--- title: "Single Sign-on with Microsoft Entra ID (Native)" slug: "single-sign-on-with-microsoft-entra-id-native" updated: 2025-06-17T13:40:32Z published: 2025-06-17T13:42:57Z canonical: "support.kandji.io/single-sign-on-with-microsoft-entra-id-native" --- > ## Documentation Index > Fetch the complete documentation index at: https://support.kandji.io/kb/llms.txt > Use this file to discover all available pages before exploring further. # Single Sign-on with Microsoft Entra ID (Native) > [!NOTE] > Note: Microsoft Entra ID [is the new name](https://learn.microsoft.com/en-us/azure/active-directory/fundamentals/new-name) for Azure AD (Azure Active Directory) > [!WARNING] > Because client secrets have a maximum life of 24 months, we recommend that you configure [SAML based Single Sign-On](/v1/docs/single-sign-on-with-microsoft-entra-id-saml) instead of using the method described in this document. ### Create a Microsoft Entra ID Application 1. Sign in to the [Microsoft Entra admin center](https://entra.microsoft.com)[.](https://portal.azure.com/#blade/Microsoft_AAD_IAM/ActiveDirectoryMenuBlade/Overview) 2. In the left navigation bar, click **Applications**. 3. Click **App Registrations** 4. Click **New Registration** to register a new application. ![](https://cdn.document360.io/0844b095-d720-4a7b-bb17-ec97d9bc6e41/Images/Documentation/w0j3gr295siiygpb0hzsi39ympaxuudada.png) 5. In the Name field, specify a name for the application (such as "Kandji Native SSO"). 6. For "Supported account types," select **Accounts in this organizational directory only**. 7. In the Redirect URI field, select **Web** from the dropdown menu, and enter one of the following values, depending on where your Kandji tenant is hosted. - If your tenant is hosted in the US, use the following URI: ```bash https://auth.kandji.io/login/callback ``` - If your tenant is hosted in the EU, use the following URI: ```bash https://auth.eu.kandji.io/login/callback ``` 8. Click **Register.** ![](https://cdn.document360.io/0844b095-d720-4a7b-bb17-ec97d9bc6e41/Images/Documentation/gfq1qhmm7gm0554s3mqxzoqpzp37mx6vug.png) 9. On the new page, copy the **Client ID** and save this for later. ![](https://cdn.document360.io/0844b095-d720-4a7b-bb17-ec97d9bc6e41/Images/Documentation/0sut2igujfweyc8wpt88d789valc4hi-xg.png) 10. Click **Certificates and Secrets.** 11. Click "**New client secret**." 12. Give the client secret a **name** such as "Kandji Native SSO." 13. Set the expiration to **24 months.** 14. Click **Add.![](https://cdn.document360.io/0844b095-d720-4a7b-bb17-ec97d9bc6e41/Images/Documentation/oo4zeo-hg_dz4llnj-atkymqpocsloyzoq.png)** 15. Copy the **Value** of the client secret, and save this for later. **Note that the client secret Value is distinct from the client secret ID.** ![](https://cdn.document360.io/0844b095-d720-4a7b-bb17-ec97d9bc6e41/Images/Documentation/39rbqdkge4h7onv0ox07bjjiykwxuaqyxw.png) ### Create a Microsoft Entra ID Directory Connection 1. Navigate to the **Settings** page. 2. Click the **Access** tab. 3. Find the **Authentication** section and click the **Add** button at the bottom left of the authentication section. ![](https://cdn.document360.io/0844b095-d720-4a7b-bb17-ec97d9bc6e41/Images/Documentation/Kandji-Support-KB-0804AM@2x(1).png) 4. In the new blade, click on the **Microsoft Entra ID** connection option. 5. Click **Next**. ![](https://cdn.document360.io/0844b095-d720-4a7b-bb17-ec97d9bc6e41/Images/Documentation/Kandji-Support-KB-0811AM@2x.png) 6. Customize or use the default **Name** for the Entra connection (this will be shown on the login page). 7. Enter the **Entra ID Directory Domain** that the application was registered within. Please refer to [Microsoft's documentation to locate your directory domain name](https://learn.microsoft.com/en-us/azure/cost-management-billing/manage/find-tenant-id-domain). 8. Enter the **Client ID** you previously copied from the Entra admin center. 9. Enter the **Client Secret** you previously copied from the Entra admin center. 10. Click **Save.** ![](https://cdn.document360.io/0844b095-d720-4a7b-bb17-ec97d9bc6e41/Images/Documentation/Kandji-Support-KB-0814AM@2x.png) 11. After saving, a new dialogue box will appear with a link to **authorize your connection.** A Microsoft Entra ID administrator for your domain will need to click the link and complete this process to authorize the application. This box will not go away after authorization is completed. ![](https://cdn.document360.io/0844b095-d720-4a7b-bb17-ec97d9bc6e41/Images/Documentation/Kandji-Support-KB-0820AM@2x(1).png) 12. In the new window that launches, sign in and click **accept**. ![](https://cdn.document360.io/0844b095-d720-4a7b-bb17-ec97d9bc6e41/Images/Documentation/lknv5g8sfib3b1ffbbqkrn8e1lswtgkwqw.png) ![](https://cdn.document360.io/0844b095-d720-4a7b-bb17-ec97d9bc6e41/Images/Documentation/awnexvjreebjnogzc_-vxne5gahd8z1wbq.png) 13. After clicking **Accept,** you will be brought to an authorization success page. 14. Your connection has now been successfully configured and may be enabled and tested. ![](https://cdn.document360.io/0844b095-d720-4a7b-bb17-ec97d9bc6e41/Images/Documentation/sxawzfvd-vxcekmmu3xgolmm3yqybw8tpw.png) > [!WARNING] > If you encounter the error "Failed to obtain access token," it may be because the secret ID was used instead of the correct value. ### Enable the SAML Connection Once you have configured the SAML connection in Kandji and your identity provider, you can enable it. For step-by-step instructions, please refer to our [Single Sign-On support article](/v1/docs/single-sign-on). ### Enforcing Single Sign-On Once you have configured at least one Single Sign-On connection, you can disable the Standard Authentication connection. Disabling Kandji standard authentication will disable the ability for Kandji administrators in your tenant to authentication via Email/Password, Google Sign in, or Office 365 Sign in. Please refer to our [Single Sign-On support article](/v1/docs/single-sign-on) for step-by-step instructions. ### Renewing the Client Secret 1. Follow steps 9-14 in the [Create a Microsoft Entra ID Application](/v1/docs/single-sign-on-with-microsoft-entra-id-native#create-a-microsoft-entra-id-application) section of this article to create a new client secret and copy the value as shown in step 14. 2. In the Kandji web app, navigate to the **Settings** page. 3. Click the **Access** tab. 4. Find the **Authentication** section. 5. Click on the ellipsis next to the SSO integration that was created earlier in this article, and choose **Configure**. 6. Replace the Client Secret with the client secret value that was copied earlier. 7. Click Save. Be sure to test the configuration by signing into the Kandji web app and choosing the Native SSO login option that was created. You'll want to test this with a private browser window/incognito window and verify that you are able to sign in to the Kandji web app. You can then optionally delete the previous client secret from the App registration in Entra ID.