> For the complete documentation index, see llms.txt.
Skip to main content

Check out Port for yourself ➜ 

Entra ID (AzureAD)

This guide demonstrates how to configure Single Sign-On (SSO) integration between Port and Microsoft Entra ID (AzureAD) using OIDC.

Once implemented:

  • Users can connect to Port via an AzureAD app.
  • AzureAD teams will be automatically synced with Port upon user sign-in.
  • You can set granular permissions in Port according to your AzureAD groups.

Prerequisites​

Before starting the configuration, ensure you have:

  • Access to the Microsoft Azure Portal with permissions to create and configure applications.
  • Users who need access to Port must have a valid value in their Email field in Azure AD.

Register a new application​

Create the application registration

  1. In the Microsoft Azure Portal, go to Azure Active Directory.

  2. Click on App registrations.

    Azure AD App registrations sidebar

  3. Click on New registration at the top of the page.

    Azure App registrations new registration button

  4. Define the Port application settings:

    4.1 Name: Insert a friendly name for the Port app, like Port.

    4.2 Supported account types: Please select the option that is appropriate for your organization.

    For most use cases this would be Accounts in this organizational directory only (Default Directory only - Single tenant).

    4.3 Redirect URI:

    • Set Platform to Web

    • Set URL to https://auth.getport.io/login/callback

      Register application form with Port redirect URI

    4.4 Click Register.

Configure authentication settings

  1. On the new Port App page, click Authentication.

    Port app sidebar Authentication option

  2. Add the Front-channel logout URL: paste the following URL:

    https://auth.getport.io/logout

    Adding the front-channel logout URL will enable single sign-out, meaning when a user logs out from Port, it also logs them out from their identity provider.

    Port Authentication redirect URI and logout URL

  3. Click Save.

Configure application branding​

  1. On the new Port App page, click Branding & Properties.

    Port app sidebar Branding and properties option

  2. Configure the following settings:

    • Home page URL: paste the following URL:

      Set authorization endpoint based on account region

      Port exposes two API instances, one for the EU region and one for the US region. Use the correct endpoint based on your account region, replacing company-<companyID>-SSO with your actual connection name.

      To find your connection name: open the Credentials modal, go to the Organization tab, and copy the Company ID. Use only the ID portion. For example, if your Company ID is company_123456789, your connection name is company-123456789-SSO.

      https://auth.getport.io/authorize?response_type=token&client_id=96IeqL36Q0UIBxIfV1oqOkDWU6UslfDj&connection=company-<companyID>-SSO&redirect_uri=https%3A%2F%2Fapp.port.io

    • Publisher domain: Select the domain matching your user emails (for example port.io).

      Port Branding page with homepage URL and domain

  3. Click Save.

Set up application permissions​

Add required permissions

  1. On the Port App page, click API Permissions.

    Port app sidebar API permissions option

  2. Click Add a permission.

    Port API permissions page with Add permission button

  3. On the Microsoft APIs tab:

    • Click on Microsoft Graph.

      Request API permissions Microsoft Graph option

    • Click on Delegate Permissions.

      Microsoft Graph Delegated permissions selection
      • Search and mark the following permissions:
      • email, openid, profile, User.read

      AzureAD groups integration

      If you wish to pull in AzureAD groups into Port, you will also need to add the Directory.Read.All permission.
      See Permissions required to pull AzureAD groups to Port for more details.


      Port API permissions with Graph delegated permissions

    • Click Add permissions.

      Grant admin consent

      (OPTIONAL) Grant admin consent: when users from your organization will first log in, they will be prompted to confirm the permissions specified here. You can click the Grant admin consent for Default Directory to automatically approve their permissions.

Configure application claims​

Add optional claims

  1. On the Port App page, click Token configuration.

    Port app sidebar Token configuration option

  2. Click Add optional claim.

    Token configuration optional claims list

  3. Select ID as the token type and then select the email claim, then click Add.

    Add optional claim dialog ID token email

    Repeat the same process for Access and SAML (3 times total).

  4. Your optional claims will look like this:

    Token configuration email claim for all token types

Multiple Azure AD SSO connections​

If you have multiple Port environments, it is possible to setup an OIDC Azure AD SSO connection for each environment.

However, note that in this instance you will not be able to use Port's main login page to reliably sign in to a specific environment. When you enter your email address to login, it will take you to one of your Port environments but it is not guaranteed to take you to the same Port environment every time.

In that case you have the following options:

  • Use the https://myapplications.microsoft.com dashboard provided by Azure AD and select the desired Port environment to connect to.
  • Use the manual login URL for each environment directly, by specifying the desired environment based on its respective connection name (e.g. company-<companyID>-SSO).

Enable AzureAD groups integration​

Port can query the group membership of users who log in through the AzureAD SSO, and add their teams as team entities inside Port. This allows platform engineers to take advantage of both existing groups from AzureAD and teams created manually inside Port to manage permissions and access to resources inside Port's catalog.

In order to import Azure AD groups into Port, Port will require the connection app to approve the Directory.Read.All permission.