connection while it still holds the old one, activate the new certificate in Entra, then remove the old one from Bird. Dropping the old certificate before Entra has activated the new one refuses every sign-in until the two agree.

Entra client secrets and signing certificates both expire. Note the dates and plan the replacement; a sign-in through an expired credential fails on the day.

Start in the Entra portal for OIDC. Bird needs the issuer, client ID and client secret to create an OIDC connection, so register the application at Entra first. Bird's Redirect URI is the same for every connection and is shown in Add connection before you create anything, so you can register it up front.

Register an application in Entra, add a client secret, and copy the client ID and secret into Bird.

Use your tenant-specific issuer, the v2.0 issuer that names your tenant id. Do not use the multi-tenant common endpoint: its discovery document describes the issuer as a template rather than a value, and a connection built from it fails every sign-in. Bird authenticates to the token endpoint with client_secret_basic.

Register Bird's Redirect URI as a redirect URI on the app registration.

Bird reads the member's address from the email claim of the ID token. Entra emits that claim only when the user's mail attribute is set, under Contact information in their Entra profile. A tenant whose users have no mailbox (an organization using another mail provider) commonly leaves it empty, and the Bird test then reports that no email address arrived, even though the user's principal name is a perfectly good address.

Populate mail for each member who will sign in through Bird.

For the tile to appear, set the app registration's Home page URL to the connection's Initiate login URI from Bird, set Visible to users to Yes, and assign the user. Without a home page URL the tile is hidden.

Setting Assignment required on the Entra application does not, by itself, stop an unassigned member signing in to Bird over OIDC. Bird requests the standard openid and email scopes, which Entra treats as Microsoft Graph permissions, so Entra evaluates assignment against Graph rather than against your Bird application.

To make Entra enforce assignment, and application-scoped conditional access with it, expose a scope on the app registration under Expose an API, and ask Bird to request it on the connection. Until then, the members who can reach your organization through this connection are the ones whose address is on one of its verified domains.

This applies to the OIDC path. A SAML application is its own resource in Entra, so assignment is evaluated against it.