Configure Single Sign-On (SSO) with Microsoft Entra ID in BI Connector

This guide explains how to configure Single Sign-On (SSO) for BI Connector using Microsoft Entra ID. Once configured, users can sign in with their Microsoft Entra ID credentials by selecting Sign in with Microsoft on the BI Connector login page.

1. Prerequisites

Before configuring SSO, make sure the following prerequisites are met:

• BI Connector Server Edition 9.5.0 or later is installed.
• A Microsoft Entra ID application and its corresponding service principal are available.
• The BI Connector user performing the configuration must have the Administrator role.
• You must have access to the Microsoft Entra ID application configuration.

Once all prerequisites are ready, proceed with the steps below.

2. Configure the Microsoft Entra ID Application

In this step, you'll collect the required information from Microsoft Entra ID and configure the BI Connector redirect URI.

Step 2.1 — Get the Application (Client) ID

1. Sign in to the Microsoft portal.
2. Open the Microsoft Entra ID application created for BI Connector.
3. Go to the application's Overview page.
4. Locate Application (client) ID.
5. Copy the Application (client) ID.

Step 2.2 — Get the OAuth 2.0 Authorization Endpoint

1. From the same application, open Endpoints.
   
2. Locate OAuth 2.0 authorization endpoint (v2).
3. Copy the URL.

Click Close to close the Endpoints window.

Step 2.3 — Configure the Redirect URI

The redirect URI allows Microsoft Entra ID to redirect the user back to BI Connector after successful authentication.

1. In the Microsoft Entra ID application, locate Redirect URIs.
2. Click the link under Redirect URIs.
   
3. Click Add Redirect URI.
   
4. Select Web as the platform.
   
5. In the Redirect URI field, enter:
   https://<your-bi-connector-domain>/api/v1/users/oauth-callback
   Replace <your-bi-connector-domain> with the domain where BI Connector is hosted.
   

Click Configure.

3. Configure SSO in BI Connector

After completing the Microsoft Entra ID configuration, configure the corresponding SSO settings in BI Connector.

Step 3.1 — Open SSO Configuration

1. Open BI Connector.
2. Sign in using a BI Connector user with the Administrator role.
3. From the left-side navigation menu, click Settings.
4. Click Configure SSO.
   

Step 3.2 — Enter the SSO Configuration

4. Configure Role Mapping

BI Connector allows you to map Microsoft Entra ID roles to BI Connector roles. This determines whether a user signing in through Microsoft Entra ID is treated as an Administrator or a User in BI Connector.

Step 4.1 — Map Administrator Roles

In the Role Mapping section on the right side of the SSO configuration page, locate the Admin field and enter the Microsoft Entra ID roles that should be treated as Administrator roles, for example:

• Entra_Admin
• Entra_Account_Admin

Step 4.2 — Map User Roles

Locate the User field and enter the Microsoft Entra ID roles that should be treated as User roles, for example:

• Entra_Viewers
• EntraID_Users

Step 4.3 — Configure the Default Role

The Default Role determines which BI Connector role is assigned when a user signs in with a Microsoft Entra ID role that has not been explicitly mapped:

• USER — treated as a standard BI Connector user.
• ADMIN — treated as a BI Connector administrator.

Step 4.4 — Save the Configuration

After entering all SSO and role mapping details:

• Review the configuration.
• Verify that the Sign-in URL, Client ID, Client Secret, and Redirect URL are correct.
• Verify that the role values are correctly mapped.
• Click Save.

5. Sign in Using Microsoft Entra ID

1. Open the BI Connector login page.
2. Click Sign in with Microsoft.
3. Microsoft Entra ID will open the authentication page.
4. Sign in using the user's Microsoft account.
5. After successful authentication, the user is redirected back to BI Connector.
6. BI Connector assigns the appropriate role based on the configured role mapping.

6. Verify the SSO Configuration

To verify that SSO is working correctly:

1. Open the BI Connector login page.
2. Click Sign in with Microsoft.
3. Complete the Microsoft Entra ID authentication.
4. Verify that the user is successfully redirected to BI Connector.
5. Verify that the user receives the expected BI Connector role based on their Microsoft Entra ID role.

7. Configuration Summary

The following values are required to configure SSO:

8. Important Notes