Azure OAuth (EntraID)
The Azure OAuth integration lets operators access ACCELERO using their Microsoft Entra ID accounts (formerly Azure AD), through the OAuth 2.0 protocol. Instead of typing an ACCELERO username and password, the operator clicks Sign in with Microsoft on the login screen and authenticates directly against EntraID.
Beyond login, the integration synchronizes the operator's access profiles from the groups they belong to in EntraID, keeping permissions aligned with the corporate directory.
This integration is provided as a plugin (azure_oauth) and must be installed and enabled by the IONGRADE technical team. Contact support to check compatibility with your ACCELERO version.
Current plugin version: 0.0.1 — compatible with ACCELERO 2.16.8 or higher.
What the integration does
With the plugin enabled, ACCELERO starts accepting authentication via Microsoft Entra ID and reflecting the directory's group structure in operators' profiles.
| Feature | What happens in ACCELERO |
|---|---|
| Login with EntraID | A Sign in with Microsoft button is added to the login screen. The operator is redirected to EntraID, authenticates, and returns to ACCELERO already authenticated |
| Binding by email | The user authenticated in EntraID is associated with the local operator whose email matches that of the Microsoft account |
| Profile synchronization | The operator's groups in EntraID are compared with ACCELERO profiles (by description); matching profiles are linked and those that no longer match are removed |
| Require Azure login | An operator can be configured to authenticate only via EntraID, blocking local login with username and password |
Centralizes authentication in the corporate directory (Entra ID): control over who has access and with which permissions is now managed through EntraID groups, with no parallel password maintenance in ACCELERO.
Configuration
Navigation path: Settings > Plugins - Azure OAuth - EntraID
The configuration screen has the General tab.
The Azure OAuth - EntraID screen (General tab) showing the Enable login with EntraID switch and the Directory (tenant) ID, Application (client) ID, and Client secret fields.
General tab
| Field | Description |
|---|---|
| Enable login with EntraID | Switch that activates the integration. When on, the Microsoft login button appears on the login screen |
| Directory (tenant) ID | Identifier of the EntraID directory (tenant) |
| Application (client) ID | Identifier of the application (client) registered in EntraID |
| Client secret | Secret of the application registered in EntraID |
Screen buttons
| Button | Function |
|---|---|
| Back | Returns without saving |
| Save | Persists the integration configuration |
The values for tenant ID, client ID, and client secret come from the App registration performed in the Microsoft Entra ID portal. The redirect URI that must be registered in EntraID points to the public ACCELERO address followed by azureoauth/callback. Request the app registration from the customer's corporate directory administrator.
Diagram of the OAuth flow: user → Sign in with Microsoft button → authentication in EntraID → return to ACCELERO (callback) → binding by email and profile synchronization → session started.
Login with EntraID
When the integration is enabled, the ACCELERO login screen displays the standard Sign in with Microsoft button, below the local login form.
The ACCELERO login screen with the integration active, showing the Sign in with Microsoft button below the username and password form.
How login works
- The operator clicks Sign in with Microsoft on the login screen.
- ACCELERO redirects the browser to EntraID, requesting access to the user's profile and to the groups they belong to.
- After authenticating, EntraID returns to ACCELERO, which identifies the email of the Microsoft account.
- ACCELERO looks for a local operator with that same email. If found, it synchronizes the profiles and starts the session; if not found, login is refused.
The association between the Microsoft account and the ACCELERO operator is done by email. The operator must already exist in ACCELERO with the same email registered on the EntraID account. Microsoft accounts without a matching operator cannot log in.
Profile synchronization from groups
On each login via EntraID, ACCELERO automatically adjusts the operator's profiles to reflect the groups they belong to in the directory.
How synchronization decides
Matching is done by name: the group's display name in EntraID is compared with the profile description in ACCELERO.
- Group without a linked profile → if a profile exists in ACCELERO with a description equal to the group's, it is linked to the operator.
- Profile that no longer matches any group → is unlinked from the operator.
For synchronization to work, the profile description in ACCELERO must be identical to the group name in EntraID. Define a naming convention aligned between the directory and the ACCELERO profiles.
On each login via EntraID, profiles without a matching group are removed from the operator. The profiles of operators who log in through EntraID are now controlled by the directory groups.
Fields added to entities
Operator
When the integration is enabled, the operator edit form gains the Require Azure login field.
Operator edit form showing the Require Azure login switch, next to the operator enablement field.
| Field | Description |
|---|---|
| Require Azure login | When active, the operator can only sign in through login with EntraID — local login with username and password is blocked |
Use Require Azure login for operators who must authenticate exclusively through the corporate directory, ensuring that access follows EntraID policies (MFA, password expiration, etc.).
Use cases
Enable SSO with Entra ID
- Request that IONGRADE install the
azure_oauthplugin. - In the Microsoft Entra ID portal, register an application and obtain the tenant ID, client ID, and client secret, registering the redirect URI
…/azureoauth/callback. - In
Settings > Plugins - Azure OAuth - EntraID, fill in the three fields and turn on Enable login with EntraID. - Make sure each operator has, in ACCELERO, the same email as their Microsoft account.
- Validate the Sign in with Microsoft button with a test operator.
Mirror directory groups in profiles
- Define a convention where each EntraID group has an ACCELERO profile with the same description.
- Create/adjust the profiles in ACCELERO so that the descriptions match the group names exactly.
- On each operator login, the profiles automatically reflect the groups.
Force corporate authentication for an operator
- Edit the operator that must use EntraID exclusively.
- Enable Require Azure login and save.
- From then on, local login with username and password is blocked for that operator.
Best practices
- Consistent emails: keep the operator's email in ACCELERO identical to the Microsoft account's — it is the binding key.
- Profiles = groups: standardize the naming between ACCELERO profiles and EntraID groups so that synchronization is predictable.
- Protect the client secret: treat the Client secret as a sensitive credential and renew it according to the directory policy.
- Require Azure login with care: when enabling Require Azure login, confirm that the operator can actually authenticate through EntraID before blocking local login.
Troubleshooting
The "Sign in with Microsoft" button does not appear on the login screen
Possible causes:
- The Enable login with EntraID switch is off.
- The plugin is not enabled.
Solution:
- In
Settings > Plugins - Azure OAuth - EntraID, turn on Enable login with EntraID and save. - Confirm with IONGRADE that the plugin is enabled.
Login returns "User not found"
Possible causes:
- No operator exists in ACCELERO with the same email as the Microsoft account.
- The email in the operator record differs from the EntraID email.
Solution:
- Check the account's email in EntraID.
- Confirm that an operator exists with exactly that email in ACCELERO.
The operator's profiles change on their own after login
Cause: synchronization adjusts the profiles according to the EntraID groups on each login.
Solution:
- Check the operator's groups in EntraID.
- Adjust the match between group names and profile descriptions in ACCELERO.
The operator cannot log in with username and password
Cause: the operator has Require Azure login active, which blocks local login.
Solution: instruct the operator to use Sign in with Microsoft, or disable Require Azure login in the operator edit form, if appropriate.
Integration with other modules
Operators
The integration relies on the Operators registry: the binding is done by email and the login behavior is controlled by the Require Azure login field.
Profiles
ACCELERO Profiles are linked and unlinked automatically according to the EntraID groups, with matching by the profile description.
Next Steps
- Operators — Register operators with the email matching that of EntraID
- Profiles — Align the profile descriptions with the directory group names
- Logs and Monitoring — Track authentication events
- Plugins — Learn more about the ACCELERO plugin system