Microsoft Azure AD®

You can integrate Microsoft Azure AD® (Active Directory) with Cloudflare Zero Trust and build rules based on user identity and group membership. Users will authenticate with their Azure AD credentials and connect to Zero Trust.

​​ Set up Azure AD as an identity provider

1. Log in to the Azure dashboard Open external link .

2. Click Azure Active Directory in the Azure Services section.

3. Navigate to Manage > App registrations and click + New registration.

4. Name your application and select Web from the Select a platform dropdown.

5. Enter your team domain followed by this callback at the end of the path: /cdn-cgi/access/callback. For example:

   https://<your-team-name>.cloudflareaccess.com/cdn-cgi/access/callback

6. Click Register.

7. Copy the Application (client) ID and Directory (tenant) ID. You will need to input these values into the Cloudflare dashboard.

8. To create an Application Secret, navigate to Certificates & Secrets and click + New client secret.

9. Name the client secret and choose an expiration. Click Add.

10. Copy the Value field of the client secret. Treat this value like a password. This example leaves the value visible so the values in Azure can be seen in the Access configuration.

11. Navigate to API permissions and click Add a permission.

12. Click Microsoft Graph.

13. Select Delegated permissions. You will need to toggle 7 specific permissions in the next page. Once toggled, click Add permissions.

    • email
    • openid
    • profile
    • offline_access
    • User.Read
    • Directory.Read.All
    • Group.Read.All

14. Click Grant Admin Consent for .

15. On the Zero Trust dashboard Open external link , navigate to Settings > Authentication.

16. Under Login methods, click Add new.

17. Click Azure AD.

18. Input the Application ID, Application secret, and Directory ID values from Azure.

19. (Optional) If you are using Azure AD groups, toggle Support Groups slider On in the Edit your Azure AD identity provider window.

20. (Optional) Enable Proof of Key Exchange (PKCE) Open external link . PKCE will be performed on all login attempts.

21. Click Save.

To test that your connection is working, navigate to Authentication > Login methods and click Test next to Azure AD.

​​ Use Azure AD groups

Azure AD exposes directory groups in a format that consists of random strings, the Object Id, that is distinct from the Name. To use Azure groups in Cloudflare Access:

1. Make sure you toggle on the Support groups switch as you set up Azure AD on your Zero Trust dashboard.

2. On your Azure dashboard, note the Object Id for the Azure group. In the example below, the group named Admins has an ID of 61503835-b6fe-4630-af88-de551dd59a2.

3. When you create a Zero Trust policy for an Azure group, you will be prompted to enter the Azure group ID. Enter the Object Id for the Azure group.

​​ Example API Configuration

{
  "config": {
    "client_id": "<your client id>",
    "client_secret": "<your client secret>",
    "directory_id": "<your azure directory uuid>",
    "support_groups": true
  },
  "type": "azureAD",
  "name": "my example idp"
}