Entra ID OIDC Configuration
This guide provides step-by-step instructions on how to configure Microsoft Entra ID (Azure AD) as the SSO provider for Glean using OIDC. Single Sign-On (SSO) is a user authentication service that permits a user to use one set of login credentials to access multiple applications. Glean supports SSO through OIDC (preferred) or SAML 2.0, both of which enhance security while simplifying the login process.
Customized instructions for your Glean environment are available in the Admin Console:  Admin Console > Settings > Authentication

​
Prerequisites

Before you begin the setup process, ensure you have the following:
  • An active Microsoft Entra ID (Azure AD) administrator account.
  • Access to your Glean admin account with Admin or Setup Admin roles to configure SSO settings.
  • Basic understanding of SSO concepts.
Glean restricts SSO authentication to domains that have been pre-approved. Ensure that you have notified Glean of all domains that will be used for user authentication or else SSO will fail.For example: company.com, company.co.jp, subsidiary.co, etc.

​
Entra ID Configuration

​
1 - Application Setup

Create a new App Registration in the Entra ID portal to complete the SSO integration and synchronize your user directory with Glean.
You will need your tenant ID and/or tenant backend domain for this step. This will take the form of: tenant_name-be.glean.comIf you are unsure of this, contact your Glean engineer or Glean support.
  1. In the Azure portal, open the Microsoft Entra ID service blade.
  2. From the left sidebar menu, select App registration, then click New Registration.
App registration
  1. Set the following values on the Register an application page, then click Register:
Field NameValue
NameGlean SSO
Supported account type✓ Accounts in this organizational directory only
Redirect URI (platform)Web
Redirect URI (URI)https://[tenant_name]-be.glean.com/authorization-code/callback?isExtension=1
Replace [tenant_name] with your actual tenant ID.
Register application

​
2 - Add Redirect URI

  1. Once the App Registration for Glean SSO has been created, select Authentication from the left sidebar menu.
  2. Under Web - Redirect URIs, click Add URI and paste the following as a second URI: 
https://tenant_name-be.glean.com/authorization-code/callback
Replace tenant_name with your actual tenant ID.
Add redirect URI
You should have two redirect URIs listed:
https://tenant_name-be.glean.com/authorization-code/callback?isExtension=1
https://tenant_name-be.glean.com/authorization-code/callback
Both are mandatory. Not adding one of the URIs will result in SSO failing to redirect.

​
3 - Configure Permissions

In this section, you will configure the granular read-only permissions required by Glean. These permissions allow access to the Microsoft Graph API for verifying and synchronizing user identity information.
  1. On the left sidebar menu, select API permissions.
  2. Click Add a permission and select Microsoft Graph.
API permissions
  1. Select Application permissions and the following:
User.Read.All
Application permissions
This must be an Application Permission. It cannot be a Delegated Permission.
  1. Click Add a permission again, and select Microsoft Graph. Select Delegated permissions and add each of the following:
openid
email
offline_access
profile
Delegated permissions
  1. Before proceeding to the next step, ensure that you have assigned each of the below permissions with the correct permission type.
PermissionType
emailDelegated
offline_accessDelegated
openidDelegated
profileDelegated
User.Read.AllApplication
This next step must be completed by a user signed into Azure with one of the following roles: Global Administrator, Application Administrator, or Cloud Application Administrator.
As Application Permissions were requested in the previous step, these must be authorized by an Azure administrator with either the Global, Application, or Cloud Application Administrator roles.
  1. On the same screen (API permissions), click the Grant admin consent button to authorize the selected permissions. If this button is not visible to you, it means that you do not have the appropriate role to grant the auorization.
Grant admin consent
  1. Once admin consent has been granted, you will see a green checkmark in the status field of each permision.
Admin consent granted

​
5 - Generate Secret

Next, you will create a secret token that Glean will use to access the Microsoft Graph API.
  1. From the left sidebar menu, select Certificates & Secrets, then click New client secret.
  2. Enter Glean SSO as the name, and select 24 months for the expiry time.
It is your responsibility to ensure that any secret tokens or API keys that Glean relies on for access to your systems are rotated before expiration.
Generate secret
  1. Under the Client secrets section, copy the Value (not the Secret ID). You will need this later when configuring Glean.
Copy secret value

​
6 - Copy App & Directory IDs

  1. From the left sidebar menu, select Overview.
  2. Copy both the Application (client) ID and the Tenant (directory) ID. You will need these later when configuring Glean.
Copy IDs

​
7 - Upload Icon

  1. From the left sidebar menu, select Branding & Properties.
  2. Fill in the fields as per the table below.
FieldValue
LogoDownload this Glean icon to set as the app logo.
Home page URL (optional)https://glean.com
Terms of service URL (optional)https://www.glean.com/terms
Privacy statement URL (optional)https://www.glean.com/privacy-policy
  1. Leave all other fields blank, and click Save.
Upload icon

​
8 - (Optional) Restrict Users

By default, enabling SSO permits any valid user in your organization to sign into Glean. To assist with organic growth and adoption of Glean, Glean recommends that you do not restrict access to the app. If you wish to restrict access to only approved users, Glean recommends adding all approved users to a group called Glean Users and restricting access based on this group.
To restrict which users can sign into Glean:
  1. Return to the main Entra ID dashboard and select Enterprise applications.
Enterprise applications
  1. Creating the App Registration for Glean also creates a corresponding Enterprise Application, called Glean SSO. Select Glean SSO from your list of Enterprise Apps.
Select Glean SSO
  1. From the left sidebar menu, select Users and groups, then click Add user/group.
Add users and groups
  1. Select the group(s) and/or individual users that you wish to restrict Glean access to, and then click Assign.
Nested groups are not supported by Entra ID when assigning groups to apps.
Assign users
  1. From the left sidebar menu, click Properties.
  2. Set Assignment required? to Yes, then click Save. Access to Glean is now restricted to the assigned users/groups.
Enable assignment

