Configure an Auth Provider for Microsoft App Manually

Add an Auth Provider credential to establish a secure connection between Salesforce and Microsoft.

Note This step is part of manually integrating Microsoft 365 Azure with Salesforce. To refer to guided setup, see Set Up Microsoft 365 and Azure Integration Using Guided Setup.

REQUIRED EDITIONS
Available in: Lightning Experience
Available in: Enterprise, Unlimited, Professional, and Developer Editions

USER PERMISSIONS NEEDED
To configure Auth. Provider:	System Administrator

Ensure that Application (client) ID and Client Secret Value correspond to your Azure account. If the ID and value don't match with your Azure account, the add-in fails to function correctly or doesn't load as expected and could result in graph API issues.

1. From Setup, in the Quick Find box, enter Auth. Providers, and then select Auth. Providers.
2. Click New, and select Open ID Connect as the provider type.
3. Enter MicrosoftApp as the Auth Provider name.
   The URL automatically gets suffixed with MicrosoftApp.
4. In Consumer Key, enter your Azure App's Application (client) ID.
5. In Consumer Secret, enter your Azure App's Client Secret Value.
6. In Authorize Endpoint URL, enter https://login.microsoftonline.com/organizations/oauth2/v2.0/authorize
7. In Token Endpoint URL, enter https://login.microsoftonline.com/organizations/oauth2/v2.0/token
8. In User Info Endpoint URL, enter https://graph.microsoft.com/oidc/userinfo
9. In Default Scopes, enter https://graph.microsoft.com/Files.ReadWrite.All offline_access openid User.ReadWrite.All
   

   Note Ensure that Default Scopes matches the API permissions that you added to your Microsoft Azure account. See Configure a Microsoft Azure App Manually.
10. Ensure Send client credentials in header is unselected.
11. Select Send access token in header and Include Consumer Secret in SOAP API Responses.
12. For Registration Handler, click Automatically create a registration handler template.
13. In Execute Registration As, select your system admin account.
14. Save your changes.
    It saves your auth provider and generates Salesforce Configuration URLs.
15. Verify that these URLs are generated under Salesforce Configurations.

    • Test-Only Initialization URL

    • Single Sign-On Initialization URL

    • Existing User Linking URL

    • OAuth-Only Initialization URL

    • Callback URL

    • Single Logout URL

16. If an experience cloud site is available in your Salesforce instance, expand Experience Cloud Sites and verify that these URLs are generated.

    • Test-Only Initialization URL

    • Single Sign-On Initialization URL

    • Existing User Linking URL

    • OAuth-Only Initialization URL

    • Callback URL

17. Save your changes.

    

    After you save the Auth. Provider details, a Registration Handler Apex Class gets created. For example, AutocreatedRegHandler1234567890123.
18. Disable automatic synchronization of username and email address.
    By default, when you link Salesforce to Microsoft Azure, the system automatically updates your Salesforce username and email address with your Microsoft Azure account details. To turn off this automatic update, perform these steps.
    1. Click the Registration Handler Apex Class link.
    2. Click Edit.
    3. Search for the updateUser method and remove or comment out:

       //u.email = data.email;
       //u.lastName = data.lastName;
       //u.firstName = data.firstName;

    4. Save your changes.
19. Add the Callback URL.
    1. Go back to your auth provider.
    2. In the Salesforce Configuration section, copy the callback URL.
    3. Open your Microsoft Azure account, and click Overview.
    4. Click Add a Redirect URL next to Redirect URLs.
    5. Select Add a platform | Web.
    6. Paste the callback URL in Redirect URIs.
    7. Select Access tokens (used for implicit flows) and ID tokens (used for implicit and hybrid flows).
    8. Click Configure.
    9. If you have a partner community set up, go to the Auth. Provider in your org.
    10. From the Experience Cloud Sites section, copy the callback URL.
    11. Open your Microsoft Azure account, and click Authentication.
    12. Go to Web | Redirect URLs , and click Add URL.
    13. Paste the Experience Cloud Site callback URL, and save your changes.
        
20. Test if your Auth. Provider authentication was successful.
    1. From the Salesforce Configuration section, copy the Test-Only Initialization URL.
    2. Paste the URL in the address bar, and press Enter.

       This is a sample text that appears: