How to configure Microsoft OpenID Connect authentication

This article describes how to configure OpenID Connect with Microsoft Entra ID as an authentication method in Templafy.

Configuration

1. Go to the Account tab in the left-side menu of the Admin Center
2. Go to the Authentication tab
3. Click on Add authentication method
4. Type in the name of the Authentication method id
5. Type in the name of the Login button name
6. Select Microsoft Entra ID in the drop-down
7. Fill in the Domain hint (optional) and Microsoft Entra Tenant ID
8. Configure Advanced Options (if necessary)
9. Click Save

Authentication Parameters

Authentication Method Id

The Authentication method ID is a unique and non-editable value used to identify the authentication method itself. This is a required field and can be referenced as an installation parameter in Templafy Desktop deployment or distributed via Registry key. Using this id, users will not have to select an authentication method each time the Refresh Token is being renewed and the login shall succeed quietly without their interaction.

Login Button Name

This name will be shown to users when logging into Templafy, if multiple authentication methods are configured on the tenant. It is therefore imperative to give the button a meaningful and distinctive name to better guide users to the correct authentication method.

Domain Hint

Every Microsoft Entra ID Tenant can be connected with one or more DNS domains. Usually, the default domain format assigned by Microsoft is "mycompanydomain.onmicrosoft.com". More often than not, however, the primary domain is set to be the same as your email domain "mycompanydomain.com"

If you are not certain which domain to provide, you can always check for your primary domain in portal.azure.com > Microsoft Entra ID > Overview

Microsoft Entra Tenant ID

Tenant ID is a globally unique identifier (GUID) that is different than your tenant name or domain. It can be found under portal.azure.com > Microsoft Entra ID > Overview

Advanced options

You can restrict access to specified email domains with the Restricted domains setting or restrict access based on the Discriminator claim name setting.