Connecting Microsoft Entra ID to Keycloak — Two-Party Setup Guide
Client — manages the Microsoft Entra ID (Azure) environment CultureSuite — manages the Keycloak environment
Step 1: Request the Redirect URI from CultureSuite
Step 2: Register the Application in Microsoft Entra ID
The Client sets up the OAuth credentials using the URI received from CultureSuite (see screenshots of substeps at the bottom of this article).
- Go to the Azure Portal and navigate to Microsoft Entra ID.
- Go to App Registrations → New Registration.
- Fill in the following:
- Name: e.g. Keycloak-Integration
- Supported account types: Accounts in this organizational directory only
- Redirect URI: paste the URI received from CultureSuite in step 1
- Click Register.
- Navigate to Certificates & Secrets → New client secret, create a secret and copy the value immediately.
- Under API Permissions, add the following Microsoft Graph permissions and click Grant admin consent:
openidemailprofileUser.Read
- Copy the Application (Client) ID from the app's Overview page.
- From the Azure Portal overview, also copy the Tenant ID.
📤 Client sends to CultureSuite: the Client ID, the Client Secret, and the Tenant ID.
Step 3: CultureSuite configures the Entra ID Identity Provider in Keycloak
Step 4: Verify the Integration
- Open the CMS login page for the configured realm.
- Confirm that Login with Microsoft Entra ID appears as an option.
- The first time you log in, you are shown a message. This means your log in was succesfull, but you don’t have a CMS role yet (admin or user).
- If you are the first (admin), please contact CultureSuite so we can set your admin role.
- After that, you can configure roles for all your colleagues via the CMS users module after their first login.
The SSO button can replace the familiar username + password fields. So make sure all your CMS users have a Microsoft account to access the new SSO.
If you still want to be able to also log in the “classic” way via a password and email, we can keep that option available too.
Information Exchange Summary
# | From | To | What |
1 | CultureSuite | Client | Keycloak Redirect URI |
2 | Client | CultureSuite | Tenant ID, Client ID & Client Secret |
Screenshots
Step 2
Step 3
Step 4
Step 5
Step 6
