Azure AD SSO Setup (OIDC)
This guide walks you through configuring Microsoft Entra ID (formerly Azure Active Directory) as your identity provider for Ledly using OpenID Connect (OIDC).
Azure AD SSO requires an Azure subscription with Azure Active Directory and a Ledly Enterprise plan ($1,999/mo).
Prerequisites
- Azure Portal access with Application Administrator or Global Administrator role
- Ledly organization administrator access
- Ledly Enterprise plan ($1,999/mo)
Configuration Values
You’ll need this Ledly value when configuring Azure AD:
| Setting | Value |
|---|---|
| Redirect URI | https://ledlyv2-production.up.railway.app/api/sso/azure/callback |
Step 1: Register Application in Azure
Log in to Azure Portal
Navigate to portal.azure.com and sign in with your administrator account.
Navigate to Azure Active Directory
- In the search bar, type Azure Active Directory (or Microsoft Entra ID)
- Click on Azure Active Directory in the results
Go to App registrations
- In the left sidebar, click App registrations
- Click New registration at the top
Register the application
Fill in the registration form:
| Field | Value |
|---|---|
| Name | Ledly SSO |
| Supported account types | Select based on your needs (typically “Accounts in this organizational directory only”) |
| Redirect URI | Select Web and enter: https://ledlyv2-production.up.railway.app/api/sso/azure/callback |
Click Register to create the application.
Step 2: Configure Authentication
Get Application IDs
After registration, you’ll be on the application overview page. Copy these values:
| Value | Location | Description |
|---|---|---|
| Application (client) ID | Overview page | Your Client ID |
| Directory (tenant) ID | Overview page | Your Tenant ID |
Save these values securely - you’ll need them to configure Ledly.
Verify Redirect URI
-
Click Authentication in the left sidebar
-
Verify the redirect URI is correctly set to:
https://ledlyv2-production.up.railway.app/api/sso/azure/callback -
Under Implicit grant and hybrid flows, ensure these are checked:
- Access tokens
- ID tokens
-
Click Save if you made changes
Step 3: Create Client Secret
Navigate to Certificates & secrets
- In the left sidebar, click Certificates & secrets
Create new client secret
- Click New client secret
- Enter a description:
Ledly SSO Secret - Select an expiration period (recommended: 24 months)
- Click Add
Copy the secret value
The secret value is only shown once. Copy it immediately.
| Field | What to copy |
|---|---|
| Value | The secret value (long string) - this is your Client Secret |
| Secret ID | Keep for reference (you may need to identify which secret to rotate) |
Critical: Copy the secret value immediately after creation. It will be hidden after you leave this page and cannot be retrieved - you would need to create a new secret.
Step 4: Configure API Permissions (Optional)
Default permissions are usually sufficient, but verify these are granted:
Check permissions
- Click API permissions in the left sidebar
- Ensure Microsoft Graph → User.Read is listed
Grant admin consent (if required)
If your organization requires admin consent:
- Click Grant admin consent for [Your Organization]
- Click Yes to confirm
Step 5: Configure Ledly
Now configure Ledly to use your Azure AD application:
Navigate to SSO Settings
- Log in to Ledly at app.ledly.io
- Go to Settings → SSO
Select Azure AD
Select Azure AD (OIDC) as your identity provider.
Enter Configuration Values
Enter the values you collected from Azure:
| Field | Value |
|---|---|
| Tenant ID | Your Directory (tenant) ID from Azure |
| Client ID | Your Application (client) ID from Azure |
| Client Secret | The secret value you created |
Configure SSO Options
| Option | Recommended Setting |
|---|---|
| Auto-provision users | Enabled - Creates accounts for new SSO users |
| Default role | Member - New users start with member permissions |
| Allow password login | Your choice - Enable for fallback access |
Save Configuration
Click Save to apply the SSO configuration.
