> For the complete documentation index, see [llms.txt](https://docs.frends.com/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://docs.frends.com/api-portal/general/admin-roles-and-user-management/how-to-set-up-entra-id-sso-for-api-portal.md).
# How to set up Entra ID SSO for API Portal
Allow your users to log in with their company credentials.
Single Sign-On (SSO) lets users of your Frends API Portal sign in with their corporate identity provider instead of managing a separate email and password for the portal. This centralizes authentication in your existing identity infrastructure, strengthens security, and removes the burden of remembering another set of credentials for your users.
SSO is configured at the portal level by API Portal Administrators and is offered as an additional login option alongside the built-in email and password method, so external users and customers can still log in with their own credentials if you prefer.
{% hint style="info" %}
Note that Frends Tenant, API Portal and Business Automation Portal all use different configuration for SSO. Please follow the corresponding instructions to set up each SSO.
{% endhint %}
## Prerequisites
Before you begin, make sure you have the following in place:
* Access to the Microsoft Entra ID tenant that will act as the identity provider, with permissions to create and configure an application registration.
* API Portal Administrator rights in the Frends API Portal, since only Portal Administrators can configure and manage SSO settings.
## Configuring the Application in Microsoft Entra ID
The first step is to create an application registration in your Entra ID tenant. This application represents the API Portal and allows it to delegate authentication to your identity provider.
Sign in to the Microsoft Entra admin center and navigate to **Microsoft Entra ID > Manage > App registrations**. Click **New registration**.
Entra ID app registration view.
Enter a name for the application, for example `Frends API Portal`, and leave the default **Single tenant only** option selected so that only users in your tenant can authenticate.
You do not need to set a redirect URI here, since it is added separately in the next step.
Click **Register** to create the application.
### Configure the Redirect URI
After the application is created, you are taken to its overview page. Note the **Application (client) ID** and the **Directory (tenant) ID**, since you will need both when configuring the API Portal later.
Finding the app details and the Authentication menu item.
Open the application's **Authentication** page from the sidebar (under **Manage**) and click **Add Redirect URI**. Choose **Single-page application** and enter the redirect URI for your portal in the following format:
```
https://{your-api-portal-domain.com}/login-sso
```
Replace `{your-api-portal-domain.com}` with the actual domain of your API Portal. This redirect URI tells Entra ID where to send users after they have authenticated.
Under the **Implicit grant and hybrid flows** section on the same page, select the checkbox for **ID tokens (used for implicit and hybrid flows)**.
Click **Configure** to save the platform.
### Configure Scopes
In the application's sidebar, click **Expose an API** and then click **Add a scope**.
Accept the suggested Application ID URI, which is in the form `api://{client-id}`, or edit it to your liking. Enter `auth` as the **Scope name**, provide a display name and description, and set **State** to **Enabled**.
Click **Add scope** to save your changes. This scope is what the API Portal will request during the login flow, and it must match the scope you configure in the portal later.
Optionally, while you are in the Entra admin center, you can also review the application's **App roles** and **API permissions** if your organization requires additional claims or delegated permissions.
That is all that is required on the Entra ID side. You can now move on to configuring SSO in the API Portal.
## Configuring SSO in the API Portal
In the API Portal, navigate to **Administration** and click **Manage SSO Configurations**. Then click **New configuration** to create a new SSO provider. The API Portal supports multiple SSO configurations, so you can register more than one identity provider if needed.
Fill in the fields using the values from your Entra ID application registration:
* **Name** – A friendly name for this SSO provider. It is shown on the login page as "Login with {Name}".
* **Client ID** – The Application (client) ID of your application in Entra ID, found in the application's overview.
* **Authority** – `https://login.microsoftonline.com/{tenantId}/v2.0`, where `{tenantId}` is your Entra ID tenant ID.
* **Redirect URI** – The same URI you configured in the Entra ID Redirect URI step, for example `https://{your-api-portal-domain.com}/login-sso`.
* **Audience** – The Azure application's Application ID URI, which can be found in the application's overview section.
* **Issuer** – Most likely the same value as the Authority, `https://login.microsoftonline.com/{tenantId}/v2.0`.
* **Scopes** – The name of the scope you created, in the form `api://{clientId}/auth`.
* **Metadata address** – `https://login.microsoftonline.com/{tenantId}/v2.0/.well-known/openid-configuration`.
When you have filled in the fields, save the changes. The "Login with {Name}" option now appears on the API Portal login screen, and users from your organization can sign in using your corporate identity provider.
## How SSO Behaves at Login
When SSO is configured, it appears as an additional login option alongside email and password authentication. This gives you flexibility: users from your own organization can choose to sign in with SSO, while external users or customers can continue using email and password. Only API Portal Administrators have permission to configure and manage these settings, which keeps authentication controlled centrally and integrated correctly with your identity infrastructure.
For users who authenticate with email and password, password management remains available through the profile menu, including password changes and reset flows. SSO users authenticate through your identity provider instead and do not manage separate portal passwords.
For more information on the roles involved in managing the portal and its authentication, see the API Portal documentation on admin roles and user management.
---
# Agent Instructions
This documentation is published with GitBook. GitBook is the documentation platform designed so that both humans and AI agents can read, navigate, and reason over technical content effectively. Learn more at gitbook.com.
## Querying This Documentation
If you need additional information that is not directly available in this page, you can query the documentation by asking a question.
Perform an HTTP GET request on the following URL with the `ask` and `goal` query parameters:
```
GET https://docs.frends.com/api-portal/general/admin-roles-and-user-management/how-to-set-up-entra-id-sso-for-api-portal.md?ask=&goal=
```
`ask` is the immediate question: it should be specific, self-contained, and written in natural language.
`goal` is what the user is ultimately trying to achieve, the reason they need the answer. Sharing it helps GitBook give you a better, more relevant answer. A goal is most helpful when it describes the outcome the user wants rather than restating the question. For example, with `ask=how do I create an API token`, a goal like `automate deployments from our CI pipeline` lets GitBook tailor the answer to that use case.
The response will contain a direct answer to the question and relevant excerpts and sources from the documentation.
Use this mechanism when the answer is not explicitly present in the current page, you need clarification or additional context, or you want to retrieve related documentation sections.
