> For clean Markdown of any page, append .md to the page URL.
> For a complete documentation index, see https://docs.itential.com/itential-platform/6/configure/auth/azure-id/configure-platform-settings/llms.txt.
> For AI client integration (Claude Code, Cursor, etc.), connect to the MCP server at https://docs.itential.com/_mcp/server.

# Configure Azure AD settings in Platform

> How to configure the Azure AAA adapter in Itential Platform using tenant ID, client ID, and API key values from Azure AD.

#### Gather required values from Azure AD

The following values are required from the Azure AD administrator who creates the Itential Platform application in Azure:

* **Tenant ID** (`"tenant"`): Found in **Azure AD > Itential Platform App > Tenant ID**.
* **Client ID** (`"client"`): Found in **Azure AD > Itential Platform App > Application ID**.
* **Itential Platform API Key** (`"secret"`): Obtained during key setup in **Azure AD > Itential Platform App > Keys**.

#### Add the Azure AAA adapter to the active profile

Update the active `IAP_Profile` in the service configuration in Admin Essentials to add the Azure AAA adapter. Copy the following JSON into the properties section of the `Service_Config` for the Azure AAA adapter:

```json
{
  "id": "Azure AAA",
  "type": "azure_aaa",
  "properties": {
    "tenant": "a38145b3-f428-3645-cb19-ac6fe574ec71",
    "client": "d54381f6-43ae-33cd-bc79-112233dce3c6",
    "secret": "7hcq6sruo5GZAEDzRh6+S4LnKmL1Mb+KK2qlP6uT8w0=",
    "groupSync": {
      "interval": 3600,
      "method": "<all | master | account>",
      "masterGroup": "<object id of master group or empty for all>",
      "serviceAccount": "<object id of service account or empty for all>"
    }
  },
  "brokers": [
    "aaa"
  ]
}
```

#### Remove aaa from the Local AAA adapter brokers

Find the properties section of `Service_Config` for the Local AAA adapter. Remove the `"aaa"` value from the `brokers` section, leaving the array empty `[]`. Make sure no other adapters are using the `"aaa"` broker config.

```json
"brokers": []
```

#### Configure the login schema in IAP\_Profile

Configure the `uiProps` login schema in `IAP_Profile`. This redirects to the Azure SSO page. The path is relative to the base Itential Platform directory.

```json
"uiProps": {
  "login": "custom/sso.html"
}
```

#### Configure authenticationProps

Update `authenticationProps` in `IAP_Profile` to specify the administrator group or groups from the Azure adapter. Any user within these groups will have full administrator permissions in Itential Platform.

To sync the groups correctly, `provenance` must match the `id` value of the service config and `group` must match the group name created in Azure AD.

```json
"authenticationProps": {
  "admins": [
    {
      "provenance": "Azure AAA",
      "group": "IAP-Administrator"
    }
  ]
}
```

> How to configure the Azure AAA adapter in Itential Platform using tenant ID, client ID, and API key values from Azure AD.