Loading
Salesforce now sends email only from verified domains. Read More
Identify Your Users and Manage Access
Table of Contents
Filter by (0)Add
Select Filters

          No results
          No results
          Here are some search tips

          Check the spelling of your keywords.
          Use more general search terms.
          Select fewer filters to broaden your search.

            Search all of Salesforce Help
            Search all of Salesforce Help
            Configure a Microsoft Authentication Provider

            You are here:

            1. Salesforce Help
            2. Docs
            3. Identify Your Users and Manage Access

            Configure a Microsoft Authentication Provider

            Set up a Microsoft authentication provider so your users can log in to Salesforce with their Microsoft credentials. This provider supports authentication with all services provided by Microsoft Azure Active Directory (AD).

            Required Editions

            Available in: Lightning Experience and Salesforce Classic
            Available in: Enterprise, Performance, Unlimited, and Developer Editions
            User Permissions Needed
            To view the settings: View Setup and Configuration
            To edit the settings:

            Customize Application

            AND

            Manage Auth. Providers

            To configure Microsoft as an authentication provider, complete these steps.

            • Set up a registration handler.
            • Set up an app in Microsoft Azure AD.
            • Define a Microsoft authentication provider in Salesforce.
            • Update your Microsoft app to use the callback URL generated by Salesforce as the redirect URI in Microsoft.
            • Test the single sign-on (SSO) connection.
            • Add the Microsoft authentication provider to your login page.
            Note
            Note For sandbox use cases, you can skip some of these steps and use the Salesforce-managed Microsoft app. For production use cases, always create your own Microsoft app and use its credentials for your authentication provider. The Salesforce-managed app can experience downtime and isn't recommended for production.

            Set Up a Registration Handler

            To use an authentication provider for single sign-on, you must create a registration handler. The registration handler creates users and updates existing users who access Salesforce via the identity provider. You can set up a registration handler with Apex or Flow Builder. For more information, see Create an Authentication Provider Registration Handler.

            Set Up a Microsoft App

            1. Log in to Microsoft Azure, and go to Azure AD.
            2. Create an app, and generate a client secret. For more information, see the Microsoft documentation.
            3. Modify the app settings as needed, including scopes.
            4. Note the application ID and client secret.

            Define a Microsoft Provider in Salesforce

            To set up a Microsoft provider in Salesforce, you need the Microsoft application ID and client secret.

            1. From Setup, in the Quick Find box, enter Auth, and then select Auth. Providers.
            2. Click New.
            3. For the provider type, select Microsoft.
            4. Enter a name for the provider.
            5. Enter the URL suffix, which is used in client configuration URLs. For example, if the URL suffix of your provider is MyMicrosoftProvider, your SSO URL is similar to https://mydomain_url or site_url/services/auth/sso/MyMicrosoftProvider.
            6. For Consumer Key, use the Microsoft application ID.
            7. For Consumer Secret, use the Microsoft client secret.
            8. Optionally, set these fields.
              • For Authorize Endpoint URL, enter the base URL from Microsoft. For example, https://login.microsoftonline.com/common/oauth2/v2.0/authorize. If you leave this field blank, Salesforce uses the version of the Microsoft API that your app uses.
              • For Token Endpoint URL, enter the URL from Microsoft. For example, https://login.microsoftonline.com/common/oauth2/v2.0/token. If you leave this field blank, Salesforce uses the version of the Microsoft API that your app uses.
              • To change the values requested from the Microsoft profile API, enter the User Info Endpoint URL. For example, https://graph.microsoft.com/oidc/userinfo. The requested fields must correspond to the requested scopes. If you leave this field blank, Salesforce uses the version of the Microsoft API that your app uses.
              • To automatically enable the OAuth 2.0 Proof Key for Code Exchange (PKCE) extension, which improves security, select Use Proof Key for Code Exchange (PKCE) Extension. For more information on how this setting helps secure your provider, see Proof Key for Code Exchange (PKCE) Extension.

              • For Token Issuer, enter the source of the authentication token in the form https://URL. For an OAuth 2.0 web server authentication flow, the provider must include an ID token in the response from the token endpoint. Optionally, the provider can include an ID token in the response for a refresh token flow. The ID token is validated against the Token Issuer value and information in the User Info endpoint. The signature of the ID token isn’t validated. The audience for the ID token is the consumer key registered with your authentication provider. Don’t include any other audience values.

              • For Default Scopes, enter the scopes to send along with the request to the authorization endpoint. Otherwise, the hard-coded defaults for the provider type are used.
              • If you enter a consumer key and consumer secret, the consumer secret is included in SOAP API responses by default. To hide the secret in SOAP API responses, deselect Include Consumer Secret in SOAP API Responses. Starting in November 2022, the secret is always replaced in Metadata API responses with a placeholder value. On deployment, replace the placeholder with your consumer secret as plain text, or modify the value later through the UI.
              • For Custom Error URL, enter the URL for the provider to use to report errors.

