Add a custom app in Microsoft Entra ID

To create a custom application in Microsoft Entra ID, perform the following steps:

1. Log in to the Azure portal and click Manage Microsoft Entra ID.
2. Navigate to Enterprise Applications > All applications.
3. Click +New application and then click Create your own application.
   

   

4. Name your application, select Register an application to integrate with Microsoft Entra ID (App you're developing), and click Create.
   

   

5. On the following screen, fill in the following values:
   1. Name – Represents the name of the application.
   2. In Supported account types, select Accounts in any organizational directory (Any Microsoft Entra ID tenant – Multitenant).
   3. In Redirect URI, select Public client/native (mobile & desktop) and enter the URI. The field value should match this pattern: https://<domain:port>/callback/azure. The domain and the port should be the same as the ones of the SAFEQ Cloud website URL. For example, if the SAFEQ Cloud web URL is https://print.acme.com:8443,the value should be: https://print.acme.com:8443/callback/azure.
      

      In environments with reverse proxy infrastructure, do not specify the port number in the URL, meaning the default HTTPS port 443 will be used. Example: https://print.acme.com/callback/azure.

      

6. Click Register.

7. Navigate back to Microsoft Entra ID > Enterprise Applications > All applications.

8. Click your application (click refresh if it does not appear at first) to open the application details to copy the Application (client) ID.
   

   

9. Log in to the SAFEQ Cloud Web UI and go to Users.
10. On the Authentication providers tab, click Add.
11. A new dialog window will be displayed.
    

    

    
    
    • In Type, select Client (OAuth2).
    • In Name, enter the name of the authentication service.
    • In Domains, enter your Entra ID domain (Example: the "acme.com" part of john.doe@acme.com).
    • In Identity provider, select Microsoft Azure OAuth 2.0.
    • In Custom application ID, enter the value of the Application (client) ID from the newly created application.
    • In the Callback domain for custom application drop-down menu, select the domain that matches the one from the Redirect URIs that is already added in Azure application. The pre-selected value represents the domain from the SAFEQ Cloud Web URL. For adding or updating the Entra Redirect URIs, go back to the Entra ID homepage in Azure portal and click App registrations. Click your application and then click Authentication.
      

      

    • In Services, select authentication service.
12. Click Save.
13. Click Sync groups.
14. After that, the end users must accept all the required permissions.
    

    

15. When the users accept the permissions, the sync groups operation is done. If you perform the synchronization for the same account/application again, the users will not be required to grant permissions again.
16. Go to Users page and to Access control tab.
    

    

17. Select your newly created authentication provider and click SEARCH. Then, the default group Authenticated Users and the Entra groups are visible. You can use all these groups in access controls to enable permissions for authenticated users.