From 764326a9e157dd535326adb02a2bbd530ee3ed01 Mon Sep 17 00:00:00 2001 From: Rolf-M <32070388+Rolf-M@users.noreply.github.com> Date: Wed, 30 Jul 2025 17:32:48 +0200 Subject: [PATCH] Update microsoft-entra.md (#96) * Update microsoft-entra.md Added configuration for role assignement with entra app-registration * Update microsoft-entra.md --------- Co-authored-by: Christiaan Goossens <9487666+christiaangoossens@users.noreply.github.com> --- .../microsoft-entra.md | 26 ++++++++++++++++++- 1 file changed, 25 insertions(+), 1 deletion(-) diff --git a/docs/provider-configurations/microsoft-entra.md b/docs/provider-configurations/microsoft-entra.md index eadb745..e091d41 100644 --- a/docs/provider-configurations/microsoft-entra.md +++ b/docs/provider-configurations/microsoft-entra.md @@ -1,7 +1,7 @@ # Microsoft Entra ID > [!WARNING] > Microsoft Entra ID does not support public clients that are not Single Page Applications (SPA's). Therefore, you will have to use a client secret. - +## Basic configuration 1. Go to app registrations in Entra ID. 2. Create a new app, use the "Web" type for the redirect URI and fill in your URL: `/auth/oidc/callback`. Note that you either have to use localhost, or HTTPS. 3. Copy the 'Application (client) ID' on the overview page of your app and use it as your `client_id`. @@ -25,3 +25,27 @@ auth_oidc: > [!CAUTION] > Be careful! Configuring Entra ID wrong may leave your Home Assistant install open for anyone with a Microsoft account. Please use "Single tenant" account types only. Do not enable "Accounts in any organizational directory (Any Microsoft Entra ID tenant - Multitenant)" or personal account modes without enabling the mode to only allow specific accounts first! + +## Configuring user roles +If you like to configure the Home Assistant users roles based on your Entra ID settings, you have to create 2 roles within your Entra ID app registration. +Go to "App registrations" and select app roles. Create two new roles for admins and users, giving them sensible names and values (the example uses `users` and `admins`), that you will need later in your HA configuration. + +Entra-HA-Roles + +Then you need to create the users and assign them a role of your choice. +Go to "Enterprise apps" chose your app registration again and select "Users and groups" within the manage section. Add users, or groups from your tenant or AD-sync and assign them a role, from the ones you created before. + +Entra-HA-Users + +Last thing to do is to include +``` + claims: + groups: "roles" + roles: + admin: "admins" + user: "users" +``` +in your auth_oidc config, where the roles values correspond to the ones you chose in your Entra ID roles. +Make sure, you keep the "include_groups_scope: False" from the basic configuration, as the claim needed for Entra ID is "roles". + +Newly created users will get the role assigned in Entra ID, but there is no update to user roles. A user created with user role in HA will not get the admin role, if you change the assignment later on in Entra ID.