Azure AD Federation

English | Deutsch

An Azure AD Federation should be setup as OpenID Connect federation. SAML might be possible but is not the preferred configuration.

Create an App registration in Azure AD (tab App Registrations)
Configure Supported Account types. The value should be “Only Account from this AD” (single tenant).
1. Azure AD: https://docs.microsoft.com/en-us/azure/active-directory/develop/howto-convert-app-to-be-multi-tenant
Add a redirect URI to the App Registration. The redirect URI will be the following: https://access.questback.com/oauth2/v1/authorize/callback
1. For Production: https://access.questback.com/oauth2/v1/authorize/callback
Add permission for “UserRead” to that App Registration.
1. The value will be https://graph.microsoft.com/User.Read
Add optional claims to the manifest of the created App Registration in Azure AD. The family_name and the given_name have to be sent.
Create a secret for that App Registration and remember it.
Remember the client ID of that App Registration.

 "optionalClaims": {
    "idToken": [
        {
            "name": "family_name",
            "essential": true
        },
        {
            "name": "given_name",
            "essential": true
        }
    ]
},
"accessToken": [],
"saml2Token": []