# Setup Entra ID (Azure AD) SSO

URL: https://select.dev/docs/reference/using-select/access-management/azure-ad-sso
Index of all SELECT docs: https://select.dev/docs/llms.txt

> Learn how to setup Entra ID (Azure AD) SSO with SELECT

> [!NOTE]
> SELECT's Azure AD integration is an add-on feature. Please contact SELECT to determine your eligibility and receive a quote.

## Connecting Entra ID

To manage access and authentication to SELECT using your Microsoft Entra ID (formerly Azure AD) account, please follow the steps below.

### Step 1: Register Application

Launch the new app registration flow in the Microsoft Entra admin center.

![SELECT Entra ID integration setup step #1](https://select.dev/cdn-cgi/imagedelivery/1zmOcgV1p520E4lLTrYjjg/3bf0527f-47b5-492d-cc61-c736edb58500/width=3456,quality=75)

Set the name to SELECT, and restrict the access to accounts in your organizational directory only. Set the Redirect URI type to 'Web' and the URI value to `https://auth.select.dev/login/callback`, and click 'Register'.

![SELECT Entra ID integration setup step #3](https://select.dev/cdn-cgi/imagedelivery/1zmOcgV1p520E4lLTrYjjg/b1512e1c-fb01-4de7-3ae0-0d1b96120300/width=3456,quality=75)

On the app's registration overview page, make a note of the 'Application (client) ID' value for configuration in SELECT.

![SELECT Entra ID integration setup step #3](https://select.dev/cdn-cgi/imagedelivery/1zmOcgV1p520E4lLTrYjjg/d004971d-1219-4a98-749d-752f1805bc00/width=3456,quality=75)

Next, click the 'Add a certificate or secret' link from the same overview page.

![SELECT Entra ID integration setup step #4](https://select.dev/cdn-cgi/imagedelivery/1zmOcgV1p520E4lLTrYjjg/fca00801-9728-4482-8215-1abd4a816b00/width=3456,quality=75)

Then, create a 'New client secret'.

![SELECT Entra ID integration setup step #5](https://select.dev/cdn-cgi/imagedelivery/1zmOcgV1p520E4lLTrYjjg/6acb22a4-5a9b-46eb-d25c-f05ddbd4e000/width=3456,quality=75)

Set the expiration to the maximum allowed duration. Click 'Add'.

![SELECT Entra ID integration setup step #6](https://select.dev/cdn-cgi/imagedelivery/1zmOcgV1p520E4lLTrYjjg/d5802e4d-c7f2-48e3-6914-b6573a7df000/width=3456,quality=75)

Make a note of the secret value for configuration in SELECT. We recommend creating a reminder to update the connection on SELECT with a new secret before it expires.

![SELECT Entra ID integration setup step #7](https://select.dev/cdn-cgi/imagedelivery/1zmOcgV1p520E4lLTrYjjg/08bbc3ea-2b1d-4ca5-1002-eceacf413900/width=3456,quality=75)

Next, click the 'Branding & properties' tab. You can find your `ORGANIZATION_ID` value in [settings](https://select.dev/app/settings). Then set the Home page URL to `https://select.dev/api/auth/login?organization=ORGANIZATION_ID`, replacing `ORGANIZATION_ID` with the value you have. Then click save.

![Find your organization ID SELECT](https://cdn.sanity.io/images/wn0ylp2c/production/4e7878f4fc488065620d278b6e1fdfd5a07aef64-2214x1304.png)

![SELECT Entra ID integration setup step #8](https://select.dev/cdn-cgi/imagedelivery/1zmOcgV1p520E4lLTrYjjg/3ccd8eeb-247a-4ff1-673e-5977db5d4c00/width=3456,quality=75)

SELECT needs to be able to retrieve the group memberships of users for [SSO Group role mappings](https://select.dev/docs/reference/using-select/access-management/role-based-access-control#sso-group-mapped-roles). To enable this, head to the 'API permissions' tab. SELECT requires the `User.Read` and `Directory.Read.All` permissions.

![SELECT Azure AD Permissions](https://select.dev/cdn-cgi/imagedelivery/1zmOcgV1p520E4lLTrYjjg/2d5cae31-239c-4e5c-2890-b1ac1ebd5600/width=3456,quality=75)

Finally, click the 'Enterprise applications' section of the sidebar, and then click the 'SELECT' application you created. Under properties, ensure the app is set to be visible to users. Access to SELECT is governed by the settings under the 'Users and groups' tab.

![SELECT Entra ID integration setup step #9](https://select.dev/cdn-cgi/imagedelivery/1zmOcgV1p520E4lLTrYjjg/7a11d815-1af3-452d-1907-c1a4709bcc00/width=3456,quality=75)

### Step 2: Add SSO Connection in SELECT

Head over to SELECT and navigate to **Settings** → **Authentication**. In the Custom Enterprise SSO section, click Add SSO and select Microsoft Entra ID from the dropdown.

![Add Azure AD (Entra ID) SSO flow](https://cdn.sanity.io/images/wn0ylp2c/production/61720239d88288c3b3782b62f33a17d34c5c35a3-3024x1963.png)

Next, fill out the Add Microsoft Entra ID SSO form. Enter the client ID and client secret that we made note of earlier. You may also enable Include SSO Groups for [SSO group role mappings](https://select.dev/docs/reference/using-select/access-management/role-based-access-control#sso-group-mapped-roles). To find your Entra ID Domain, [see your directory page](https://entra.microsoft.com/#settings/directory):

![SELECT Entra ID integration setup step #10](https://select.dev/cdn-cgi/imagedelivery/1zmOcgV1p520E4lLTrYjjg/46c0e71f-7270-4bdf-e478-bfc4dcb62000/width=3456,quality=75)

Click Add SSO to complete. You should then see your newly created SSO connection under Authentication Methods.

![Add Microsoft Entra ID SSO form](https://cdn.sanity.io/images/wn0ylp2c/production/71a3c19c3c500ac023ef580b1e80fe86be9d2eb6-3024x1963.png)

![Newly added Azure AD (Entra ID) SSO connection](https://cdn.sanity.io/images/wn0ylp2c/production/b8a64ae6f1037e0cd2f560ee753ab6d0439f251d-3024x1963.png)

> [!NOTE]
> Creating an SSO connection will automatically disable manual user invitations.