## Steps to set Entra as an OIDC identity provider:

1. Log in to Microsoft Entra and navigate to the **Identity/Applications/Enterprise applications** view within Microsoft Entra.

2. Click on **New application.**

3. Once navigated to a new page, click on **Create your own application**.

4. Provide a name to the application and select “ **Register an application to integrate with Microsoft Entra ID (App you’re developing)**” for the application purpose, then click on the **Create** button.

5. Select who can use the application from the given options according to your needs and then click on **Register.**

6. Now navigate to **Identity/Applications/App registrations.**

7. In the **All applications tab,** select the application which we created.

8. Copy the Application(Client) ID, then click on **Endpoints** and then copy the **OpenID Connect metadata document** (Discovery Endpoint).
   
   
 
9. Navigate to **Certificates and Secrets.**

10. Click on **New client secret,** give it a description and select the expiry according to your needs and then click on **Add**.

11. Copy the **value(client secret)** and store it, as it won’t be shown again.

12. Navigate to the settings page on Cosmo.

13. Give the connection a name, paste the **OpenID Connect metadata document** copied before, into the **Discovery Endpoint,** paste the **Client ID** and **Client secret** copied before into the **Client ID** and **Client Secret fields respectively,** and then click on **Connect.**

14. Configure the mapping between the roles in Cosmo and the groups in Microsoft Entra. The field **Group in the provider** should be populated with the **Object ID of a group from Entra.** Once all the mappers are configured, click on **Save**. Every member in those groups would get the respective role configured.

Object ID of the groups in Entra

15. Copy the sign-in and sign-out redirect URIs displayed in the dialog.

16. Navigate back to the **App registrations** page, in the **All applications** tab select the app which we created.

17. Click on **Add a redirect URI,** and now click on **Add a platform,** select **Web** and then paste the Sign-in and Sign-out redirect URIs in the **Redirect URIs** and **Front-channel logout URL respectively.**

18. Select **ID tokens** and then click on **Configure.**

19. Now navigate to **Token configuration**, and click on **Add groups claim.**

20. Select **Security groups,** expand **ID,** select **Group ID** and click on **Add.**

21. Navigate to **API Permissions**, and click on **Add a permission.**

22. Click on **Microsoft Graph,** and then on **Delegated permissions,** select **email, openid and profile** and then click on **Add permissions.**

23. Now you can assign users/groups to the application, and only those users will be able to log into Cosmo using the URL provided on setting up the provider.

Steps to add a user:

1. Navigate to Users/All users, click on New User and then click on Create a new user.

2. Provide the user principal name, the display name and then click on **Next**.

3. Provide the first name (optional) and the last name (optional).

4. Provide the email of the user (**Required**).

5. Then click on **Next** and assign the user to the groups according to your needs.