              • For Custom Logout URL, enter a URL to provide a specific destination for users after they log out, if they authenticated using the SSO flow. Use this field to direct users to a branded logout page or destination other than the default Salesforce logout page. The URL must be fully qualified with an http or https prefix, such as https://acme.my.salesforce.com.Configure single logout (SLO) to automatically log out a user from Salesforce and the identity provider. As the relying party, Salesforce supports OpenID Connect SLO when the user logs out from the identity provider or Salesforce.

            9. To use an Apex registration handler, take these steps.
              1. For Registration Handler Type, select Apex.
              2. For Registration Handler, select an existing Apex class that implements the Auth.RegistrationHandler interface. Or, to create an template for the registration handler, click Automatically create a registration handler template. Edit this class later, and modify the default content before using it.
            10. To use a flow for your registration handler, take these steps.
              1. For Registration Handler Type, select Flow.
              2. For Registration Handler, select an existing flow of the Identity User Registration flow type.
              3. Select a default profile. A default profile is required to run the registration handler. If you don't specify a default profile here, set the default profile in the flow itself.

                If you use the Authentication Provider User Registration flow template, the profile that you set here is automatically stored in the defaultProfileId variable.

              4. Select a default account. If you use your authentication provider for Experience Cloud sites, this account stores new internal users.

                If you use the Authentication Provider User Registration flow template, the profile that you set here is automatically stored in the defaultAccountId variable.

            11. For Execute Registration As, select an execution user to run the Apex class or flow. The user must have the Manage Users permission.

              Execute Registration As provides the context in which the registration handler runs. In production, you typically create a system user for the Execute Registration As user. This way, operations performed by the handler are easily traced back to the registration process. For example, if a contact is created, the system user creates it.

            12. To use a portal with your provider, select the portal from the Portal dropdown list.
            13. For Icon URL, add a path to an icon to display as a button on the login page for a site. This icon applies to an Experience Cloud site only. It doesn’t appear on your Salesforce login page or My Domain login URL. Users click the button to log in with the associated authentication provider for the site. Specify a path to your own image, or copy the URL for one of our sample icons into the field.
            14. To use the Salesforce multi-factor authentication (MFA) functionality instead of your identity provider’s MFA service, select Use Salesforce MFA for this SSO provider. This setting triggers MFA only for users who have MFA applied to them directly. For more information, see Use Salesforce MFA for SSO.
            15. Save your provider.
            16. Note the generated Auth. Provider ID value. You use it with the Auth.AuthToken Apex class.

            After you define the authentication provider, Salesforce generates these client configuration URLs.

            • Test-Only Initialization URL—Salesforce admins use this URL to check that the third-party provider is set up correctly. The admin opens this URL in a browser, signs in to the third party, and is redirected to Salesforce with a map of attributes.
            • Single Sign-On Initialization URL—Use this URL to perform SSO into Salesforce from a third party using its third-party credentials. The user opens this URL in a browser and logs in to the third party. The third party creates or updates a user. Then the third party signs the user in to Salesforce as that user.
            • Existing User Linking URL—Use this URL to link Salesforce users to a third-party account. The user opens this URL in a browser, signs in to the third party, signs in to Salesforce, and approves the link.
            • OAuth-Only Initialization URL—Use this URL to obtain OAuth access tokens for a third party. Users must authenticate with Salesforce for the third-party service to get a token. This flow doesn’t provide for future SSO functionality.
            • Callback URL—Use this URL for the endpoint that the authentication provider calls back to for configuration. The authentication provider must redirect to the callback URL with information for each client configuration URL.
            • Single Logout URL—Use this URL to log users out from multiple apps with a single logout. For example, the user logs out of Salesforce and is logged out of the third-party provider.

            Client configuration URLs support additional request parameters that enable you to direct users to log in to specific sites, obtain customized permissions from the third party, or go to a specific location after authenticating.

            Update Your Microsoft App with the Callback URL

            Go back to Microsoft and update the Redirect URI to use the callback URL generated by Salesforce.

            Test the Single Sign-On Configuration

            In a browser, open the Test-Only Initialization URL on the Auth. Provider detail page. It redirects you to Microsoft and asks you to sign in. You’re then asked to authorize your Microsoft app. After you authorize, you’re redirected to Salesforce.

            Add the Authentication Provider to Your Login Page

            Configure your login page to show the authentication provider as a login option. Depending on whether you’re configuring SSO for an org or Experience Cloud site, this step is different.

             
            Loading
            Salesforce Help | Article