# Entra or Azure AD Implementation **URL:** \ **Category:** Ignition\ **Tags:** perspective, ignition81\ **Created:** [July 2, 2024, 4:51pm UTC](https://forum.inductiveautomation.com/t/entra-or-azure-ad-implementation/92701 "2024-07-02T16:51:32Z")\ **Posts on this page:** 10\ **Page:** 1
**Author:** ![scadafan](https://avatars.discourse-cdn.com/v4/letter/s/90db22/32.png) [@scadafan](https://forum.inductiveautomation.com/u/scadafan)\ **Post date:** [July 2, 2024, 4:51pm UTC](https://forum.inductiveautomation.com/t/entra-or-azure-ad-implementation/92701/1 "2024-07-02T16:51:32Z")
Hi there, Is there a step by step guide somewhere on how to implement Entra or Azure AD into Ignition? I cannot seem to find anything out there for it. ---
**Author:** ![wbaker](https://sea1.discourse-cdn.com/inductiveautomation/user_avatar/forum.inductiveautomation.com/wbaker/32/85315_2.png) [@wbaker](https://forum.inductiveautomation.com/u/wbaker)\ **Post date:** [July 3, 2024, 3:42am UTC](https://forum.inductiveautomation.com/t/entra-or-azure-ad-implementation/92701/2 "2024-07-03T03:42:23Z")
I worked thru this and had success. Additionally, you will need to create a ‘group claim’ in Entra on the App Registration so your groups from AD come thru. [https://forum.inductiveautomation.com/t/bug-12277-openid-to-microsoft-azure/21745/7](https://forum.inductiveautomation.com/t/bug-12277-openid-to-microsoft-azure/21745/7) ---
**Author:** ![scadafan](https://avatars.discourse-cdn.com/v4/letter/s/90db22/32.png) [@scadafan](https://forum.inductiveautomation.com/u/scadafan)\ **Post date:** [July 14, 2024, 3:16am UTC](https://forum.inductiveautomation.com/t/entra-or-azure-ad-implementation/92701/3 "2024-07-14T03:16:10Z")
Ok after some I investigating and looking into the link. I came across another link: > **[Active Directory SSO Disabled for 8.1.17 & 7.9.20](https://support.inductiveautomation.com/hc/en-us/articles/5979279808397-Active-Directory-SSO-Disabled-for-8-1-17-7-9-20)** > > A security vulnerability was found when enabling the SSO (Single Sign-On) feature for AD (Active Directory) User Source profiles. As a result, the feature will be disabled for both Ignition version... What are you doing to overcome this issue? ---
**Author:** ![Kevin.Herron](https://sea1.discourse-cdn.com/inductiveautomation/user_avatar/forum.inductiveautomation.com/kevin.herron/32/7259_2.png) [@Kevin.Herron](https://forum.inductiveautomation.com/u/Kevin.Herron)\ **Post date:** [July 14, 2024, 11:50am UTC](https://forum.inductiveautomation.com/t/entra-or-azure-ad-implementation/92701/4 "2024-07-14T11:50:42Z")
Entra is an identity provider, the article you linked to is not relevant as integrating with it will not use those authentication profiles. ---
**Author:** ![scadafan](https://avatars.discourse-cdn.com/v4/letter/s/90db22/32.png) [@scadafan](https://forum.inductiveautomation.com/u/scadafan)\ **Post date:** [July 14, 2024, 2:04pm UTC](https://forum.inductiveautomation.com/t/entra-or-azure-ad-implementation/92701/5 "2024-07-14T14:04:00Z")
Don't I need to enable SSO setting in Ignition to allow the IDP to work within Ignition? ---
**Author:** ![paul-griffith](https://sea1.discourse-cdn.com/inductiveautomation/user_avatar/forum.inductiveautomation.com/paul-griffith/32/37249_2.png) [@paul-griffith](https://forum.inductiveautomation.com/u/paul-griffith)\ **Post date:** [July 14, 2024, 5:31pm UTC](https://forum.inductiveautomation.com/t/entra-or-azure-ad-implementation/92701/6 "2024-07-14T17:31:07Z")
No. The legacy SSO feature in the linked article wasn't true SSO and was only relevant to Ignition's bespoke 'user source'/'authentication profile' concept. SSO as it is used in modern contexts, especially in relation to IdPs, is an entirely different feature with no overlap. ---
**Author:** ![scadafan](https://avatars.discourse-cdn.com/v4/letter/s/90db22/32.png) [@scadafan](https://forum.inductiveautomation.com/u/scadafan)\ **Post date:** [July 14, 2024, 5:43pm UTC](https://forum.inductiveautomation.com/t/entra-or-azure-ad-implementation/92701/7 "2024-07-14T17:43:54Z")
Could you provide me a guide on how to set this up? ---
**Author:** ![paul-griffith](https://sea1.discourse-cdn.com/inductiveautomation/user_avatar/forum.inductiveautomation.com/paul-griffith/32/37249_2.png) [@paul-griffith](https://forum.inductiveautomation.com/u/paul-griffith)\ **Post date:** [July 14, 2024, 7:22pm UTC](https://forum.inductiveautomation.com/t/entra-or-azure-ad-implementation/92701/8 "2024-07-14T19:22:58Z")
Have you worked through the guide linked above? I don't have any better resource to offer. > [@\[BUG-12277\] OpenID to Microsoft Azure](https://forum.inductiveautomation.com/t/bug-12277-openid-to-microsoft-azure/21745/7): > > Which browser are you using? Do you get the same exception if you try logging in from a private window? I did not alter the default user attribute mapping for an OIDC IdP, which is a direct mapping to ‘sub’ for ID and username and no mapping configured for the other attributes. Here are the steps I took to setup AAD as an OP for Ignition: [How to set up Azure Active Directory as an OpenID Connect Provider for Ignition.pdf](https://us1.discourse-cdn.com/inductiveautomation/original/2X/f/fcc18f168199f7ae581e4855677b00f22890b020.pdf) (2.7 MB) ---
**Author:** ![scadafan](https://avatars.discourse-cdn.com/v4/letter/s/90db22/32.png) [@scadafan](https://forum.inductiveautomation.com/u/scadafan)\ **Post date:** [July 15, 2024, 2:16am UTC](https://forum.inductiveautomation.com/t/entra-or-azure-ad-implementation/92701/9 "2024-07-15T02:16:04Z")
Isn't there a SAML version out there. I know when I set it up originally it worked but kept asking for a profile to connect with it ---
**Author:** ![scadafan](https://avatars.discourse-cdn.com/v4/letter/s/90db22/32.png) [@scadafan](https://forum.inductiveautomation.com/u/scadafan)\ **Post date:** [July 17, 2024, 7:20pm UTC](https://forum.inductiveautomation.com/t/entra-or-azure-ad-implementation/92701/10 "2024-07-17T19:20:57Z")
I want to ask a follow up question when it comes to using Federated IdP via the SAML or OpenID Connect protocols. What exactly is needed to get this going? Is there any documentation on this?