<strong>App registrations</strong> and then click on <strong>New registration</strong>.</li><li>Pick a name, check the supported account type(single-tenant, multi-tenant, etc). In the <strong>Redirect URI</strong> section create a new
<strong>Web</strong> platform entry for each app that you want to protect by the oauth2 proxy(e.g.
<ahref="https://internal.yourcompanycom/oauth2/callback"target="_blank"rel="noopener noreferrer">https://internal.yourcompanycom/oauth2/callback</a>). Click <strong>Register</strong>.</li><li>Next we need to add group read permissions for the app registration, on the <strong>API Permissions</strong> page of the app, click on
<strong>Add a permission</strong>, select <strong>Microsoft Graph</strong>, then select <strong>Application permissions</strong>, then click on <strong>Group</strong> and select
<strong>Group.Read.All</strong>. Hit <strong>Add permissions</strong> and then on <strong>Grant admin consent</strong> (you might need an admin to do this).<br>**IMPORTANT**: Even if this permission is listed with **"Admin consent required=No"** the consent might actually be required, due to AAD policies you won't be able to see. If you get a **"Need admin approval"** during login, most likely this is what you're missing!</li><li>Next, if you are planning to use v2.0 Azure Auth endpoint, go to the <strong>Manifest</strong> page and set <code>"accessTokenAcceptedVersion": 2</code>
in the App registration manifest file.</li><li>On the <strong>Certificates & secrets</strong> page of the app, add a new client secret and note down the value after hitting <strong>Add</strong>.</li><li>Configure the proxy with:</li></ol><ul><li>for V1 Azure Auth endpoint (Azure Active Directory Endpoints - <ahref="https://login.microsoftonline.com/common/oauth2/authorize"target="_blank"rel="noopener noreferrer">https://login.microsoftonline.com/common/oauth2/authorize</a>)</li></ul><divclass="codeBlockContainer_Ckt0 theme-code-block"style="--prism-color:#bfc7d5;--prism-background-color:#292d3e"><divclass="codeBlockContent_biex"><pretabindex="0"class="prism-code language-text codeBlock_bY9V thin-scrollbar"><codeclass="codeBlockLines_e6Vv"><spanclass="token-line"style="color:#bfc7d5"><spanclass="token plain"> --provider=azure</span><br></span><spanclass="token-line"style="color:#bfc7d5"><spanclass="token plain"> --client-id=<application ID from step 3></span><br></span><spanclass="token-line"style="color:#bfc7d5"><spanclass="token plain"> --client-secret=<value from step 5></span><br></span><spanclass="token-line"style="color:#bfc7d5"><spanclass="token plain"> --azure-tenant={tenant-id}</span><br></span><spanclass="token-line"style="color:#bfc7d5"><spanclass="token plain"> --oidc-issuer-url=https://sts.windows.net/{tenant-id}/</span><br></span></code></pre><divclass="buttonGroup__atx"><buttontype="button"aria-label="Copy code to clipboard"title="Copy"class="clean-btn"><spanclass="copyButtonIcons_eSgA"aria-hidden="true"><svgviewBox="0 0 24 24"class="copyButtonIcon_y97N"><pathfill="currentColor"d="M19,21H8V7H19M19,5H8A2,2 0 0,0 6,7V21A2,2 0 0,0 8,23H19A2,2 0 0,0 21,21V7A2,2 0 0,0 19,5M16,1H4A2,2 0 0,0 2,3V17H4V3H16V1Z"></path></svg><svgviewBox="0 0 24 24"class="copyButtonSuccessIcon_LjdS"><pathfill="currentColor"d="M21,7L9,19L3.5,13.5L4.91,12.09L9,16.17L19.59,5.59L21,7Z"></path></svg></span></button></div></div></div><ul><li>for V2 Azure Auth endpoint (Microsoft Identity Platform Endpoints - <ahref="https://login.microsoftonline.com/common/oauth2/v2.0/authorize"target="_blank"rel="noopener noreferrer">https://login.microsoftonline.com/common/oauth2/v2.0/authorize</a>)</li></ul><divclass="codeBlockContainer_Ckt0 theme-code-block"style="--prism-color:#bfc7d5;--prism-background-color:#292d3e"><divclass="codeBlockContent_biex"><pretabindex="0"class="prism-code language-text codeBlock_bY9V thin-scrollbar"><codeclass="codeBlockLines_e6Vv"><spanclass="token-line"style="color:#bfc7d5"><spanclass="token plain"> --provider=azure</span><br></span><spanclass="token-line"style="color:#bfc7d5"><spanclass="token plain"> --client-id=<application ID from step 3></span><br></span><spanclass="token-line"style="color:#bfc7d5"><spanclass="token plain"> --client-secret=<value from step 5></span><br></span><spanclass="token-line"style="color:#bfc7d5"><spanclass="token plain"> --azure-tenant={tenant-id}</span><br></span><spanclass="token-line"style="color:#bfc7d5"><spanclass="token plain"> --oidc-issuer-url=https://login.microsoftonline.com/{tenant-id}/v2.0</span><br></span></code></pre><divclass="buttonGroup__atx"><buttontype="button"aria-label="Copy code to clipboard"title="Copy"class="clean-btn"><spanclass="copyButtonIcons_eSgA"aria-hidden="true"><svgviewBox="0 0 24 24"class="copyButtonIcon_y97N"><pathfill="currentColor"d="M19,21H8V7H19M19,5H8A2,2 0 0,0 6,7V21A2,2 0 0,0 8,23H19A2,2 0 0,0 21,21V7A2,2 0 0,0 19,5M16,1H4A2,2 0 0,0 2,3V17H4V3H16V1Z"></path></svg><svgviewBox="0 0 24 24"class="copyButtonSuccessIcon_LjdS"><pathfill="currentColor"d="M21,7L9,19L3.5,13.5L4.91,12.09L9,16.17L19.59,5.59L21,7Z"></path></svg></span></button></div></div></div><p><strong><em>Notes</em></strong>:</p><ul><li>When using v2.0 Azure Auth endpoint (<code>https://login.microsoftonline.com/{tenant-id}/v2.0</code>) as <code>--oidc_issuer_url</code>, in conjunction
with <code>--resource</code> flag, be sure to append <code>/.default</code> at the end of the resource name. See
<ahref="https://docs.microsoft.com/en-us/azure/active-directory/develop/v2-permissions-and-consent#the-default-scope"target="_blank"rel="noopener noreferrer">https://docs.microsoft.com/en-us/azure/active-directory/develop/v2-permissions-and-consent#the-default-scope</a> for more details.</li><li>When using the Azure Auth provider with nginx and the cookie session store you may find the cookie is too large and doesn't
get passed through correctly. Increasing the proxy_buffer_size in nginx or implementing the
