Entra ID (OIDC)

This guide provides step-by-step instructions on how to configure Microsoft Entra ID (Azure AD) as the SSO provider for Glean using OIDC.

Single Sign-On (SSO) is a user authentication service that permits a user to use one set of login credentials to access multiple applications. Glean supports SSO through OIDC (preferred) or SAML 2.0, both of which enhance security while simplifying the login process.

​

Prerequisites

Before you begin the setup process, ensure you have the following:

• An active Microsoft Entra ID (Azure AD) administrator account.
• Access to your Glean admin account with Admin or Setup Admin roles to configure SSO settings.
• Basic understanding of SSO concepts.

​

Entra ID Configuration

​

1 - Application Setup

Create a new App Registration in the Entra ID portal to complete the SSO integration and synchronize your user directory with Glean.

1. In the Azure portal, open the Microsoft Entra ID service blade.

2. From the left sidebar menu, select App registration, then click New Registration.

4. Set the following values on the Register an application page, then click Register:

Replace [tenant_name] with your actual tenant ID.

​

2 - Add Redirect URI

1. Once the App Registration for Glean SSO has been created, select Authentication from the left sidebar menu.

2. Under Web - Redirect URIs, click Add URI and paste the following as a second URI:

https://tenant_name-be.glean.com/authorization-code/callback

Replace tenant_name with your actual tenant ID.

https://tenant_name-be.glean.com/authorization-code/callback?isExtension=1
https://tenant_name-be.glean.com/authorization-code/callback

​

3 - Configure Permissions

In this section, you will configure the granular read-only permissions required by Glean. These permissions allow access to the Microsoft Graph API for verifying and synchronizing user identity information.

1. On the left sidebar menu, select API permissions.

2. Click Add a permission and select Microsoft Graph.

3. Select Application permissions and the following:

User.Read.All

4. Click Add a permission again, and select Microsoft Graph. Select Delegated permissions and add each of the following:

openid
email
offline_access
profile

5. Before proceeding to the next step, ensure that you have assigned each of the below permissions with the correct permission type.

​

4 - Grant Admin Consent

As Application Permissions were requested in the previous step, these must be authorized by an Azure administrator with either the Global, Application, or Cloud Application Administrator roles.

1. On the same screen (API permissions), click the Grant admin consent button to authorize the selected permissions. If this button is not visible to you, it means that you do not have the appropriate role to grant the auorization.

2. Once admin consent has been granted, you will see a green checkmark in the status field of each permision.

​

5 - Generate Secret

Next, you will create a secret token that Glean will use to access the Microsoft Graph API.

1. From the left sidebar menu, select Certificates & Secrets, then click New client secret.

2. Enter Glean SSO as the name, and select 24 months for the expiry time.

3. Under the Client secrets section, copy the Value (not the Secret ID). You will need this later when configuring Glean.

​

6 - Copy App & Directory IDs

1. From the left sidebar menu, select Overview.

2. Copy both the Application (client) ID and the Tenant (directory) ID. You will need these later when configuring Glean.

​

7 - Upload Icon

1. From the left sidebar menu, select Branding & Properties.

2. Fill in the fields as per the table below.

3. Leave all other fields blank, and click Save.

​

8 - (Optional) Restrict Users

By default, enabling SSO permits any valid user in your organization to sign into Glean. To assist with organic growth and adoption of Glean, Glean recommends that you do not restrict access to the app.

If you wish to restrict access to only approved users, Glean recommends adding all approved users to a group called Glean Users and restricting access based on this group.

To restrict which users can sign into Glean:

1. Return to the main Entra ID dashboard and select Enterprise applications.

2. Creating the App Registration for Glean also creates a corresponding Enterprise Application, called Glean SSO. Select Glean SSO from your list of Enterprise Apps.

3. From the left sidebar menu, select Users and groups, then click Add user/group.

4. Select the group(s) and/or individual users that you wish to restrict Glean access to, and then click Assign.

5. From the left sidebar menu, click Properties.

6. Set Assignment required? to Yes, then click Save. Access to Glean is now restricted to the assigned users/groups.

​

Glean Configuration

​

1 - Configure Azure SSO

1. In the Glean UI, navigate to  Admin Console > Settings > Authentication
2. Select Azure SSO from the list of SSO Providers.

3. Paste the Client secret, Application (client) ID, and Directory (tenant) ID values copied from Entra ID into their respective fields in the Glean UI.
4. Click Save.

​

2 - Activate SSO

You must activate SSO in Workspace Settings before your users can sign in to Glean using SSO.

1. Return to the  Admin Console > Settings > Authentication screen.
2. Under the Switch to logging into Glean via SSO section, click the Switch to Azure SSO button.

1. You will be prompted to confirm the switch.
2. After SSO has been activated, you will see Azure SSO present in the list of Authentication apps with a Status of Connected.

​

3 - Sync People Data

Glean synchronizes your directory from Entra ID so that it can properly map and honor user permissions when displaying search results. In this step, we will initialize the initial synchronization; after which the process will be automated.

1. In the Glean UI, navigate to  Admin Console > Settings > People data
2. Under Ready to sync you should see Azure listed. Click Azure.

3. Glean will show you a summary of the data that will be synchronized.

   • If this does not look correct, check:

     1. That each user in your directory in Entra ID has their First Name, Last Name, Email, Title, Department, and (optionally) Manager fields populated.
     2. You have correctly provided the Glean SSO App Registration with the Directory.Read.All and User.Read.All Application (not Delegated) permissions.
     3. That your Client Secret, Directory ID, and Application ID are correct.

4. Click Start sync to begin the initial synchronization.

5. Over the next few hours, you will start to see your users synchronized to Glean under  Admin Console > Settings > People data. If 24 hours elapse without any data populating, please contact your Glean engineer or Glean support.

​

Testing the Configuration

There are two key phases of SSO to test: The Glean to Microsoft Online redirect, and the Microsoft Online back to Glean redirect.

​

Glean to Entra ID

To test your SSO configuration, open a new Incognito or Private Browsing window and navigate to https://app.glean.com. Enter your work email and click Log In.

You should be redirected to your SSO platform successfully.

​

Entra ID to Glean

When you have been redirected to Entra ID, attempt to sign in. You should be redirected back to Glean and successfully signed in.

​

Troubleshooting

If any of the above SSO flows fail, consult the table below. If you have issues that persist, or issues not mentioned below, please contact Glean support.