Skip to main content
View as MarkdownOpen in ChatGPTOpen in Claude

Microsoft Entra ID identity provider integration

You can integrate your Microsoft Entra ID identity provider (IdP) with Axiad Mesh to ensure that your users are securely signing in to the portal.

The integration requires updates on both Entra ID and Axiad Mesh.

Entra ID configuration steps​

Important

These steps are Axiad's current understanding of the configuration. Because Entra ID is a third-party product, there may be slight variations between your experience and what this guide describes. We work hard to keep things as up to date as possible, but depending on the versions in use, the latest updates, and so on, there may be some mismatches.

If you find any significant differences or anything that doesn't make sense, contact Axiad support so we can update this guide.

note

The Entra ID steps are similar for both integrations with Axiad Mesh — as an IdP and as a connector. However, it's important that each integration type has its own enterprise application in Entra ID to ensure that the permissions are assigned accordingly.

Create a new enterprise application​

  1. Sign in to the Microsoft Entra admin center as at least a Cloud Application Administrator.

  2. Navigate to Identity > Enterprise applications.

  3. Select New application.

  4. On the Browse Microsoft Entra Gallery page, select Create your own application.

  5. In the Create your own application pane, set the Name to a friendly name.

  6. Select Register an application to integrate with Microsoft Entra ID (App you're developing).

  7. Select Create.

    Create your own application pane in the Microsoft Entra admin center

  8. On the Register an application page, set the Name to the friendly name.

  9. Select Accounts in this organizational directory only (Single tenant). The option label includes your directory name, for example Eagle 101 only - Single tenant.

    Axiad recommendation

    We recommend that you create and test the integration with Axiad Mesh using a single tenant. Upon success, you can then change this setting to a multitenant environment as needed.

  10. Select Register.

    Register an application page with the single-tenant account type selected

Configure application properties​

  1. In the Entra admin center, navigate to Identity > Enterprise applications > All applications.

  2. Locate and open your newly created application.

  3. Under Manage in the menu, select Properties.

  4. Select Yes for Enabled for users to sign-in?.

  5. Select Yes for Assignment required?.

  6. Select No for Visible to users?.

  7. Select Save.

    Application properties page with sign-in enabled, assignment required, and visibility disabled

  8. Copy the Application ID — you need it for the Axiad Mesh configuration steps.

Add the redirect URI​

Your Axiad Mesh sign-in URL includes a domain query parameter that identifies which identity provider to use. Entra ID matches redirect URIs as exact strings, so a redirect URI registered without that query parameter does not match, and sign-in fails.

  1. In the Entra admin center, navigate to Identity > Applications > App registrations and open your newly created application.

  2. Under Manage in the menu, select Authentication.

  3. Select Add a platform, and then select Web.

  4. Set the Redirect URI to your Mesh portal URL followed by /oauth2/callback?domain=, plus the domain you enter in the Mesh configuration steps:

    https://YOUR-SUBDOMAIN.mesh.axiad.io/oauth2/callback?domain=YOUR-DOMAIN

    For example, if your portal is https://contoso.mesh.axiad.io and the Domain you configure in Mesh is contoso.com, register:

    https://contoso.mesh.axiad.io/oauth2/callback?domain=contoso.com

  5. Select Configure.

The query parameter is required

https://contoso.mesh.axiad.io/oauth2/callback on its own is not a match. The ?domain= value must be character-for-character identical to the Domain value you enter in the Axiad Mesh configuration steps.

If the Redirect URIs field rejects the query string, add it through the application manifest instead: Manage > Manifest, then add the full URI to replyUrlsWithType with "type": "Web".

Diagnosing a redirect URI mismatch

An unregistered redirect URI does not always surface as AADSTS50011. When silent authentication is in use, Entra ID evaluates the sign-in session before it validates the redirect URI, so the same misconfiguration can appear as AADSTS50058. Interactively, the sign-in form is rendered first, so a user only sees AADSTS50011 after entering their password. Verify the registered value rather than reading the error code.

Configure the groups claim​

Axiad Mesh decides who is an administrator from the group membership Entra ID reports at sign-in. By default, Entra ID does not report group membership at all, and the result is easy to miss: sign-in still succeeds, but nobody is granted the Mesh admin role.

  1. In the Entra admin center, navigate to Identity > Applications > App registrations and open your newly created application.
  2. Under Manage in the menu, select Token configuration.
  3. Select + Add groups claim.
  4. Select Security groups.
  5. Expand ID, Access, and SAML, and set Customize token properties by type to Group ID for each.
  6. Select Add.

To confirm the result, open Manage > Manifest. A correctly configured application contains:

"groupMembershipClaims": "SecurityGroup",
"optionalClaims": {
  "idToken": [{ "name": "groups" }],
  "accessToken": [{ "name": "groups" }]
}
Use Group ID, not Group Name

Selecting Group ID makes Entra ID report each group as its object ID (a GUID). Axiad Mesh matches your nominated admin groups against those values exactly — it does not look up display names. If you choose a name-based option here, or enter display names in the Admin groups field later, nobody is granted the admin role.

