Microsoft Entra ID (Azure SSO)
Delphi can authenticate users with Microsoft Entra ID (Azure AD) while keeping all authorization in Delphi. Entra proves who the person is; Delphi decides which teams and roles they have.
Security model
| Responsibility | System |
|---|---|
| Authenticate the person | Microsoft Entra ID |
Map the signed Directory (tid) + Object (oid) IDs to a local user | Delphi |
| Active/locked state, platform role, team roles | Delphi |
Email, display name, Entra groups, and Entra app roles never select a Delphi user or grant privileges. Accounts must be pre-linked by a Super Admin before SSO sign-in works.
Operator setup
- Register a single-tenant Web app in Entra with redirect URI:
https://<delphi-host>/api/auth/callback/azure-ad - Create a client secret and record the Directory (tenant) ID, Application (client) ID, and secret value.
- On the TelWeb / Auth hosts, set at least:
AUTH_WITH_MICROSOFT=trueAUTH_MICROSOFT_ENTRA_ID_ID(application client ID)AUTH_MICROSOFT_ENTRA_ID_SECRET(client secret value)AUTH_MICROSOFT_ENTRA_ID_ISSUER(https://login.microsoftonline.com/<tenant-id>/v2.0)- Optionally
AUTH_WITH_CREDENTIALS=falseto hide password login.
- In Admin Settings → Users, link each SSO user's Entra Object ID (and tenant) to their Delphi account before they sign in.
See the environment variable index for the full Auth set.
Sign-in behaviour
- When Microsoft auth is enabled, the login page offers Sign in with Microsoft.
- Delphi validates the signed
tidagainst the configured tenant and looks up the pre-linked account key<tenant-id>:<object-id>. - Missing links, locked/inactive users, and session-cap failures are rejected with an audit event.
- Successful logins record a Login (success) event in Access logs.
Super Admin role changes
Promoting or demoting a Super Admin still requires a short email code to the acting Super Admin's Delphi email (credential and Entra sessions alike). It does not require the target user to set a local password.