Microsoft Entra ID (Azure AD) – SSO & Connector Permissions

This guide provides a comprehensive, step-by-step walkthrough for administrators to set up Single Sign-On (SSO) with Microsoft Entra ID for FSI Server, secure the integration, and manage access to different Source Connectors on FSI Server.

It covers all licensing tiers—from Entra ID Free (the default plan included in Microsoft 365) to Entra ID P1 and Entra ID P2—highlighting the functional differences, workarounds, and best practices.

Portal Selection: Microsoft Entra Admin Center vs. Azure Portal​

Microsoft provides two web portals to manage directory identities and app registrations. Both portals connect to the exact same directory (tenant) and share all underlying configuration:

In the following steps, navigation paths refer primarily to the Microsoft Entra Admin Center, with corresponding Azure Portal paths noted where applicable.

License Feature Comparison: Free vs. P1 vs. P2​

Depending on your organization's Microsoft 365 / Entra ID plan, different administrative and security capabilities are available:

Architecture & Data Flow​

On FSI Server, digital assets are organized into Source Connectors (such as local storage directories, SAN/NAS shares, or cloud buckets). Access to each connector is governed by FSI Server Groups.

The following diagram illustrates how user attributes in Entra ID map to security groups, pass through the OIDC authorization code flow, and resolve to connector permissions on FSI Server:

Scenario Overview:​

Microsoft Entra Admin Center Configuration​

Step 1: Create Security Groups for Connectors​

In the Microsoft Entra Admin Center, navigate to: 👉 Entra ID → Groups → All groups → New group (In Azure Portal: Microsoft Entra ID → Groups → All groups → New group)

Option A: With Entra ID Free (Static Membership)​

1. Group type: Security
2. Group name: e.g., FSI-Connector-Marketing
3. Membership type: Assigned
4. Under Members, manually select the authorized employees.
5. Repeat for FSI-Connector-Products, FSI-Connector-Archive, and FSI-Administrators.

Option B: With Entra ID P1 (Dynamic User Groups)​

1. Membership type: Dynamic User
2. Under Dynamic user members → Add expression:
   • Property: department, Operator: Equals, Value: Marketing (Expression: (user.department -eq "Marketing"))
3. Benefit: Employees joining or moving to Marketing receive access automatically; access is revoked immediately upon department change.

Option C: With Entra ID P2 (PIM for Admins & Access Reviews)​

• For FSI-Administrators: Set Microsoft Entra roles can be assigned to the group to Yes (this option requires at least an Entra ID P1 license). Combined with Privileged Identity Management (PIM) (P2), administrators only activate their privileges upon request with MFA and approval.
• For FSI-Connector-Archive: Schedule quarterly Access Reviews under ID Governance (formerly Identity Governance) to periodically recertify permissions.

Step 2: Register the Application​

1. Navigate to: 👉 Entra ID → App registrations → New registration (until 2025: Identity → Applications → App registrations; in Azure Portal: Microsoft Entra ID → App registrations → New registration)
2. Configure the following fields:
   • Name: FSI Server (or e.g., FSI Server Media Platform).
   • Supported account types: Select Single tenant only (single-tenant; formerly labeled "Accounts in this organizational directory only").
   • Redirect URI:
     • Platform dropdown: Web (Important: Do NOT select "Single-page application (SPA)"!).
     • URL: https://<fsi-domain>/fsi/interface/ (Example: https://fsi.example.com/fsi/interface/ – Ensure the trailing slash / is included!)
3. Click Register.

Step 3: Record Tenant and Application IDs​

On the application Overview page, record the following values:

• Application (client) ID: e.g., 00000000-0000-0000-0000-000000000000
• Directory (tenant) ID: e.g., 11111111-2222-3333-4444-555555555555

Step 4: Configure Authentication & Back-Channel Logout​

1. In the app menu, select Authentication.
2. Under Web, verify the Redirect URI: https://<fsi-domain>/fsi/interface/.
3. Under Logout URL:
   • Front-channel logout URL: Leave empty.
   • Back-channel logout URL: Enter the FSI Server logout endpoint: https://<fsi-domain>/service/oidc/logout
4. Under Implicit grant and hybrid flows:
   • Ensure both Access tokens and ID tokens are unchecked (disabled). (FSI Server uses the secure Authorization Code Flow with PKCE and Client Secret).
5. Click Save.

Step 5: Create a Client Secret​

1. In the app menu, navigate to Certificates & secrets → Client secrets tab.
2. Click New client secret.
3. Description: e.g., FSI Server Backend Secret.
4. Expires: Choose according to company policy (6, 12, 18, or 24 months; e.g., 6 or 24 months).
5. Click Add.
6. CRITICAL: Copy the string in the Value column immediately (not the Secret ID!). (The plaintext value is only displayed once and will be permanently masked afterwards).

