Skip to main content

Configure Microsoft Entra ID

This guide connects DIAL to Microsoft Entra ID so users authenticate with their organizational account and DIAL authorizes them by Entra security group. For the shared workflow, see the SSO / IdP setup overview.

Prerequisites​

  • A running DIAL deployment and the URL of your DIAL Chat instance, referred to below as <chat_url>.
  • A Microsoft Entra tenant with permission to register applications.

Step 1: Configure Microsoft Entra ID​

  1. Register an application (Microsoft's quickstart):
    • Supported account types: typically Accounts in this organizational directory only (Single tenant)
    • Redirect URI: Web + <chat_url>/api/auth/callback/azure-ad
  2. Create a client secret under Certificates & secrets and save its value.
  3. Gather facts: the Application (client) ID (<azure_client_id>), Directory (tenant) ID (<azure_tenant_id>), and the client secret (<azure_client_secret>).
  4. (Optional, RBAC) Create a group, add members, and assign the group to the application under Enterprise applications → Users and groups.
  5. (Optional, RBAC) Add a groups claim under Token Configuration, selecting Groups assigned to the application and Group ID. Review the caveats for group claims.

Step 2: Configure DIAL Chat​

Set these environment variables on DIAL Chat. See DIAL Chat configuration — Azure AD for the full list.

AUTH_AZURE_AD_CLIENT_ID: "<azure_client_id>"
AUTH_AZURE_AD_TENANT_ID: "<azure_tenant_id>"
AUTH_AZURE_AD_SECRET: "<azure_client_secret>"
AUTH_AZURE_AD_SCOPE: "openid profile <azure_client_id>/.default email offline_access"
tip

The application scope above is required to validate the access token signature.

Step 3: Configure DIAL Core​

Add the provider to the identityProviders section of DIAL Core static settings (settings.json). Generate a random loggingSalt, for example with pwgen -s 32 1.

{
  "identityProviders": {
    "azure": {
      "jwksUrl": "https://login.microsoftonline.com/<azure_tenant_id>/discovery/v2.0/keys",
      "issuerPattern": "^https:\\/\\/sts\\.windows\\.net.+$",
      "loggingKey": "sub",
      "loggingSalt": "<random_salt>",
      "rolePath": "groups"
    }
  }
}

rolePath is groups, so DIAL reads the Entra group IDs from the token. For every setting, see the Identity providers reference.

note

DIAL Core reads static settings at startup. Restart Core after editing settings.json. Each setting can also be supplied as an aidial.identityProviders.azure.* environment variable.

Step 4: Assign roles to resources​

In config.json (dynamic settings), add an Entra group name (or ID) to a deployment's userRoles array.

{
  "models": {
    "chat-gpt-35-turbo": {
      "userRoles": ["azure-group-name"]
    }
  }
}

Result​

Users log in through Entra ID, and DIAL Core authorizes their requests based on Entra group membership.

Further reading​