Microsoft Entra ID

Entra ID is the most common setup and the most straightforward: every directory has its own issuer, so the tenant key needs no discriminator in the usual case.

1. Create the app registration.

   Entra admin centre → App registrations → New registration. Add a Single-page application platform with the redirect URI set to the portal’s origin.

2. Define app roles.

   In the app registration → App roles, create four roles. Any names work — you map them in step 5 — but matching Seylo’s makes the mapping obvious: viewer, releaser, approver, admin.

3. Assign them to people.

   Enterprise applications → your app → Users and groups. Assignments here arrive in the token’s roles claim.

   Caution

   App roles must be assigned in Enterprise applications, not in the app registration. Defining a role without assigning it produces a token with no roles claim — which signs in successfully and authorises nothing.

4. Register the provider in Seylo.

   Single sign-on → Add provider → preset Microsoft Entra ID. The identifier is your Directory (tenant) ID. Discovery fills in the issuer, the JWKS URI and the endpoints.

5. Set the audiences and the role claim.

   • Audiences: the Application (client) ID and api://<client-id>. Entra mints both forms, and registering only one is a common cause of verify-failed — unexpected "aud" claim value.
   • Role claim: roles.
   • Map each app-role value onto one of Seylo’s four roles.

6. Leave the discriminator blank — unless your registration is AzureADMultipleOrgs and several directories share one issuer, in which case set the discriminator claim to tid and the value to the directory ID.

7. Run test login.

Using groups instead of app roles

Entra emits group object IDs in the groups claim, not group names — unless the app registration’s optional claims are configured with a sAMAccountName/NetBIOS source, which requires on-premises synchronisation.

So: set the role claim to groups and map the object IDs. If you are not sure which IDs will arrive, run test login first — the report prints the raw claim exactly as it came in, and you can copy the values straight out of it.

Tip

App roles are easier to live with than group object IDs, because the mapping table stays readable a year later. Use groups when your access reviews already run on groups and adding app roles would create a second place to look.

Common problems

Symptom	Cause	Fix
Signs in, every action is 403	App roles defined but not assigned, or values not mapped	Assign in Enterprise applications; check the per-value mapping in test login
verify-failed — unexpected "aud" claim value	Only one audience form registered	Register both the client ID and api://<client-id>
unknown-issuer	The directory ID in the registration is not the one minting tokens	Compare iss in the test-login report against the registration
Group names expected, GUIDs arrived	Entra emits object IDs by default	Map the object IDs, or configure optional claims