Step 6: Configure Token Group Claims​

To inform FSI Server of user group memberships, Entra ID must include them in the ID token.

1. Navigate to Token configuration.
2. Click Add groups claim.
3. Configure the claim based on your license:

4. Click Add.

Step 7: Configure Enterprise Application (License Differences)​

Navigate to: 👉 Entra ID → Enterprise apps → Select FSI Server. (until 2025: Identity → Applications → Enterprise applications; in Azure Portal: Microsoft Entra ID → Enterprise applications → FSI Server)

Scenario A: With Entra ID Free (No Feature Plan)​

Free plan customers have two viable options:

• Recommended Option for Free (Access Control Managed via FSI Server):
  1. Under Properties, set Assignment required? to No.
  2. Click Save.
  3. Security Model: Any tenant user can initiate login, but FSI Server's groupMapping only grants connector permissions to users who belong to the mapped security groups. Users without an assigned group see no connectors (access denied).
• Alternative Option for Free (Manual Per-User Assignment):
  1. Set Assignment required? to Yes.
  2. Under Users and groups, add every authorized employee individually as a user.

Scenario B: With Entra ID P1 / P2 (Enterprise Standard)​

1. Under Properties, set Assignment required? to Yes.
   • Any unauthorized tenant user is stopped at the Microsoft login prompt with error AADSTS50105.
2. Under Users and groups → Add user/group, assign the connector security groups:
   • FSI-Connector-Marketing
   • FSI-Connector-Products
   • FSI-Connector-Archive
   • FSI-Administrators

Additional P1 / P2 Security Features:​

• Conditional Access (P1 / P2): Under Protection → Conditional Access, create a policy targeting the FSI Server Cloud App to enforce:
  • Multi-Factor Authentication (MFA).
  • Managed / Compliant devices (Intune compliant or Hybrid Azure AD Joined).
• Risk-Based Protection (P2 only): Automatically block sign-ins or prompt for secure password resets if Microsoft Identity Protection flags a user or session risk.
• PIM & Access Reviews (P2 only): Enforce periodic access recertification for sensitive archive access.

FSI Server Configuration (settings.yml)​

Configure the OIDC authentication module in settings.yml (located in the FSI Server configuration directory, e.g., /etc/fsi/fsi-server/config/settings.yml).

The example below shows all parameters, highlighting mandatory settings and default values:

authentication:
  authModules:
    - type: "oidc"                                # Mandatory: Module type
      enabled: true                               # Default: true
      name: "Microsoft Entra ID (SSO)"            # Display label on login button
      provider: "entra"                           # Provider identifier

      # 1. Credentials from Entra ID App Registration (Steps 3 & 5)
      clientId: "00000000-0000-0000-0000-000000000000"          # Mandatory: Application (client) ID
      clientSecret: "your-client-secret-value-from-azure"       # Mandatory: Client secret value

      # 2. Issuer URL (Endpoints are automatically discovered via .well-known/openid-configuration)
      # Mandatory: Replace with your Tenant ID; must end with /v2.0
      issuerUrl: "https://login.microsoftonline.com/11111111-2222-3333-4444-555555555555/v2.0"

      # 3. Redirect URI
      # Default: Uses base request URL if omitted.
      # Recommendation: Specify explicitly with [IP_ADDRESS] to match Entra ID registration.
      redirectUri: "https://[IP_ADDRESS]/fsi/interface/"

      # 4. Token Claims
      usernameClaim: "preferred_username"         # Default: "preferred_username"
      groupsClaim: "groups"                       # Default: "groups"

      # 5. User Provisioning & Session Mode
      autoProvision: true                         # Default: true (provisions user upon first SSO login)

      # 6. Group Mapping: Map Entra ID Object IDs (GUIDs) to FSI Server Groups
      # Note: FSI Server groups must correspond to the group names
      groupMapping:
        # Full Administrator (Access to server settings & all connectors)
        "44444444-dddd-eeee-ffff-444444444444": "administrators"

        # Marketing Team (Mapped to marketing connector)
        "11111111-aaaa-bbbb-cccc-111111111111": "marketing"

        # Products Team (Mapped to product catalog connector)
        "22222222-bbbb-cccc-dddd-222222222222": "products"

        # Archive Team (Mapped to internal archive connector)
        "33333333-cccc-dddd-eeee-333333333333": "archive"

    # Optional: File-based XML authentication module as local administrative fallback
    - type: "file"
      enabled: true

Troubleshooting & Common Issues​