Setting up Microsoft Entra

Documentation Index

Fetch the complete documentation index at: https://docs.getbifrost.ai/llms.txt

Use this file to discover all available pages before exploring further.

​

Overview

​

Prerequisites

• A Microsoft Azure account with access to Entra ID (Azure AD)
• Admin access to create app registrations
• Bifrost Enterprise deployed and accessible
• The redirect URI for your Bifrost instance (e.g., https://your-bifrost-domain.com/login)

​

Step 1: Register an Application

1. Sign in to the Azure Portal
2. Navigate to Microsoft Entra ID (or Azure Active Directory)
3. Go to App registrations
4. Click New registration

5. Click Register

​

Enable assignment requirement on the Enterprise Application

1. From the Entra ID main menu, go to Enterprise applications
2. Find and select Bifrost Enterprise (the service principal created automatically when you registered the app above)
3. Go to Properties

4. Set Assignment required? to Yes
5. Set Enabled for users to sign-in? to Yes
6. Click Save

​

Step 2: Capture App Registration Information

​

Step 3: Create App Roles (Optional)

1. In your app registration, go to App roles
2. Click Create app role
3. Create the following three roles:

​

Viewer Role

​

Developer Role

​

Admin Role

​

Step 4: Create a Client Secret

1. Go back to App registrations → Bifrost Enterprise
2. Navigate to Certificates & secrets
3. Click New client secret

4. Click Add
5. Copy the secret value immediately - it won’t be shown again!

​

Step 5: Configure API Permissions

1. In your app registration, go to API permissions
2. Click Add a permission
3. Select Microsoft Graph
4. Choose the permission type as indicated in the next steps
5. Add the following Delegated permissions (Add a permission → Microsoft Graph → Delegated permissions):
   • openid
   • profile
   • email
   • offline_access (for refresh tokens)
   • User.Read
6. Add the following Application permissions (Add a permission → Microsoft Graph → Application permissions):
   • User.Read.All
   • GroupMember.Read.All
   • Group.Read.All
   • Application.Read.All — required for syncing app-role-based role mappings during user import. If you don’t want to do bulk syncing, you can skip this permission.
   • AppRoleAssignment.ReadWrite.All — required to read each user’s app role assignments via Microsoft Graph

7. Click Add permissions
8. Click Grant admin consent for [Your Organization] (this is required — without admin consent, Application permissions are not effective even though they appear in the list)

​

Step 6: Configure Token Claims

1. Go to Token configuration
2. Click Add groups claim
3. Select:
   • Security groups or Groups assigned to the application
   • For token type, enable ID and Access
4. Click Add

​

Step 7: Assign Users and Roles

1. Go to Enterprise applications → Bifrost Enterprise
2. Navigate to Users and groups
3. Click Add user/group
4. Select users or groups
5. Select the appropriate role (Admin, Developer, or Viewer)
6. Click Assign

​

Step 8: Configure App Manifest

"requestedAccessTokenVersion": 2

"accessTokenAcceptedVersion": 2

"optionalClaims": {
  "idToken": [
    {
      "name": "roles",
      "source": null,
      "essential": false,
      "additionalProperties": []
    },
    {
      "name": "groups",
      "source": null,
      "essential": false,
      "additionalProperties": ["cloud_displayname", "sam_account_name"]
    }
  ],
  "accessToken": [],
  "saml2Token": []
}

"groupMembershipClaims": "ApplicationGroup"

​

Step 9: Configure Bifrost

​

Using the Bifrost UI

1. Navigate to Governance → User Provisioning in your Bifrost dashboard
2. Select Microsoft Entra as the SCIM Provider
3. Enter the following configuration:

5. Verify configuration and see if you get any errors. Make sure you get no errors/warnings.
6. Toggle Enabled to activate the provider
7. Click Save Configuration

​

Configuration Reference

​

Attribute Mappings

• attributeRoleMappings: map a claim value to a Bifrost role (Admin, Developer, Viewer, or a custom role)
• attributeTeamMappings: map a claim value to a Bifrost team
• attributeBusinessUnitMappings: map a claim value to a Bifrost business unit

1. In the User Provisioning configuration, scroll down to Attribute Mappings
2. Click Add Mapping under the relevant mapping type (Role, Team, or Business Unit)
3. Enter the Attribute (the claim name from the token), the Value to match, and the target Role, Team, or Business Unit
4. Repeat for each rule you need

​

Custom attribute mapping

​

Evaluation rules

• Role mappings: Ordered, first match wins. If no rule matches, users are not allowed to login into the system.
• Team and business unit mappings: All matching rules apply - users can be placed on multiple teams and business units simultaneously.
• Claim values: Can be strings, arrays, or nested objects. Bifrost resolves dotted paths (e.g., realm_access.roles).

5. Click Save Configuration

​

Testing the Integration

1. Open your Bifrost dashboard in a new browser or incognito window
2. You should be redirected to Entra for authentication
3. Log in with an assigned user
4. After successful authentication, you’ll be redirected back to Bifrost
5. Verify the user appears in the Bifrost users list with the correct role

​

Troubleshooting

​

User not redirected to Microsoft login

• Verify the SCIM provider is enabled in Bifrost
• Check that the Bifrost server was restarted after configuration
• Ensure the Tenant ID and Client ID are correct

​

”AADSTS50011: The reply URL does not match”

• Verify the redirect URI in your app registration exactly matches your Bifrost login URL
• Ensure there are no trailing slashes or protocol mismatches (http vs https)

​

“AADSTS7000215: Invalid client secret”

• Regenerate the client secret in Azure
• Ensure you’re using the secret Value, not the secret ID
• Check for any leading/trailing whitespace when copying

​

Token validation errors

• Ensure the Tenant ID matches your Azure directory
• Verify the Client ID is correct
• Check that the app registration is in the same tenant as your users

​

Claim "roles" is not present in the token on login

• User isn’t assigned to a role at the Enterprise Application level. Go to Enterprise applications → Bifrost Enterprise → Users and groups, edit the assignment, and pick a role (admin/developer/viewer). Adding a user to the app without selecting a role does not emit the roles claim.
• Role assignment is via a group that isn’t itself assigned to the app. The group needs to appear in Users and groups with a role selected — Entra does not walk transitive group memberships to populate roles.
• Optional roles claim missing from the manifest. Confirm Step 8 (App Manifest) lists roles under optionalClaims.idToken.
• Sign out and back in. Existing sessions still carry the old token without roles.

​

Bulk user sync assigns Viewer instead of the mapped role

• Confirm the user actually has the app role assigned in Entra (Enterprise applications → Bifrost Enterprise → Users and groups).
• Confirm both Application.Read.All and AppRoleAssignment.ReadWrite.All are granted with admin consent in Step 5. Without these, Bifrost cannot read the app role catalog or per-user assignments via Microsoft Graph, so the synthetic roles claim used by the importer will be empty.
• Server logs will contain [ENTRA-ROLES] failed to fetch app role catalog: ... 403 if the permission is missing.

​

Next Steps

• User Provisioning (SCIM) - Overview of SCIM in Bifrost and alternative identity providers
• Advanced Governance - Learn about user budgets and compliance features
• Role-Based Access Control - Understand the Admin, Developer, Viewer hierarchy
• Audit Logs - Monitor user authentication and activity