> ## Documentation Index
> Fetch the complete documentation index at: https://docs.prophecy.ai/llms.txt
> Use this file to discover all available pages before exploring further.

# Microsoft Entra ID SSO

> Sign-in to Prophecy using your Microsoft Entra ID credentials

<Callout icon="/images/icon.png" color="#FFC107">
  Available for [Express and Enterprise Editions](/administration/platform/editions) only.
</Callout>

Prophecy supports **direct OAuth integration** with Microsoft Entra ID (formerly Azure Active Directory).

## 1. Register a new app

First, you need to log in to the [Azure portal](https://portal.azure.com/) as an administrator and register a new app.

1. In the Azure portal, open the **App registrations** page.
2. Click **New Registration**.
3. Name it `ProphecyEntraIDApp`.
4. Choose the supported account type: **Accounts in this organizational directory only (`xxxxx only - Single tenant`)**
5. For the Redirect URI, choose **Web** in the dropdown and use:
   `https://your-prophecy-ide-url.domain/api/oauth/azureadCallback`
6. Click **Register**.

## 2 (Optional): Enable automatic team creation

To automatically create new teams in Prophecy via [group mappings](/administration/management/authentication/group-team-mapping), follow these steps.

1. In your Prophecy deployment, set the `ENABLE_AUTO_TEAM_CREATION` flag to `true`.

2. Open the Azure portal.

3. Open the app that you registered in [1. Register a new app](#1-register-a-new-app).

4. Under **Manage**, select **Token configuration**.

5. Select **Add groups claim**.

6. Select the **Groups assigned to the application** checkbox.
   * To change the groups assigned to the application, select the corresponding application from the **Enterprise applications** list. Select **Users and groups** and then **Add user/group**. Select the group(s) you want to add to the application from **Users and groups**.

7. Click **Save**.

<Note>
  These steps are also listed in the [Configure groups optional
  claims](https://learn.microsoft.com/en-us/entra/identity-platform/optional-claims?tabs=appui#configure-groups-optional-claims)
  section of the Microsoft documentation.
</Note>

## 3. API Permission

Next, go to **API permissions** on the left-hand side and add this set of API permissions:

![Screenshot 2022-06-13 at 9 57 16 PM](https://user-images.githubusercontent.com/59466885/173400731-acb084df-31a7-4858-b6ba-f395e888e60e.png)

## 4. Certificates and Secrets

Then, go to **Certificates and Secrets**, add a new secret, and note down the value of this secret.

## 5. Client ID

Finally, click on **Overview** on the left-hand side and note down the Application (client) ID.

## 6. Configure Prophecy to connect with Microsoft Entra ID

1. Log in to Prophecy as an admin user.
2. Navigate to the **SSO** tab of the Prophecy **Settings** page.
3. Under **Authentication Provider**, select Azure Active Directory.
4. Enter the **Client ID** and the **Client Secret** at minimum.
5. Click **Save**.

Once you have logged out, you will be able to see a **Login with Azure Active Directory** option. Now, your Azure AD users will be able to login to Prophecy with this option.