Is Microsoft Entra ID the same as Azure AD?

Yes. Microsoft renamed Azure Active Directory to Microsoft Entra ID in 2023. App registrations, enterprise applications and tenants work the same way.

Why does Magento say the email claim is missing?

Entra ID doesn't always put an email address in the ID token. Add the optional email claim under Token configuration, or map email to preferred_username only if every user's sign-in name is a real, routable email address.

Do customers lose their order history when they start signing in with Entra ID?

No. On first sign-in IdPlug matches the existing customer by email and links the Entra identity to that account. Orders, addresses and wishlists stay where they are.

Do I need a paid plan for this?

Customer sign-in with Entra ID works with the free IdPlug Customer SSO module. Administrator sign-in needs IdPlug Admin SSO, and automatic provisioning needs IdPlug SCIM Provisioning.

How to Set Up Microsoft Entra ID Single Sign-On for Magento 2

Microsoft Entra ID, formerly Azure Active Directory, is the identity provider we see most often behind Magento B2B portals, employee stores and company admin teams. This guide connects a Magento 2 or Adobe Commerce store to Entra ID with the free IdPlug Customer SSO extension, then extends it to administrators and automatic provisioning.

It assumes Magento 2.4.8 or newer on PHP 8.4, a storefront on HTTPS with a valid certificate, and permission to create app registrations in your Entra tenant. In the examples, store.example.com stands for your store’s secure base URL.

Step 1: Choose OpenID Connect or SAML

Entra ID supports both. Use OpenID Connect unless you have a reason not to: setup takes four values, and signing keys rotate automatically. Use SAML if your identity team standardizes on it. If you’re unsure, read SAML vs OpenID Connect for Magento SSO first.

Step 2a: Register the app in Entra ID (OpenID Connect)

In the Microsoft Entra admin center:

Go to App registrations > New registration. Give it a clear name such as “Magento storefront”.
Under Redirect URI, choose the Web platform and enter https://store.example.com/idplug/oidc/callback.
After saving, copy the Application (client) ID and the Directory (tenant) ID from the overview page.
Under Certificates & secrets, create a New client secret and copy its value right away. Entra shows it only once. Note the expiry date, because you will have to renew it.
Under Token configuration, add the optional email claim to the ID token. Entra doesn’t always include an email address otherwise, and Magento needs one to create or match a customer.
If you plan to map groups to customer groups or admin roles, use Add groups claim on the same screen. Entra sends groups as object IDs (GUIDs), so you will map those IDs, not display names.

Step 2b: Create an enterprise application (SAML)

If you chose SAML instead:

Go to Enterprise applications > New application > Create your own application and choose the option for an application not in the gallery.
Open Single sign-on > SAML. Take the Identifier (Entity ID) and the Reply URL from the store’s metadata at https://store.example.com/idplug/saml/metadata. You can also upload that metadata file directly. The Reply URL is the Assertion Consumer Service, https://store.example.com/idplug/saml/acs.
Download the Federation Metadata XML for the next step.

Step 3: Add the provider in Magento

In the Magento admin, go to IdPlug > Identity Providers > Add New Identity Provider and choose the Microsoft Entra ID preset. The preset fills in sensible defaults, but review every value it seeds.

For OpenID Connect, enter the Client ID and Client secret, and either the Microsoft Entra tenant ID or the full Issuer, https://login.microsoftonline.com/<tenant-id>/v2.0. The client secret is stored encrypted. Scopes stay at openid profile email.

For SAML, paste the federation metadata. The preset maps Entra’s URI-style claims for email, given name, surname, name and groups.

Then check the attribute mapping:

Magento target	What it does	OpenID Connect claim
`subject`	Stable identifier the account is linked to	`sub` (preset), or `oid` (see below)
`email`	Matches and creates customers	`email`
`firstname`, `lastname`	Customer name	`given_name`, `family_name`
`groups`	Customer group or admin role mapping	`groups`

About oid: Entra’s sub claim is unique per application, while oid is the user’s object ID across the tenant. If you will also use SCIM provisioning, map subject to oid. SCIM uses the Entra object ID as externalId, so sign-in and provisioning then refer to the same person.

Finally, set a default customer group, and map Entra group IDs to Magento customer groups if different teams or companies need different prices or catalogs.

Step 4: Test before anyone sees a button

Use Test Sign-in on the provider screen. It works while the provider is still disabled: you sign in once at Entra ID and IdPlug shows the claims that came back, how they map, and what a real sign-in would do. It doesn’t sign anybody in or create anything. The admin and the storefront must use the same hostname for this test, and the result can be opened once, within five minutes.

The most common findings at this point are a missing email claim (see step 2a) and groups that arrive as GUIDs when the mapping expects names.

IdPlug > Authentication Logs and the bin/magento idplug:diagnose command help with anything else. The logs never store tokens or client secrets.

Step 5: Roll out to customers

Enable the provider, then set Storefront SSO Mode under Stores > Configuration > Services > IdPlug > Storefront to Optional. The login page shows a sign-in button next to the native form on Luma and Hyvä themes, including Hyvä’s checkout sign-in popup.

The native login stays available. Once you are confident, Login Auto-Redirect sends customers straight to Entra ID, and the native form is still reachable at customer/account/login?idplug_native=1 for anyone who needs it.

In Entra ID, set Assignment required on the enterprise application if only specific users or groups should be able to sign in to the store.

Step 6: Bring administrators in (optional)

With IdPlug Admin SSO, the same provider can sign in Magento administrators:

Set the provider’s Applies to to include Administrator.
Map Entra group IDs to Magento admin roles. No administrator is created or changed without a matching mapping.
Set Administrator SSO Mode under Stores > Configuration > Services > IdPlug > Administrator to Optional.
Keep one break-glass administrator who signs in natively.

Why this matters for offboarding is covered in Magento admin accounts are an offboarding risk.

Step 7: Automate accounts with SCIM (optional)

Single sign-on creates a customer on first sign-in, but it never removes anyone. To have Entra ID create customers before their first visit and deactivate them when they leave, add IdPlug SCIM Provisioning and point Entra’s automatic provisioning at https://store.example.com/scim/v2. The SCIM guide covers that setup.

Need a hand? The optional installation service on each IdPlug product page covers this whole setup on your store, or ask us about Magento development for anything around it.