# OIDC Based SSO for Azure Entra

Verkada Command supports Single Sign-On (SSO) through OpenID Connect (OIDC) with Azure Entra. This integration allows our users to seamlessly and securely authenticate using their existing Azure Entra credentials, streamlining access to Command and enhancing overall security.

{% hint style="danger" %}
OIDC is not supported on the Pass app or Desk Station apps.
{% endhint %}

{% hint style="info" %}
Enable [Enterprise Controlled Encryption (ECE)](https://help.verkada.com/command/single-sign-on-sso/oidc/enable-enterprise-controlled-encryption-ece) for enhanced security.
{% endhint %}

***

## Azure Entra configuration

{% stepper %}
{% step %}

#### Log in to your [Azure Entra portal](https://portal.azure.com).

{% endstep %}

{% step %}

#### Search for and select **App registrations.**

{% endstep %}

{% step %}

#### Click **New Registration.**

a. Name the application **Verkada SSO OIDC.**\
b. Under **Supported account types,** select **Accounts in this organizational directory only ( only - Single tenant).**\
c. Under **Redirect URI**, select **Single-page application** (SPA) as the platform and add the following callback URLs:

1. <https://command.verkada.com/oidc/aad/callback>
2. [https://org-short-name.command.verkada.com/oidc/aad/callback](http://org-short-name.command.verkada.com/oidc/aad/callback) (replace org-short-name in the URI with your Command organization’s short-name.)**Note:** Verify there is no trailing slash in the callback URI.
   {% endstep %}

{% step %}

#### Click **Register.**

{% endstep %}

{% step %}

#### Copy and store your **Application (Client) ID** and **Directory (Tenant) ID** in a safe place. You will need them to complete the setup in Verkada Command.

{% endstep %}

{% step %}

#### On the left, click **Manage > Expose an API**.

a. Click **Add a scope.**\
b. Click **Save and continue**.\
c. Enter *verkada\_ece* for the following fields:

* Scope name
* Admin consent display name
* Admin consent description
* User consent display name
* User consent description

i. Set **Who can consent?** to **Admins and users.**\
j. Click **Add scope.**

<div align="left" data-with-frame="true"><img src="https://705858581-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FNRq5qDDjsYNxwNzF1bcB%2Fuploads%2Fgit-blob-aec1149e6970227126f726c9c06f46e5c865b681%2F1d3772842a085fc3d15f2795987254a747399203.png?alt=media" alt="" width="800"></div>
{% endstep %}
{% endstepper %}

***

## Verkada Command configuration

{% stepper %}
{% step %}

#### In Verkada Command, go to **All Products** > **Admin**.

{% endstep %}

{% step %}

#### In the left navigation, select **Login & Access**.

{% endstep %}

{% step %}

#### Select **Single Sign-On Configuration.**

{% endstep %}

{% step %}

#### Under **OIDC Configuration,** click **Add New.**

a. Toggle on **Enable.**\
b. (Optional) Toggle on **Require OIDC SSO.**\
c. Under **Select Provider,** select **Azure Entra.**\
d. Under **Add Client and Tenant,** click <i class="fa-plus">:plus:</i>.

1. In the **Client ID** field, paste the Client ID you copied from Azure Entra.
2. In the **Tenant ID** field, paste the Tenant ID you copied from Azure Entra.
3. Click **Done**.

h. Under **Email Domains,** click <i class="fa-plus">:plus:</i>**.**

1. Enter your domain name present (e.g., @verkada.com).
2. Click **Done**.

   <div align="left" data-with-frame="true"><img src="https://705858581-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FNRq5qDDjsYNxwNzF1bcB%2Fuploads%2Fgit-blob-03a2ba25ea251f2a72146ba1464a58bc4e11e7fd%2Ff054308c20f7523b4f1f29da383884cb7c2e6453.png?alt=media" alt="" width="215"></div>

{% endstep %}

{% step %}

#### Click **Run Login Test.**

{% endstep %}

{% step %}

#### A successful login test should redirect to the OIDC configuration page. Once you’re logged in, add the domain that you need to whitelist.

{% endstep %}

{% step %}

#### **Once your domain is added, run the login test again. SSO will not be enabled until this second login test successfully completes.**

{% endstep %}

{% step %}

#### Once your domain is verified, you should see it successfully validated.

{% endstep %}
{% endstepper %}

{% hint style="success" %}
**Need more help?** Contact [Verkada Support](https://help.verkada.com/command/need-help/contact-verkada-support).
{% endhint %}
