---
title: Set up Microsoft Entra ID SSO
slug: configured-commerce/docs/set-up-microsoft-azure-sso
docTags: 
createdAt: 2026-08-13T10:46:20.000Z
---

## Create an application registration in Microsoft Entra ID

1. Go to **Entra ID Active Directory** in the Entra ID portal.
2. Select **App registrations**under **Manage** in the Microsoft Entra ID portal.
3. Click **New registration** to register a new application.
4. Enter a display **Name** for your application.
5. Specify who can use the application, sometimes called the **sign-in audience.**
6. Click **Register**.

![](https://api.archbee.com/api/optimize/BrbvVORKJ5iIeSMZye5kI/qjFJr2alE41wpaTnelDOC-20260722-174957.png)

7. Click **Add an Application ID URI** for the application.
8. Click **Set** next to **Application ID URI**. Copy the default value, which will be used later.
9. Click **Save**.
10. Click **Add a Redirect URI** for the application.
11. Ensure **ID tokens** is selected.
    ![](https://api.archbee.com/api/optimize/BrbvVORKJ5iIeSMZye5kI/nxJ0AMGsj0JjN0jeJP335-20260722-174957.png)
12. Select the platform for your app. For example, enter `https://www.b2bcommercesite/identity/externalcallback` if used for the storefront or `https://www.b2bcommercesite/identity/adminexternalcallback` if used for the admin console (where [www.b2bcommercesite](http://www.b2bcommercesite) is your url) for the **Redirect URI**, and click **Configure**.
13. Return to the **Overview** page for your app and note the **Directory (tenant) ID** for tenant-specific endpoints. For tenant-independent endpoints, use the **FEDERATION METADATA DOCUMENT** endpoint value in [this article](https://docs.microsoft.com/en-us/azure/active-directory/azuread-dev/azure-ad-federation-metadata).

Next, enable SSO using Windows settings for Entra ID or [OpenId Connect](docId:4IOhrsq3jeQ-tLbnpKWnF).

## Enable Windows SSO

1. Go to **Administration > System > Settings** in the Admin Console.
2. Search for **Allow Sign in With Windows Account**. (You may also navigate to **Site Configurations > Windows SSO** from **Settings**.)
3. Set the **Allow Sign in With Windows Account** toggle to **YES**. If Yes, a Windows button will appear on the sign in page. Default value: No.
4. Set the **Use Windows Sign In on Storefront** toggle to **YES**, if you want to enable this. If Yes, a Windows button will appear on the storefront sign in page. Default value: No. If this setting is enabled, the following fields will be available:
   - **Storefront Caption** – This is the caption to show on the Windows button. Default value: Windows.
   - **Storefront Application ID URI** – This is the globally unique URI used to identify this web API. Also referred as an identifier URI, it works as the prefix for scopes and in access tokens as well as the value of the audience claim. **Paste the text copied from the Application ID URI from step 8 above into this field.** The default is blank.
   - **Storefront Windows Metadata URL** – This is the address used to retrieve WsFederation metadata. The default is blank.
5. Set the **Use Windows Sign In on Admin Console** to **YES**, if you want to enable this. If Yes, a Windows button will appear on the Admin Console sign in page. Default value: Yes. If this setting is enabled, the following fields will be available:
   - **Admin Console Caption** – This is the caption to show on the Windows button. Default value: Windows.
   - **Admin Console Application ID URI** – This is the globally unique URI used to identify this web API. Also referred to as an identifier URI, it works as the prefix for scopes and access tokens as well as for the value of the audience claim. Paste the text copied from the Application ID URI from step 8 above into this field. The default is blank.

:::hint{type="warning"}
**🚧 Important**
Microsoft Entra ID SSO [requires the use of verified URLs](https://learn.microsoft.com/en-us/azure/active-directory/develop/reference-breaking-changes#appid-uri-in-single-tenant-applications-will-require-use-of-default-scheme-or-verified-domains). When using a verified URL, the value for the **Admin Console Application ID URI** follows the format `https://www.verifiedURL.com/identity`. Otherwise, you can use the format `api://{appId}` (found in the Entra ID Portal) instead.
:::

:::Paragraph{listStyleType="disc" indent="2"}
**Admin Console Windows Metadata URL** – This is the address used to retrieve WsFederation metadata. The default is blank.  Under endpoints in Entra ID this would be the Federation metadata document.
:::

![](https://api.archbee.com/api/optimize/BrbvVORKJ5iIeSMZye5kI/2tplU9EI71afpsZVaJNgN-20260722-174957.png "MicrosoftTeams-image (1).png")

6. Click **Save**.

:::hint{type="info"}
**📘 Note**
If you plan on using SSO for the Admin Console and you do not wish to automatically assign any permissions, you should update the **Assign A/C User Role with SSO** setting to **NO** under **Administration > System > Settings > System Settings > Security**. New Admin Console users will then require an existing user to set their roles up manually. Default value: Yes.
:::

![](https://api.archbee.com/api/optimize/BrbvVORKJ5iIeSMZye5kI/sioy1FeKhyeBmJ1oyxoDp-20260722-174957.png "b2b-sso-azure-app-id.png")

## Configure the SSO Clients

:::hint{type="info"}
**📘 Note**
This step is not required in net8.0+
:::

1. Go to **Administration** > **Permissions**> **Single Sign On** in the Admin Console.
2. If you want to use Windows for the storefront, click **Edit** for the **ext** client.
   - Enter your website URLs in the Redirect Uris (comma separated list of redirect URIs). These have to use the path `/identity/externalcallback`, such as `https://www.b2bcommercesite1.com/identity/externalcallback`.
   - Click **Save**.
3. If you want to use Windows for the Admin Console, click **Edit** for the  `isc\_admin\_ext` client.
   - Enter your website URLs in the Redirect URIs (only one URI is supported). These have to use the path `/identity/adminexternalcallback`, such as `https://www.b2bcommercesite1.com/identity/adminexternalcallback`.
   - Click **Save**.

![](https://api.archbee.com/api/optimize/BrbvVORKJ5iIeSMZye5kI/Ygabz3uZmAnsKGXWZJcCl_87d9233-2bbad72-b2b-sso-azure-app-config.png)

:::hint{type="warning"}
**🚧 Caution**
Any SSO settings changes require a restart to be applied.
:::