​
Glean Configuration

​
1 - Configure Azure SSO

  1. In the Glean UI, navigate to  Admin Console > Settings > Authentication
  2. Select Azure SSO from the list of SSO Providers.
Select Azure SSO
  1. Paste the Client secret, Application (client) ID, and Directory (tenant) ID values copied from Entra ID into their respective fields in the Glean UI.
  2. Click Save.
Configure Azure SSO

​
2 - Activate SSO

You must activate SSO in Workspace Settings before your users can sign in to Glean using SSO.
  1. Return to the  Admin Console > Settings > Authentication screen.
  2. Under the Switch to logging into Glean via SSO section, click the Switch to Azure SSO button.
Switch to Azure SSO
  1. You will be prompted to confirm the switch.
  2. After SSO has been activated, you will see Azure SSO present in the list of Authentication apps with a Status of Connected.
SSO Connected
If you don’t see the Switch to Azure SSO button, it means that your Glean tenant is still provisioning and you will not be able to make the switch just yet.You can skip ahead to the Connect Data Sources section of the Getting Started guide and return to this point later.

​
3 - Sync People Data

Glean synchronizes your directory from Entra ID so that it can properly map and honor user permissions when displaying search results. In this step, we will initialize the initial synchronization; after which the process will be automated.
  1. In the Glean UI, navigate to  Admin Console > Settings > People data
  2. Under Ready to sync you should see Azure listed. Click Azure.
Ready to Sync Azure
  1. Glean will show you a summary of the data that will be synchronized.
    • If this does not look correct, check:
      1. That each user in your directory in Entra ID has their First Name, Last Name, Email, Title, Department, and (optionally) Manager fields populated.
      2. You have correctly provided the Glean SSO App Registration with the Directory.Read.All and User.Read.All Application (not Delegated) permissions.
      3. That your Client Secret, Directory ID, and Application ID are correct.
  2. Click Start sync to begin the initial synchronization.
Start Sync
  1. Over the next few hours, you will start to see your users synchronized to Glean under  Admin Console > Settings > People data. If 24 hours elapse without any data populating, please contact your Glean engineer or Glean support.
People Data Synced
You have successfully configured SSO and directory synchronization for Glean with Entra ID.

​
Testing the Configuration

There are two key phases of SSO to test: The Glean to Microsoft Online redirect, and the Microsoft Online back to Glean redirect.

​
Glean to Entra ID

To test your SSO configuration, open a new Incognito or Private Browsing window and navigate to https://app.glean.com. Enter your work email and click Log In. You should be redirected to your SSO platform successfully.
Testing in a Private Window is crucial to prevent existing browser cache, storage, sessions, and cookies from affecting the result.

​
Entra ID to Glean

When you have been redirected to Entra ID, attempt to sign in. You should be redirected back to Glean and successfully signed in.

​
Troubleshooting

If any of the above SSO flows fail, consult the table below. If you have issues that persist, or issues not mentioned below, please contact Glean support.
IssueDescriptionFix
SSO code exchange failed [Error Code 13]The Directory ID, Application ID, or Client Secret token is/are incorrect.Double check that you have copied the Directory ID, Application ID, and Client Secret values correctly into the Glean UI.
Cannot authenticate user from access token [Error Code 14]A key field that Glean needs to authenticate the user is missing from the access token provided by them on sign-in.Check the profile of the user in Entra ID. Ensure that the Email attribute is populated, along with First Name, Last Name, Display Name, Department, and Title.
Cannot authenticate user from access token [Error Code 14]In addition to the above, this error code may indicate that Glean cannot validate the email domain being used for sign-in.Glean checks the email domain of every user that authenticates via SSO against a list of known company domains that are assigned to your tenant. If Glean is not aware of the email domain that your user is attempting to SSO with, it denies access to your Glean environment for security reasons. Notify your Glean engineer or Glean support of all email domains that your users will be authenticating from.
Microsoft error: “You can’t get there from here”User authentication to Glean is being blocked by a Conditional Access policy.Amend your Conditional Access policy to include and permit the Glean SSO Enterprise App.
Microsoft error: “Need admin approval”Admin consent has not been granted to the permissions requested by the Glean SSO App Registration.Ensure that you have granted admin consent for the Application and Delegated permissions requested under “API permissions” of the Glean SSO App Registration.
Users are being asked to approve permissions when signing in to GleanThe type of permissions granted to the Glean SSO App Registration are incorrect (or missing).Ensure that the Directory.Read.All and User.Read.All permissions are assigned to the Glean SSO app registration and are of Application type.
Ensure that the email, openid, offline_access, and profile permissions are assigned to the Glean SSO app registration and are of Delegated type.
SSO is successful, but the Glean is stuck at the login pageGlean cannot validate the email domain being used for sign-in.Glean checks the email domain of every user that authenticates via SSO against a list of known company domains that are assigned to your tenant. If Glean is not aware of the email domain that your user is attempting to SSO with, it denies access to your Glean environment for security reasons. Notify your Glean engineer or Glean support of all email domains that your users will be authenticating from.
SSO is successful, but Glean returns an internal server error or some other error.You likely have IP restrictions assigned to your Azure/Entra ID tenant which are preventing the access token from being validated.Contact your Glean engineer or Glean support who can advise you on the static IP addresses assigned to your Glean tenant that you will need to allowlist.
Looking for the original version of this page? You can find the archived version here.