> This page is for Itential Platform On-Prem, version 6 (default).
> For other versions, use one of these documentation indexes:
> - 6 (default): https://docs-test.itntl.com/itential-platform/6/llms.txt
> - 2023.2: https://docs-test.itntl.com/itential-platform/2023-2/llms.txt

> For clean Markdown of any page, append .md to the page URL.
> For a complete documentation index, see https://docs-test.itntl.com/llms.txt.
> For AI client integration (Claude Code, Cursor, etc.), connect to the MCP server at https://docs-test.itntl.com/_mcp/server.

# Configure Azure AD settings in Platform

> How to configure the Azure AAA adapter in Itential Platform using a tenant ID, a client ID, and either a client secret or a certificate.

#### Gather required values from Azure AD

The following values are required from the Azure AD administrator who creates the Itential Platform application in Azure:

* **Tenant ID** (`"tenant"`): Found in **Azure AD > Itential Platform App > Tenant ID**.
* **Client ID** (`"client"`): Found in **Azure AD > Itential Platform App > Application ID**.

You also need the credentials for your authentication method. If you provide both, the adapter uses the certificate and ignores the client secret. For details, see [Choose a credential type](/itential-platform/configure/auth/azure-id/configure-azure-ad#choose-a-credential-type).

* **Client secret**:
  * **Itential Platform API Key** (`"secret"`): Obtained during key setup in **Azure AD > Itential Platform App > Keys**.
* **Certificate** (Platform 6.6 and later):
  * **Certificate path** (`"certPath"`): The path to the PEM certificate file on your Platform servers.
  * **Private key path** (`"keyPath"`): The path to the private key file on your Platform servers.

#### Add the Azure AAA adapter to the active profile

Update the active `IAP_Profile` in the service configuration in Admin Essentials to add the Azure AAA adapter. Copy the JSON for your authentication method into the properties section of the `Service_Config` for the Azure AAA adapter.

#### Client secret

If you're switching from certificate-based authentication, remove the `certPath` and `keyPath` properties. If either property remains, the adapter uses the certificate and ignores the secret.

```json
{
  "id": "Azure AAA",
  "type": "azure_aaa",
  "properties": {
    "tenant": "a38145b3-f428-3645-cb19-ac6fe574ec71",
    "client": "d54381f6-43ae-33cd-bc79-112233dce3c6",
    "secret": "7hcq6sruo5GZAEDzRh6+S4LnKmL1Mb+KK2qlP6uT8w0=",
    "groupSync": {
      "interval": 3600,
      "method": "<all | master | account>",
      "masterGroup": "<object id of master group or empty for all>",
      "serviceAccount": "<object id of service account or empty for all>"
    }
  },
  "brokers": [
    "aaa"
  ]
}
```

#### Certificate

Certificate-based authentication requires Platform 6.6 or later. Both `certPath` and `keyPath` are required. If the configuration also includes `secret`, the adapter uses the certificate and ignores the secret.

```json
{
  "id": "Azure AAA",
  "type": "azure_aaa",
  "properties": {
    "tenant": "a38145b3-f428-3645-cb19-ac6fe574ec71",
    "client": "d54381f6-43ae-33cd-bc79-112233dce3c6",
    "certPath": "path/to/cert.pem",
    "keyPath": "path/to/private.key",
    "groupSync": {
      "interval": 3600,
      "method": "<all | master | account>",
      "masterGroup": "<object id of master group or empty for all>",
      "serviceAccount": "<object id of service account or empty for all>"
    }
  },
  "brokers": [
    "aaa"
  ]
}
```

#### Remove aaa from the Local AAA adapter brokers

Find the properties section of `Service_Config` for the Local AAA adapter. Remove the `"aaa"` value from the `brokers` section, leaving the array empty `[]`. Make sure no other adapters are using the `"aaa"` broker config.

```json
"brokers": []
```

#### Configure the login schema in IAP_Profile

Configure the `uiProps` login schema in `IAP_Profile`. This redirects to the Azure SSO page. The path is relative to the base Itential Platform directory.

```json
"uiProps": {
  "login": "custom/sso.html"
}
```

#### Configure authenticationProps

Update `authenticationProps` in `IAP_Profile` to specify the administrator group or groups from the Azure adapter. Any user within these groups will have full administrator permissions in Itential Platform.

> **Note**
>
> To sync the groups correctly, `provenance` must match the `id` value of the service config and `group` must match the group name created in Azure AD.

```json
"authenticationProps": {
  "admins": [
    {
      "provenance": "Azure AAA",
      "group": "IAP-Administrator"
    }
  ]
}
```