Configure application owners​

  1. In the Entra admin center, navigate to Identity > Applications > Enterprise applications > All applications.
  2. Locate and open your newly created application.
  3. Under Manage in the menu, select Owners.
  4. In the Owners pane, search for and add the desired application owners.
  5. After they're all added, select Save.

Assign users and groups​

  1. In the Entra admin center, navigate to Identity > Applications > Enterprise applications > All applications.

  2. Locate and open your newly created application.

  3. Under Manage in the menu, select Users and groups.

  4. Search for and select the application users and groups allowed to use Axiad Mesh.

    Users and groups page listing the groups assigned to the application

  5. After the users and groups are added, select Save.

  6. Copy the Object ID of each group that should receive the Axiad Mesh admin role — you need these values for the Admin groups field in the Axiad Mesh configuration steps. To find a group's object ID, navigate to Identity > Groups > All groups, open the group, and copy the Object Id value from its Overview page.

Generate a client secret​

  1. In the Entra admin center, navigate to Identity > Applications > Enterprise applications > All applications.

  2. Locate and open your newly created application.

  3. Under Manage in the menu, select Single sign-on.

  4. On the OIDC-based Sign-on page, select Go to application in the Configure application properties section.

  5. Under Manage in the menu, select Certificates & secrets.

  6. Select New client secret.

  7. On the Add a client secret page, provide a Description, set Expires to the expiration time, and then select Add.

  8. After the secret is created, copy the Value from the Certificates & secrets page.

    Important

    You can only copy this value immediately after creating it, and it's required for the Axiad Mesh configuration steps. Be sure to copy this value now — you won't have another opportunity, and you would need to create a new client secret instead.

    Certificates and secrets page showing the newly created client secret value

Axiad Mesh configuration steps​

note

You can integrate your Entra ID IdP with Axiad Mesh in the initial onboarding process as the primary IdP, or as a secondary IdP after you've configured another IdP as the primary IdP.

For more information about the initial onboarding process, see the getting started guide.

Initial onboarding configuration​

If you're adding Entra ID as your primary IdP during your initial onboarding, complete the following steps.

  1. After you open the access link from the Axiad Mesh welcome email, you're prompted to set up your primary IdP.

  2. Set the Domain to the domain of your Entra ID environment. This value must match the domain query parameter of the redirect URI you registered in Add the redirect URI exactly.

  3. Select Microsoft Entra ID from the Provider dropdown.

  4. Set the Microsoft Entra Tenant ID to the Tenant ID of your Entra ID environment. Learn how to locate your Tenant ID.

  5. Fill in the fields with the values copied in the Entra ID configuration steps:

    Primary IdP setup form with domain, provider, tenant ID, client ID, and client secret fields

  6. On the next screen, set the Admin groups to the object IDs of the groups whose members should be Axiad Mesh admins, as copied in Assign users and groups, step 6.

    Enter object IDs, not group names

    Because you set the groups claim to Group ID, Entra ID reports each group as an object ID — a GUID, shown in the group's Overview page as Object Id. Axiad Mesh matches these values exactly, so a display name such as Mesh Admins never matches and the admin role is not granted.

    Entra ID group limitations

    Only users that are in the groups included in the Assign users and groups section can access Axiad Mesh. For any groups you add here, be sure that the users are members of any group limitations made in Entra ID.

    Admin groups step of the initial onboarding flow

  7. Select Continue, and you're signed in to the Axiad Mesh portal for the first time.

Secondary IdP configuration​

If you already have your initial IdP connected and need to add a new one, or you need to replace the existing one, you can connect your Entra ID IdP from the Axiad Mesh administrative portal.

  1. From the homepage, select the gear icon to open the Settings page.

    Axiad Mesh homepage with the settings gear icon highlighted

  2. Select Identity providers from the left menu and select + Add identity provider.

    Identity providers settings page with the Add identity provider button

  3. On the Add identity provider page, set the Domain to the domain of your Entra ID environment. This value must match the domain query parameter of the redirect URI you registered in Add the redirect URI exactly.

  4. Select Microsoft Entra ID from the Provider dropdown.

  5. Set the Microsoft Entra Tenant ID to the Tenant ID of your Entra ID environment. Learn how to locate your Tenant ID.

  6. Fill in the fields with the values copied in the Entra ID configuration steps:

  7. Set the Admin groups to the object IDs of the groups whose members should be Axiad Mesh admins, as copied in Assign users and groups, step 6.

    Enter object IDs, not group names

    Because you set the groups claim to Group ID, Entra ID reports each group as an object ID — a GUID, shown in the group's Overview page as Object Id. Axiad Mesh matches these values exactly, so a display name such as Mesh Admins never matches and the admin role is not granted.

    Entra ID group limitations

    Only users that are in the groups included in the Assign users and groups section can access Axiad Mesh. For any groups you add here, be sure that the users are members of any group limitations made in Entra ID.

    Add identity provider form filled out for Microsoft Entra ID

  8. After the fields are filled out, select Test Connection.

  9. Upon a successful test, select Add & Connect.

  10. After the setup completes, the new IdP is listed on the Identity providers page.

    Identity providers page listing the newly added Entra ID provider