Microsoft Azure AD® (Active Directory)
You can integrate Microsoft Azure AD® (Active Directory) with Cloudflare for Teams and build rules based on user identity and group membership. Users will authenticate with their Azure AD credentials and login to resources protected by Cloudflare Access or enroll into Cloudflare Gateway.
- Sign in to the Azure dashboard.
- Click Azure Active Directory in the Azure Services section.
- On the Azure AD dashboard, click App registrations in the Manage section of the Azure Active Directory pane.
- Click + New registration.
- Name your application and enter your Cloudflare Authentication Domain. The format of the authentication domain will be
https://<your authentication domain>/cdn-cgi/access/callback
). Click Register.
- On the following screen, copy the
Application (client) ID
andDirectory (tenant ID
. You will need to input these values into the Cloudflare dashboard.
- In the left hand panel, click Certificates & Secrets to create an Application Secret.
- Click + New client secret. Name the client secret and choose an expiration. Click Add.
Copy the Value
field of the client secret. Treat this value like a password. This example leaves the value visible so the values in Azure can be seen in the Access configuration.
- In the left hand panel, select API permissions. Click Add a permission.
- Click Microsoft Graph.
Select Delegated permissions. You will need to toggle 7 specific permissions in the next page. Once toggled, click Add permissions.
- openid
- profile
- offline_access
- User.Read
- Directory.Read.All
- Group.Read.All
- On the next page, click the button that begins Grant Admin Consent for ....
- Return to the Cloudflare for Teams dashboard. Select
Authentication
under the Access section of the sidebar. In theLogin
tab, click + Add. ChooseAzure AD
on the next page.
- Input the
Application ID
,Application secret
, andDirectory ID
values from Azure.
If you are using Azure AD groups, toggle Support Groups slider On in the Edit your Azure AD identity provider window.
- Click Save and Test to check your connection to the IdP.
Using AzureAD Groups
AzureAD exposes directory groups in a format that consists of random strings, the Object Id
, that is distinct from the Name
. In the example below, the group named "Admins" has an ID of "61503835-b6fe-4630-af88-de551dd59a2".
When configuring Access to use Azure groups, you must input the Object Id
.
Example API Configuration
{ "config": { "client_id": "<your client id>", "client_secret": "<your client secret", "directory_id": "<your azure directory uuid", "support_groups": true }, "type": "azureAD", "name": "my example idp"}