> This page is for Itential Platform On-Prem, version 2023.2. > For other versions, use one of these documentation indexes: > - 6 (default): https://docs-test.itntl.com/itential-platform/6/llms.txt > - 2023.2: https://docs-test.itntl.com/itential-platform/2023-2/llms.txt > For clean Markdown of any page, append .md to the page URL. > For a complete documentation index, see https://docs-test.itntl.com/llms.txt. > For AI client integration (Claude Code, Cursor, etc.), connect to the MCP server at https://docs-test.itntl.com/_mcp/server. # Configure Azure AD > How to configure the Azure AD server and set up adapter-azure_aaa for Itential Platform SSO over OpenID Connect. The Azure adapter allows SSO (single sign-on) in Azure over the OpenID Connect (OIDC) protocol. Use this guide to configure the Azure AD server and set up `adapter-azure_aaa` for Itential Platform. > **Warning** > > The information provided was developed in a lab environment. Input for various settings and fields should be populated with details specific to your production environment. This page outlines the process and permissions required for the Azure AAA adapter to communicate with the Azure AD system. > **Note** > > Admin privileges in the Azure AD system are required to perform the initial setup. ## Create a new application #### Open App Registration Log in to the Azure AD system and access the Azure AD page. Select the **App Registration** section and click **New registration**. > **Note** > > Create a separate application for each environment so that passwords and configurations are unique to each environment. ![](/_fern-img/1d9985e5fbfe34532ac6941cf50c971dd7f3ddf3d9f122314efae690d345abce.webp) #### Complete the application fields Fill in the registration form. For example: * **Name**: `Itential Automation Platform - Production` * **Supported Account Types**: Default * **Redirect URI**: Leave blank; you will update it later. Click **Register**. #### Record the Application ID and Tenant ID Review the application details. Record the **Application ID** — it will be used by the adapter as the `client id`. Record the **Tenant ID** — it will be used by the adapter as the `tenant id`. ![](/_fern-img/1f1ef09c7f12507c670c67803091a5c074977697ba290abb20822f76ad146a29.webp) ## Configure authentication settings #### Set redirect URIs Go to the **Authentication** section. Verify the Redirect URIs. These are the acceptable return URIs after authentication. If a redirect is attempted to a URI that does not exist here, the redirect will fail. Pay close attention to ports — you must have a URI for each port. > **Note** > > Typically the URL is the same as the sign-on URL, or a sign-on URL with a specific SSO page. For example: > > * `https://itential.customer.com/login` > * `https://localhost:3443/login` ![](/_fern-img/f4f9a9f45680d66968f90f26b5066876fe673f717a17d5189676b01172e05d78.webp) #### Enable ID tokens Enable the ID tokens under **Advanced settings**. ![](/_fern-img/cf254d4db0cc7b1bba313b22967ab7ca621bfc613412941a4a83cd1e476d1777.webp) ## Set application permissions #### Add API permissions Go to the **API Permissions** section. Click **+ Add a permission**. Find and select **Microsoft Graph API** from the list. #### Select required permissions From the list of **Application Permissions**, check the following: * `Directory.Read.All` * `Group.Read.All` * `User.Read.All` No delegated permissions are required. Click **Add Permission**. ![](/_fern-img/23c392632d148ea4e134c922a3e338f1eb179c7d68984e70c7c055c2ec2147ed.webp) #### Grant admin consent Click **Grant admin consent** and then click **Yes**. ## Choose a credential type The Azure AAA adapter authenticates to Azure AD with a client secret or a certificate: * **Client secret**: Supported in all Platform 6 releases. To set it up, see [Set the API key](#set-the-api-key). * **Certificate**: Supported in Platform 6.6 and later. Certificate-based authentication (CBA) replaces the shared secret with a certificate and private key that stay on your Platform servers. To set it up, see [Upload a certificate](#upload-a-certificate). If you configure both, the adapter uses the certificate and ignores the client secret. To switch back to the client secret, remove the `certPath` and `keyPath` properties from the adapter's service configuration. ## Set the API key #### Create a new password Go to **Settings > Keys** and create a new password by completing the following fields: * **Description**: `IAP API Key` * **Expires**: `Never` * **Value**: `` ![](/_fern-img/7ce183ed448f0aad418a73dcc97e4e480ea6cc80d845538e751e82bf7b86ae71.webp) > **Note** > > Expiration policies vary across organizations. Follow the guidelines for your organization. #### Save the value Click **Add**. A warning message displays reminding you to keep a safe copy of the **Value**, which has been encrypted. This value is used in the `secret` field by the Azure AAA adapter. ![](/_fern-img/dcca50ce24b482e70c8998d4153c9c5899677cdf5cac96435c5c00e280901cd8.webp) ## Upload a certificate Platform 6.6.0+ #### Prepare the certificate and private key Get a PEM-formatted certificate and its private key. You can use a certificate from a public or internal certificate authority, or a self-signed certificate. Copy both files to the same location on every Platform server in your environment. The adapter's service configuration is shared across servers, so each server reads the files from the same paths. #### Upload the public certificate In your registered application, go to **Certificates & secrets > Certificates** and select **Upload certificate**. Choose your certificate file (`.cer`, `.pem`, or `.crt`), enter a description, and select **Add**. > **Warning** > > Upload only the public certificate. Never upload the private key to Azure AD. The private key stays on your Platform servers. #### Record the file paths Record the paths to the certificate and private key on your Platform servers. The Azure AAA adapter uses these values in the `certPath` and `keyPath` fields. ## Add optional claims (Access Token v2.0) If you have configured your registered application **Manifest** to use `accessAcceptedTokenVersion: 2`, you must create an optional claim for `upn` on your ID tokens and access tokens. The `upn` claim is used by the Azure adapter internally to handle account routing in Itential Platform and is required. ![](/_fern-img/7fbed729ded0a73618f9aa7d47e98681cce8b0b41bb48eb7c07a2959e09449e8.webp)![](/_fern-img/65be4ad77f9b85a41021e4935ab8698567c8dd4f824c65d7125941c8770d1a9b.webp)