It is possible to setup Azure Active Directory together with the piplanning app It is possible to set up Microsoft Entra ID as an OpenID provider with the planning app. With this setup in place, your existing Azure AD Microsoft Entra ID users will be able to login log in to the piplanning planning app without the need for a different account.

The generic instructions are also available on the Microsoft Docs website

Setting up

...

Microsoft Entra ID

1. Go to the Azure portal: https://portal.azure.com/#home
2. Select Azure Active Directory Microsoft Entra ID in the menu
   
3. Go to App registrations Registrations and click on New registration
   
4. Insert the name of the application (e.g., the piplanning app) and the callback URL.
   
   Please note: Depending on how your AD Microsoft Entra ID is configured and which users you want to give access to the piplanning app, you might have to select a different option in the Supported account types section. If login for some users doesn't work, try changing this configuration option.
   
   
   The callback URL can be found on the "Identity Provider" page in the Cockpit.
   
5. Double-check that the permissions are correct. You need the Microsoft Graph User.Read permissions to be able to login successfully.
   Image Removedto log in successfully. In case you want to perform the automatic mapping of Microsoft Entra ID groups to piplanning app teams, you need to add Microsoft Graph Group.Read.All permissions as well.
   Image Added
6. Next is the creation of a client secret. This can be done by going in to the "Certificates & Secrets" menu item and clicking on "New client secret"
   
7. The secret can now be copied and saved. This information is needed in the piplanning app to setup the Identity Provider
   

Setting up the piplanning app

1. Login to the Cockpit and click on the "Idenity Provider" menu item. The OpenID Connect configuration page will open.
   
2. Fill in a connection name of your choice. This name will appear on the your users' login button for your users. (e.g. "Azure ADMicrosoft Entra ID")
3. Leave the "Automatically discover endpoints" option enable enabled and enter as Issuer the following URL: https://login.microsoftonline.com/{tenantId}/v2.0
   The tenant ID must be substituted with the value found on the Azure AD Microsoft Entra ID application registration overview as Directory (tenant) ID:
   
   
   Please note: Depending on your configuration, you might have to use the older version of the API. If login doesn't work with your setup, try to remove /v2.0 from the issuer URL:
   https://login.microsoftonline.com/{tenantId}
   
4. Fill in the client ID that you can also find in the application registration overview as Application (client) ID
5. Fill in the client secret from the value you previously generated under "Certificates & Secrets"
6. In case you want to perform the automatic mapping of Microsoft Entra ID groups to piplanning.io teams, you need to add the "groups" value to the "Groups claim" field. Do not forget to make sure that you have the correct permissions to read groups in your Microsoft Entra ID setup.
   Image Added
7. At this point, the form should be complete, and by clicking "Save," the connection should now be saved.
   

The login screen will now add the option of logging to log in with Azure ADMicrosoft Entra ID.

FAQ

Q: During login, I get the error: "A request to the OpenID Connect Token API has failed. Unable to complete this login request" [Backend error: AADSTS700025 - invalid_client]
A: Make sure you have selected "Web" (instead of a single page application) for the redirect URI in Azure.