Skip to main content

Configure SSO with Microsoft Entra ID

This page explains how to connect your organization’s Microsoft Entra ID directory to Clovis. The integration uses the OpenID Connect (OIDC) protocol: users authenticate with Microsoft and then access Clovis with their business identity.

Configuration takes place in two stages:

  1. your administrator creates an app registration in Microsoft Entra ID;
  2. the Clovis team configures the identity provider using the settings provided by your organization.

Prerequisites​

Before you begin, make sure you have:

  • an account authorized to create app registrations in your Microsoft Entra ID tenant;
  • the redirect URI for your organization, provided by the Clovis team;
  • a secure channel agreed with the Clovis team for sending the client secret.

The redirect URI usually has the following format:

https://iam.clovis-ai.fr/realms/clovis-prod/broker/<SSO_IDENTIFIER>/endpoint
Use the URI provided by Clovis

The redirect URI must exactly match the value configured in Clovis. Do not derive the SSO identifier from your organization’s name.

1. Create the app registration​

  1. Sign in to the Microsoft Entra admin center.
  2. Open Entra ID, then App registrations.
  3. Select New registration.
  4. Enter a descriptive name, such as Clovis SSO.
  5. Under Supported account types, select Accounts in this organizational directory only (Single tenant).
  6. Under Redirect URI, select the Web platform, then paste the URI provided by the Clovis team.
  7. Select Register.

Creating a single-tenant web app registration in Microsoft Entra ID

The grayed-out areas hide values specific to the organization.

You can also add the URI after creating the application by going to Authentication > Add a redirect URI > Web.

2. Record the identifiers​

On the app registration’s Overview page, record the following two values:

Microsoft Entra fieldValue to provide
Application (client) IDOIDC client identifier
Directory (tenant) IDMicrosoft Entra ID tenant identifier

Location of the client and tenant identifiers in the Microsoft Entra ID overview

These identifiers are not secrets, but they should be shared only for the purposes of the integration.

3. Create a client secret​

  1. In the app registration, open Certificates & secrets.
  2. Under Client secrets, select New client secret.
  3. Enter a description, such as Clovis SSO.
  4. Choose an expiration date that complies with your organization’s security policy.
  5. Select Add.
  6. Immediately copy the secret’s Value.

Creating a client secret from the Certificates &amp; secrets page

Save the secret value

Microsoft Entra ID displays the secret value only once. Do not provide the secret ID instead, and never send the secret in an email, an unsecured ticket, or a shared document.

Record its expiration date so you can arrange its rotation before it becomes invalid.

4. Configure OIDC permissions​

  1. Open API permissions.
  2. Select Add a permission.
  3. Choose Microsoft Graph, then Delegated permissions.
  4. Add the following OpenID permissions:
    • openid: allows the user to be authenticated;
    • profile: provides access to the profile information needed to identify the user.
  5. Depending on your tenant’s policies, select Grant admin consent.

Selecting delegated OpenID permissions in Microsoft Entra ID

A recent app registration may already contain the User.Read permission. Do not change existing permissions without approval from your Entra ID administrator. Do not add any other permissions unless the Clovis team asks you to.

5. Send the configuration to Clovis​

Send the following items through the secure channel agreed with the Clovis team:

  • the Application (client) ID;
  • the Directory (tenant) ID;
  • the client secret value;
  • the secret expiration date.

The Clovis team then completes the identity provider configuration and confirms when the integration is ready for testing.

6. Test the connection​

After receiving confirmation from the Clovis team:

  1. open the Clovis sign-in page in a private browsing window;
  2. choose your organization’s SSO sign-in option;
  3. sign in with an authorized test account;
  4. check that the user is redirected to Clovis and has the expected access.

Test at least one authorized user. If your organization applies Conditional Access policies or requires users to be explicitly assigned to the enterprise application, also check these settings in Microsoft Entra ID.

Troubleshooting​

SymptomWhat to check
Microsoft displays an AADSTS50011 errorThe redirect URI registered in Entra ID must exactly match the one provided by Clovis.
Consent is deniedA tenant administrator may need to grant consent on behalf of the organization.
The secret is rejectedMake sure you provided the secret value, that it has not expired, and that no characters were omitted.
The user cannot open the applicationCheck Conditional Access policies and, if enabled, user assignment in the enterprise application.

Renew the secret​

Before the current secret expires:

  1. create a new client secret in the same app registration;
  2. send its value and expiration date to the Clovis team through the secure channel;
  3. wait for confirmation that it has been applied, then test the connection;
  4. delete the old secret when it is no longer in use.

Keep at least one clearly identified owner on the app registration and schedule an alert before each expiration date.

Microsoft resources​