Configuring Microsoft Entra ID in Cloud Authentication

To integrate Microsoft Entra ID with Cloud Authentication and Policy application from Entra ID, do the following:

1. Register Cloud Authentication and Policy Application in Entra ID Portal
2. Configure API Permissions for Cloud Authentication and Policy Application
3. Configure Client Secret ID for Cloud Authentication and Policy Application

Register Cloud Authentication and Policy Application in Entra ID Portal

Register the Cloud Authentication and Policy application inEntra ID to authenticate with the Microsoft identity platform endpoint. This configuration allows the Cloud Authentication and Policy application to call Microsoft Graph APIs Application Programming Interface. Refers to a set of functions, procedures, protocols, and tools that enable users to build application software. to authorize users during authentication.

For instructions, see Register an application with the Microsoft identity platform.

In the Redirect URI Uniform Resource Identifier. URI identifies the name and the location of a resource in a uniform format. section, add OAuth Open Standard for Authorization. OAuth is a token-based authorization standard that allows websites or third-party applications to access user information, without exposing the user credentials. and Reply URLs Uniform Resource Locator. URL is a global address used for locating web resources on the Internet. of the Cloud Guest server. The reply URL must be in the https://<cloud guest server>/oauth/reply format.

For more information about Cloud Guest server URLs, see Cloud Guest Server Domains for Guest Access Service in Opening Firewall Ports for Device Communication.

Configure API Permissions for Cloud Authentication and Policy Application

After registering the application, you must configure the following API permissions to call APIs:

• Directory.Read.All
• Group.Read.All
• User.Read
• User.Read.All

In the Entra ID portal, for the registered Cloud Authentication and Policy application, ensure that the API permission type is selected as Application permissions in the API permissions > Add a permission > Microsoft Graph.

For more information, see Introduction to permissions and consent section under Permissions and access in the Microsoft Entra ID portal.

After adding the API permissions, ensure to grant admin consent for all API permissions. To do this, select Grant admin consent in the API Permissions page. You must have administrator rights to grant admin consent.

Configure Client Secret ID for Cloud Authentication and Policy Application

The client secret is a string value and is used to identify the Cloud Authentication and Policy application when requesting an access token from the Microsoft identity platform token endpoint. Access token is used in the Microsoft Graph API to get information about users.

For more information, see Add a client secret.

The Value and Secret ID are generated for the client. Ensure to note down these values to use in the Cloud Authentication and Policy application. This secret value is never displayed again after you leave this page.

APIs for Microsoft Entra ID

The following APIs are used by Cloud Authentication and Policy to authorize users in Microsoft Entra ID:

• GET https://graph.microsoft.com/v1.0/users/{id | userPrincipalName}

• GET https://graph.microsoft.com/v1.0/users/{id | userPrincipalName}/memberOf