Contact Support

OIDC Based SSO for Azure Entra

Verkada Command supports Single Sign-On (SSO) through OpenID Connect (OIDC) with Azure Entra. This integration allows our users to seamlessly and securely authenticate using their existing Azure Entra credentials, streamlining access to Command and enhancing overall security.

OIDC is not supported on the Pass app or Desk Station apps.

Enable Enterprise Controlled Encryption (ECE) for enhanced security.

Azure Entra configuration

1

Log in to your Azure Entra portal.

2

Search for and select App registrations.

3

Click New Registration.

a. Name the application Verkada SSO OIDC. b. Under Supported account types, select Accounts in this organizational directory only ( only - Single tenant). c. Under Redirect URI, select Single-page application (SPA) as the platform and add the following callback URLs:

  1. https://command.verkada.com/oidc/aad/callback

  2. https://org-short-name.command.verkada.com/oidc/aad/callback (replace org-short-name in the URI with your Command organization’s short-name.)Note: Verify there is no trailing slash in the callback URI.

4

Click Register.

5

Copy and store your Application (Client) ID and Directory (Tenant) ID in a safe place. You will need them to complete the setup in Verkada Command.

6

On the left, click Manage > Expose an API.

a. Click Add a scope. b. Click Save and continue. c. Enter verkada_ece for the following fields:

  • Scope name

  • Admin consent display name

  • Admin consent description

  • User consent display name

  • User consent description

i. Set Who can consent? to Admins and users. j. Click Add scope.

Verkada Command configuration

1

In Verkada Command, go to All Products > Admin.

2

In the left navigation, select Login & Access.

3

Select Single Sign-On Configuration.

4

Under OIDC Configuration, click Add New.

a. Toggle on Enable. b. (Optional) Toggle on Require OIDC SSO. c. Under Select Provider, select Azure Entra. d. Under Add Client and Tenant, click .

  1. In the Client ID field, paste the Client ID you copied from Azure Entra.

  2. In the Tenant ID field, paste the Tenant ID you copied from Azure Entra.

  3. Click Done.

h. Under Email Domains, click .

  1. Enter your domain name present (e.g., @verkada.com).

  2. Click Done.

5

Click Run Login Test.

6

A successful login test should redirect to the OIDC configuration page. Once you’re logged in, add the domain that you need to whitelist.

7

Once your domain is added, run the login test again. SSO will not be enabled until this second login test successfully completes.

8

Once your domain is verified, you should see it successfully validated.

Need more help? Contact Verkada Support.

Last updated

Was this helpful?