Microsoft Entra ID
Connect Microsoft Entra ID (Azure AD) to nano with OIDC via an app registration.
Microsoft Entra ID (Azure AD) — OIDC
Entra ID speaks OIDC natively. You register nano as an application, create a client secret, and point nano at your tenant's issuer.
Prerequisites
- Access to the Microsoft Entra admin center (
entra.microsoft.com) with permission to create app registrations. - Your nano host and a chosen provider slug (this guide uses
entra).
Steps
Create the app registration. In the Entra admin center go to Identity → Applications → App registrations → New registration. Give it a name (e.g. nano SIEM) and choose the account types for your organization (typically single tenant).
Set the redirect URI. Under Redirect URI, choose platform Web and enter:
https://<your-nano-host>/auth/callback/entraRegister the app.
Copy the IDs. On the app's Overview page, copy the Application (client) ID and the Directory (tenant) ID — you need the tenant ID for the issuer URL.
Create a client secret. Go to Certificates & secrets → New client secret. Copy the secret's Value immediately (not the Secret ID) — it is only shown once.
(Optional) Emit groups. For group mapping, go to Token configuration → Add groups claim, pick the group types to include, and save. This adds a groups claim to the ID token.
Add the provider in nano. Go to Settings → Single Sign-On → Add provider and enter:
| Field | Value |
|---|---|
| Name | Microsoft Entra ID |
| Slug | entra |
| Issuer URL | https://login.microsoftonline.com/<tenant-id>/v2.0 |
| Client ID | (Application (client) ID) |
| Client Secret | (secret Value from step 4) |
| Scopes | openid email profile |
| Group claim | groups (only if configured in step 5) |
Replace <tenant-id> with your Directory (tenant) ID. Save.
Test it. Sign out and use the Entra ID option on the login page.
Group mapping
By default Entra puts group object IDs (GUIDs) in the groups claim, not display names. Map those GUIDs in nano's group mappings, or configure group-name emission in Token configuration if your tenant supports it.
Troubleshooting
AADSTS50011(redirect mismatch) — the Web redirect URI must be exactlyhttps://<your-nano-host>/auth/callback/entra.- Issuer errors — the issuer must be
https://login.microsoftonline.com/<tenant-id>/v2.0(the/v2.0suffix matters); use the tenant GUID, not the domain. - Secret rejected — make sure you copied the secret Value, not its ID, and that it hasn't expired.