Step 6: Test SSO
Test with an Admin Account First
- Open an incognito/private browser window
- Navigate to your Ledly login page
- Click Sign in with SSO or enter your email
- Verify you’re redirected to Microsoft login
- Sign in with your Azure AD credentials
- If prompted, consent to the permissions requested
- Confirm you’re redirected back to Ledly and logged in
Verify User Attributes
After logging in via SSO:
- Go to Settings → Profile
- Verify your name and email were populated correctly
Test JIT Provisioning (Optional)
- Have a user who doesn’t have a Ledly account sign in via SSO
- Verify their account was automatically created
Configuration Reference
OIDC Endpoints
Azure AD uses standard OIDC discovery. The endpoints are automatically derived from your Tenant ID:
| Endpoint | URL |
|---|---|
| Discovery | https://login.microsoftonline.com/{tenant-id}/v2.0/.well-known/openid-configuration |
| Authorization | https://login.microsoftonline.com/{tenant-id}/oauth2/v2.0/authorize |
| Token | https://login.microsoftonline.com/{tenant-id}/oauth2/v2.0/token |
| UserInfo | https://graph.microsoft.com/oidc/userinfo |
Supported Scopes
Ledly requests the following OIDC scopes:
| Scope | Purpose |
|---|---|
openid | Required for OIDC |
profile | Access to name claims |
email | Access to email claim |
Token Lifetimes
| Token | Default Lifetime |
|---|---|
| Access token | 1 hour |
| Refresh token | 90 days |
| ID token | 1 hour |
Conditional Access Policies
Azure AD Conditional Access can be used to enforce additional security:
Recommended Policies
| Policy | Description |
|---|---|
| Require MFA | Require multi-factor authentication for Ledly access |
| Trusted locations | Only allow access from corporate networks |
| Compliant devices | Require devices to be enrolled and compliant |
| Sign-in risk | Block or require MFA for risky sign-ins |
Configuring Conditional Access
- Go to Azure Active Directory → Security → Conditional Access
- Create a new policy
- Under Cloud apps or actions, select your Ledly SSO application
- Configure your conditions and access controls
- Enable the policy
Conditional Access policies are enforced at the Azure AD level and apply to all SSO logins to Ledly.
Troubleshooting
”Invalid Client ID” Error
Possible causes:
- Client ID was not copied correctly
- Application was deleted
Solutions:
- Verify the Application (client) ID in Azure matches what’s configured in Ledly
- Check that the application still exists in Azure AD
”Invalid Client Secret” Error
Possible causes:
- Secret value was not copied correctly
- Secret has expired
Solutions:
- In Azure, go to Certificates & secrets
- Check if the secret has expired
- Create a new secret if needed and update Ledly
”Redirect URI Mismatch” Error
Possible causes:
- Redirect URI doesn’t match exactly
Solution: Verify the redirect URI in Azure AD is exactly:
https://ledlyv2-production.up.railway.app/api/sso/azure/callbackCheck for:
- Trailing slashes
- HTTP vs HTTPS
- Typos
”AADSTS50011: The reply URL does not match”
This is the Azure-specific version of redirect URI mismatch:
- In Azure Portal, go to your app registration
- Click Authentication
- Ensure the redirect URI matches exactly
- Click Save and wait a few minutes for propagation
”User Not in Directory” Error
Possible causes:
- User is not a member of your Azure AD tenant
- Using the wrong account type selection
Solutions:
- Verify the user exists in your Azure AD
- Check the “Supported account types” setting in your app registration
- For guest users, ensure guest access is enabled
Secret Expiration
When your client secret expires:
- In Azure, go to Certificates & secrets
- Click New client secret
- Copy the new secret value
- Update the secret in Ledly Settings → SSO
- Delete the old secret in Azure
Set a calendar reminder for secret expiration. Secrets expire silently and will break SSO when they do.
Revoking SSO Access
Remove User Access
To remove a specific user’s access to Ledly:
- Use Conditional Access to block the user, or
- Remove the user from Azure AD entirely
Disable SSO Integration
To disable SSO for your entire organization:
In Ledly:
- Go to Settings → SSO
- Toggle off the SSO configuration or select “None” as provider
In Azure (optional):
- Go to your Ledly app registration
- Click Delete to remove the application entirely
Support
If you need help with Azure AD SSO setup:
- Ledly Support: [email protected]
- Microsoft Documentation: docs.microsoft.com/azure/active-directory
When contacting support, include:
- Your Ledly organization ID
- Your Azure tenant ID (not the client secret)
- Any error messages displayed
- Screenshots of your Azure configuration (redact secrets)