Gardience Documentation
gardience.com →
Docs / Administration

Set up sign-in with Microsoft Entra ID

This page connects your company's Microsoft Entra ID (formerly Azure Active Directory) to Gardience, so people sign in to the console with their Microsoft work account and Entra group membership decides their Gardience role. These steps were tested with Entra ID in October 2026. Microsoft changes its screens from time to time, so a menu name may differ slightly.

Pick one method. Gardience runs one at a time.

In the steps below, replace https://gardience.example.com with the public address of your console (see Before you start). All Entra steps are at entra.microsoft.com.

Step 1: Make an Entra group for each Gardience role

  1. Open Groups > All groups > New group.
  2. Group type: Security. Name it, for example Gardience-Admins, add the people who should be Gardience admins as members, and click Create.
  3. Repeat for any other roles you want, for example Gardience-Operators or Gardience-Viewers.
  4. Open each group and copy its Object ID. Entra sends groups to Gardience as these ID numbers, not as names, so you map the Object IDs in Gardience.

Option A: OpenID Connect

In Entra

  1. Open Applications > App registrations > New registration.

  2. Fill in:

    • Name: Gardience
    • Supported account types: Accounts in this organizational directory only
    • Redirect URI: platform Web, https://gardience.example.com/gardience/sso/callback
  3. Click Register. On the app's Overview page, note the Application (client) ID and the Directory (tenant) ID.
  4. Open Token configuration > Add groups claim, check Security groups, and click Add. Without this, Entra sends no groups.
  5. Open Certificates & secrets > New client secret, then Add. Copy the Value right away (not the Secret ID). Entra shows it only once. Note its expiry date: sign-in stops working when it expires, so make a new one before then.

In Gardience

  1. Open Settings > Single sign-on and set Protocol to OpenID Connect.

  2. Fill in:

    • Public URL of this Gardience: https://gardience.example.com
    • Issuer URL: https://login.microsoftonline.com/TENANT-ID/v2.0, with your Directory (tenant) ID.
    • Client ID: the Application (client) ID.
    • Client secret: the secret Value from step 5.
    • Leave Scopes, User name claim and Groups claim at their defaults.
  3. Under Groups to roles, add a row for each group, with the group's Object ID as the IdP group, for example the Object ID of Gardience-Admins mapped to admin.
  4. Click Save, then Test connection. A good result names the issuer and how many signing keys it found.
  5. Tick Turn on single sign-on and click Save.

Option B: SAML 2.0

In Entra

  1. Open Applications > Enterprise applications > New application > Create your own application.
  2. Name it Gardience, choose Integrate any other application you don't find in the gallery (Non-gallery), and click Create.
  3. In the new app, open Users and groups > Add user/group and add the people or groups who may sign in. Entra's free tier can assign only individual people here, not groups. Group membership still reaches Gardience through the group claim in step 5, so the role mapping works either way.

  4. Open Single sign-on > SAML. In Basic SAML Configuration, click Edit and set:

    • Identifier (Entity ID): https://gardience.example.com/gardience/sso/saml/metadata
    • Reply URL (Assertion Consumer Service URL): https://gardience.example.com/gardience/sso/saml/acs
    • Click Save.
  5. In Attributes & Claims, click Edit > Add a group claim, choose Security groups, and save.
  6. Leave Unique User Identifier (Name ID) as Microsoft's default, user.userprincipalname. That sends each person's work sign-in name, which is what you want in the audit log.
  7. In SAML Certificates, copy the App Federation Metadata Url.

In Gardience

  1. Open Settings > Single sign-on, set Protocol to SAML 2.0, set Public URL of this Gardience, and click Save.
  2. Paste the App Federation Metadata Url into IdP metadata URL.
  3. Leave Groups claim / attribute at its default. Gardience reads Microsoft's group claim automatically.
  4. Under Groups to roles, map each group's Object ID to a Gardience role.
  5. Click Save, then Test connection. A good result names the identity provider found in the metadata.
  6. Tick Turn on single sign-on and click Save.

Check that it works

  1. Open a private browser window and go to your console.
  2. Click the single sign-on button and sign in with a Microsoft work account that is in a mapped group.
  3. The console should show you signed in as your work sign-in name, with the role of your group. The audit log records it as sso.login.

If Gardience says No Gardience access, Microsoft signed the person in but sent no group that matches a mapping. Check the person is a member of the group, the groups claim was added, and the mapping uses the group's Object ID, not its name.

Guest accounts

People invited into your Entra from outside, such as a personal Outlook or Hotmail account, get a sign-in name containing #EXT#. Gardience does not accept that character in a user name, so those people cannot sign in through SAML. Give each person an account that belongs to your own Entra directory.

PreviousGovernment sign-in (notice, marking banner, smart cards)NextAPI keys and the REST API
Gardience by Bouziden Management LLC.