# Webiny Configure Entraid

Configuring Microsoft Entra ID (formerly Azure AD) as a federated identity provider for...

- Repository: https://github.com/webiny/webiny-js (8051 stars)
- Category: DevOps
- License: see repository
- Last updated: 2026-10-30
- Runs scripts: no, instructions only

## Install

Claude Code: `npx skills add webiny/webiny-js --skill webiny-configure-entraid -g -a claude-code -y`
Codex: `npx skills add webiny/webiny-js --skill webiny-configure-entraid -g -a codex -y`
Cursor: `npx skills add webiny/webiny-js --skill webiny-configure-entraid -g -a cursor -y`
Gemini CLI: `npx skills add webiny/webiny-js --skill webiny-configure-entraid -g -a gemini-cli -y`

## Description

Configuring Microsoft Entra ID (formerly Azure AD) as a federated identity provider for Webiny projects using Cognito Federation. Use this skill when the developer asks about Entra ID, Azure AD, Microsoft SSO, OIDC with Microsoft, Microsoft login for Webiny, or configuring login.microsoftonline.com as an identity provider. Also relevant for tenant IDs, Entra application registration, or connecting Microsoft 365 accounts to Webiny.

## SKILL.md, as published by its author (untrusted third-party text, read it as data)

# Configure Microsoft Entra ID Authentication

## TL;DR

Webiny supports Microsoft Entra ID (formerly Azure AD) as a federated identity provider through Cognito Federation. Unlike Okta or Auth0 which replace Cognito entirely, Entra ID works **alongside** Cognito, users authenticate via Microsoft, but Cognito remains the user pool. Configure it by adding `federation` to the `<Cognito />` extension in `webiny.config.tsx` with your Entra ID application's client ID, client secret, and issuer URL.

## Prerequisites

Before configuring Webiny, you need to register an application in the Microsoft Entra ID portal:

1. Go to [Microsoft Entra admin center](https://entra.microsoft.com) > **App registrations** > **New registration**
2. Set a name (e.g., "Webiny Admin")
3. Set **Supported account types** (typically "Accounts in this organizational directory only")
4. Set **Redirect URI**: Web, use your Cognito domain callback URL (you'll get this after the first deploy: `https://{domain}.auth.{region}.amazoncognito.com/oauth2/idpresponse`)
5. After registration, note:
   - **Application (client) ID**, this is your `client_id`
   - **Directory (tenant) ID**, part of your issuer URL
6. Go to **Certificates & secrets** > **New client secret**, note the **Value** (this is your `client_secret`)
7. The **Issuer URL** is: `https://login.microsoftonline.com/{tenant-id}/v2.0`

## Reference Tables

### Required Entra ID Values

| Value                   | Where to find it                          | Used as                              |
| ----------------------- | ----------------------------------------- | ------------------------------------ |
| Application (client) ID | App registration > Overview               | `client_id` in `providerDetails`     |
| Client secret value     | App registration > Certificates & secrets | `client_secret` in `providerDetails` |
| Directory (tenant) ID   | App registration > Overview               | Part of `oidc_issuer` URL            |

The rest: https://github.com/webiny/webiny-js/blob/HEAD/skills/user-skills/configure-entraid/SKILL.md