Microsoft Entra ID (Azure AD) Identity Provider

Configure Microsoft Entra ID, formerly Azure Active Directory, as an OpenID Connect (OIDC) identity provider for MinIO AIStor. For general OIDC configuration, see OpenID Connect Identity Management.

Prerequisites

An active Azure subscription with access to the Azure Portal.
A MinIO AIStor deployment with network connectivity to Microsoft identity endpoints.
The mc CLI installed and configured with an alias for your MinIO AIStor deployment.

Microsoft Graph API permissions

MinIO AIStor uses the Microsoft Graph API to query group memberships for authenticated users. The following Application permissions are required (not Delegated):

Permission	Purpose
`User.Read.All`	Read user profiles and group memberships
`Group.Read.All`	Read group information and memberships

These permissions require admin consent and enable MinIO AIStor to:

Query the /directoryObjects/{user-id}/getMemberGroups endpoint
Map Azure AD security groups and Microsoft 365 groups to MinIO AIStor policies

Register an application in Azure

In the Azure Portal, navigate to Microsoft Entra ID > App registrations > New registration.
Enter a name (for example, minio-oidc).
Set Supported account types as appropriate for your organization.
Set Redirect URI platform to Web and enter your Console UI URL:
```
https://minio.example.com/oauth_callback
```
Select Register.

After registration:

Note the Application (client) ID and Directory (tenant) ID.
Navigate to Certificates & secrets > New client secret. Copy the generated secret value for MINIO_IDENTITY_OPENID_CLIENT_SECRET.
Navigate to API permissions > Add a permission > Microsoft Graph > Application permissions. Add User.Read.All and Group.Read.All.
Select Grant admin consent for your organization.

The OpenID discovery document URL is:

https://login.microsoftonline.com/<tenant-id>/v2.0/.well-known/openid-configuration

Configure MinIO AIStor

Add the Azure AD provider using mc:

mc idp openid add ALIAS azure \
  config_url="https://login.microsoftonline.com/<tenant-id>/v2.0/.well-known/openid-configuration" \
  client_id="<client-id>" \
  client_secret="<client-secret>" \
  scopes="openid,email,profile" \
  redirect_uri="https://minio.example.com/oauth_callback" \
  display_name="Azure AD" \
  claim_name="groups" \
  vendor="azure" \
  azure_tenant_id="<tenant-id>"

Or using environment variables:

export MINIO_IDENTITY_OPENID_CONFIG_URL="https://login.microsoftonline.com/<tenant-id>/v2.0/.well-known/openid-configuration"
export MINIO_IDENTITY_OPENID_CLIENT_ID="<client-id>"
export MINIO_IDENTITY_OPENID_CLIENT_SECRET="<client-secret>"
export MINIO_IDENTITY_OPENID_SCOPES="openid,email,profile"
export MINIO_IDENTITY_OPENID_REDIRECT_URI="https://minio.example.com/oauth_callback"
export MINIO_IDENTITY_OPENID_DISPLAY_NAME="Azure AD"
export MINIO_IDENTITY_OPENID_CLAIM_NAME="groups"
export MINIO_IDENTITY_OPENID_VENDOR="azure"
export MINIO_IDENTITY_OPENID_AZURE_TENANT_ID="<tenant-id>"

Restart MinIO AIStor to apply the configuration:

mc admin service restart ALIAS

Azure-specific settings

Setting	Value	Purpose
`vendor`	`azure`	Enables Microsoft Graph API integration for group membership
`azure_tenant_id`	your tenant ID	Required for client credentials authentication to Graph API
`claim_name`	`groups`	Reads policy names from the `groups` claim, which MinIO AIStor fills with the user’s group object IDs

How group mapping works

A user authenticates via Azure AD OIDC and MinIO AIStor receives an ID token.
MinIO AIStor reads the user’s object ID from the oid claim of the ID token.
MinIO AIStor authenticates to the Microsoft Graph API using the configured tenant ID, client ID, and client secret.
MinIO AIStor queries the Graph API to retrieve every group and directory role the user belongs to, including nested groups.
These groups are added to the groups claim for policy mapping.

MinIO AIStor applies the policies whose names match the object IDs of the user’s groups. Copy the Object ID from the group’s overview page in Microsoft Entra ID > Groups, then create a policy with that name:

mc admin policy create ALIAS <group-object-id> policy.json

A user who belongs to several mapped groups receives all of their policies. MinIO AIStor doesn’t issue credentials to a user who belongs to no mapped group.

Group membership changes

MinIO AIStor reads group memberships from Microsoft Graph each time a user signs in. Temporary credentials keep the policies they were issued with until they expire, so a change in Microsoft Entra ID applies at the user’s next sign-in.

Log in with Azure AD

Open the Console UI in a browser.
Select Login with SSO.
Enter your Azure AD credentials on the Microsoft login page.
After successful authentication, you are redirected to the Console UI with access based on your Azure AD group policies.

Users that you manage with mc admin user keep signing in with their username and password.