AdministrationSSO

Use Entra ID for SSO

Use this guide to create an app in Entra ID and integrate it into the Method Platform’s authentication service for SSO.

Setup Azure Entra ID

In the Microsoft Azure portal, click into Microsoft Entra ID.

When you click on the menu, you’ll be to redirect to the tenant overview. If you don’t have any tenants, please see the Quickstart to create a new tenant.

Register a new Enterprise Application

On this page click Add and then Enterprise application.

On the Browse Microsoft Entra App Gallery page, select Create your own application, and then Method Platform as the Name.

You should now see your Enterprise application within Entra. The next step is to set up an OIDC provider. To do so, click on App registrations in the left-hand sidebar. You will see an app that shares the same name as the Enterprise application you just created. Once you click in, set up a redirect URI:

We will now configure our redirect URI:

1

Platform Type

Under “Platform Configurations” select Web for the platform type.

2

Redirect URI

When prompted for your Redirect URI, enter https://keycloak.<method-instance>.method.delivery/realms/method/broker/entra/endpoint.

Instance name

Make sure to fill in the name of your Method instance in the URI above.

3

Supported account type

For “Supported account types”, please select Accounts in this organizational directory only

4

Save

Click Save to save the configuration

Create Client secrets

On the app overview page, select Add a certificate or secret or on the left sidebar select Certificates & secrets.

Next, select New client secret.

Fill out a description of Method Platform Client Secret and keep recommended 180 days.

Copy the Value immediately because you will not be able to see this value again.

Share Information with your Method Mission Ops team

There will be three pieces of information you need to share with your Method Mission Ops team:

  1. The Client Secret copied in the previous step
  2. An endpoint URI with OpenID information
  3. Application (Client ID)

Get OpenID Endpoint URI

On the App main page, click Endpoints.

On the drawer that opens up, copy the value for OpenID Connect metadata document.

Get the Application (Client ID)

On the App main page, copy the value for Application (Client ID).

Send three pieces of information to Method Mission Ops team

Ensure that this information is sent securely.

Test login

Once you are notified by your Method Mission Ops team, you should see a new Entra option when logging into Method Platform.

Set up SCIM provisioning

SCIM provisioning is an optional step which allows you to sync users and group membership from Entra to Method. This allows you to manage users’ permissions within the platform from your IdP, since the IdP controls group membership, and group membership determines permissions in Method.

Get the integration token from Method Platform

1

Log in to Method Platform

Log in to Method Platform using SSO.

3

Create a new integration

Click the + button. In the dialog, select Entra as the identity provider and click Create integration.

4

Generate a bearer token

Click Create token and copy the bearer token. You will need this when configuring SCIM in Entra.

Save your token

The token value will not be accessible after you close this dialog. If you lose it, you will need to generate a new one.

Configure SCIM in Entra

Head back to your application under Enterprise apps in the left hand sidebar. Once inside the application configuration, go to Provisioning and click Connect your application.

On the next screen, perform the following steps:

1

Authentication Method

Leave as Bearer authentication.

2

Tenant URL

Your URL will look like https://<method-instance>.method.delivery/bulwark/api/scim/v2/

Instance name

Make sure to fill in the name of your Method instance in the URI above.

3

Secret Token

Paste the bearer token you copied from Method.

4

Test

Test the connection.

Attribute mappings

Method Platform supports the following SCIM user attributes:

  • userName
  • active
  • displayName
  • title
  • emails (work email value and primary flag)
  • preferredLanguage
  • name (givenName, familyName, formatted, middleName, honorificPrefix, honorificSuffix)
  • addresses (formatted, street, locality, region, postalCode, country, primary)
  • phoneNumbers (work, mobile, fax)
  • userType
  • nickName
  • locale
  • timezone

Attributes not listed above are accepted but ignored.

You are now set up to provision users from Entra ID to Method Platform. Assign users or groups to the enterprise application in Entra to begin provisioning.