Identity Provider (Microsoft Entra ID)

This guide walks through connecting Horizon to Microsoft Entra ID (formerly Azure AD) as an OpenID Connect identity provider, so your users can sign in to Horizon with their corporate account. It also covers SCIM provisioning, so users and group memberships can be synchronized automatically from Entra ID into Horizon.

Prerequisites

• Entra ID tenant administrator access (to register an application and grant admin consent).
• Horizon administrator access (Security > Access Management).

Step 1 — Register an application in Entra ID

1. Sign in to the Azure Portal and go to Microsoft Entra ID > App registrations > New registration.
2. Give the application a name (e.g. Horizon CLM).
3. Leave the Redirect URI empty for now — you'll add it in Step 3, once Horizon has generated the exact callback URL for this provider.
4. Click Register.
5. On the application's Overview page, note the Application (client) ID and Directory (tenant) ID — you'll need both.
6. Go to Certificates & secrets > Client secrets > New client secret. Set an expiry per your organization's policy, then copy the generated secret value immediately — it is not shown again.
7. Go to API permissions and confirm the delegated Microsoft Graph permissions openid, profile, and email are present. Grant admin consent for the tenant if required by your organization's policy.

Step 2 — Create credentials in Horizon

1. In Horizon, go to Security > Credentials.

2. Click Add a Credential.

3. Fill the different attributes:

   Field	Value
   Credentials Type	Select Login.
   Name	A unique label for this credential (e.g. entraid-oidc).
   Target	Select Identity Providers.
   Login	The Application (client) ID from Step 1.
   Password	The client secret value from Step 1.

Step 3 — Create the identity provider in Horizon

1. In Horizon, go to Security > Access Management > Identity Providers.

2. Click Add.

3. Select identity provider type OpenID Connect and fill in the fields:

   Field	Value
   Name	A unique, meaningful name (e.g. entraid).
   Provider metadata URL	https://login.microsoftonline.com/<tenant-id>/v2.0/.well-known/openid-configuration, replacing <tenant-id> with the Directory (tenant) ID from Step 1.
   Client credentials	The credential created in Step 2.
   Scope	openid profile email
   Identifier Claim	{{oid}} — Entra ID's stable, unique object ID for the user. Preferred over email or UPN since it never changes.
   Email Claim	{{email}}
   Name Claim	{{name}}
   Enable	Yes
   Enabled on UI	Yes

4. On the Languages tab, add a display name (e.g. "Microsoft Entra ID" or "Corporate SSO") so users recognize the option on the login screen.
5. Click Save. Horizon generates the exact callback (redirect) URL for this provider — open the saved identity provider to retrieve it.
6. Back in the Azure Portal, go to your app registration > Authentication > Add a platform > Web, paste the redirect URI generated by Horizon, and click Save.

Step 4 — Test sign-in

1. Log out of Horizon.
2. On the login screen, select the identity provider you created.
3. Complete the Microsoft sign-in flow.
4. Confirm you're redirected back to Horizon, authenticated as your Entra ID identity.

Step 5 — Provision users and teams automatically with SCIM (optional)

Instead of relying on just-in-time user creation at first login, Entra ID can push users and group memberships into Horizon automatically via SCIM 2.0, mapping Entra ID groups to Horizon roles or teams.

SCIM has no OIDC/OAuth flow of its own — Entra ID authenticates to Horizon's SCIM endpoint using plain HTTP Basic (or bearer) auth, encoded as base64 Login:Password. This is a separate credential from the OIDC client credentials used for SSO in Step 2: create a dedicated local account and role for it, scoped to only what SCIM provisioning needs, rather than reusing an administrator account.

1. In Horizon, go to Security > Access Management > Roles and click Add. Give it a unique Name (e.g. entraid-scim) and grant only the permissions required to manage users, teams, and role membership. Save.

2. Go to Security > Access Management > Local Accounts and click Add. Set an Identifier (e.g. entraid-scim), assign it the role created above, and set its password — this identifier/password pair becomes the Login:Password used in the SCIM Basic Auth header.

3. In Horizon, go to Security > SCIM Profiles and click Add.

4. Give it a unique Name and save.

5. Edit the profile's SCIM-specific parameters:

   Field	Description
   Mail type	The SCIM mail type to synchronize into Horizon. Defaults to work.
   Mappings	One or more mappings from a SCIM group name (as sent by Entra ID) to either a Horizon role or a team — not both. Add as many mappings as you have groups to synchronize.

6. Note this profile's SCIM base URL: https://<horizonUrl>/security/scim/<scimProfileName>/.

7. In the Azure Portal, open your app's corresponding Enterprise application > Provisioning, set Provisioning Mode to Automatic, set Tenant URL to the SCIM base URL above, and set Secret Token to the base64-encoded Login:Password of the local account created in Step 2.

8. Click Test Connection, then start provisioning.

Troubleshooting