---
title: "Setting Up Content Services SSO"
slug: "setting-up-content-services-sso"
tags: ["Content Services"]
updated: 2026-03-12T08:39:25Z
published: 2026-03-12T08:39:25Z
canonical: "kb.ctera.com/setting-up-content-services-sso"
---

> ## Documentation Index
> Fetch the complete documentation index at: https://kb.ctera.com/llms.txt
> Use this file to discover all available pages before exploring further.

# Setting Up Content Services SSO

The following outlines what the security officer responsible for Microsoft Entra ID must do.

1. Log in to your Azure portal and access **Microsoft Entra ID**.  

![Image](https://cdn.document360.io/30792387-cdcb-4791-aa14-94929bbcd3fe/Images/Documentation/image-81B3FZLW.png?sv=2026-02-06&spr=https&st=2026-11-11T04%3A07%3A29Z&se=2026-11-11T05%3A07%3A29Z&sr=c&sp=r&sig=jSYvVN3Wz9jtzwcidb%2FFD68Kx2IrXAZM5rKFNGHMi3I%3D)
2. Note the **Tenant ID** value which is used later for the **OPENID_ISSUER** value.
3. Click **Add > Enterprise Application**.  

The **Browse Microsoft Entra Gallery** screen is displayed.  

![Image](https://cdn.document360.io/30792387-cdcb-4791-aa14-94929bbcd3fe/Images/Documentation/image-PUUZ0FYO.png?sv=2026-02-06&spr=https&st=2026-11-11T04%3A07%3A29Z&se=2026-11-11T05%3A07%3A29Z&sr=c&sp=r&sig=jSYvVN3Wz9jtzwcidb%2FFD68Kx2IrXAZM5rKFNGHMi3I%3D)
4. Click **Create your own application**.  

![Image](https://cdn.document360.io/30792387-cdcb-4791-aa14-94929bbcd3fe/Images/Documentation/image-6W63SP81.png?sv=2026-02-06&spr=https&st=2026-11-11T04%3A07%3A29Z&se=2026-11-11T05%3A07%3A29Z&sr=c&sp=r&sig=jSYvVN3Wz9jtzwcidb%2FFD68Kx2IrXAZM5rKFNGHMi3I%3D)
5. Enter a name for the application. For example, `example-cs`
6. Select **Integrate any other application you don't find in the gallery (Non-gallery)**.
7. Click **Create**.  

![Image](https://cdn.document360.io/30792387-cdcb-4791-aa14-94929bbcd3fe/Images/Documentation/image-XCIDJZE9.png?sv=2026-02-06&spr=https&st=2026-11-11T04%3A07%3A29Z&se=2026-11-11T05%3A07%3A29Z&sr=c&sp=r&sig=jSYvVN3Wz9jtzwcidb%2FFD68Kx2IrXAZM5rKFNGHMi3I%3D)
8. Note the **Application ID** value which is used later for the **OPENID_CLIENT_ID** value.
9. Click **Properties** in the **Manage** section.  

![Image](https://cdn.document360.io/30792387-cdcb-4791-aa14-94929bbcd3fe/Images/Documentation/image-LDN2WRI7.png?sv=2026-02-06&spr=https&st=2026-11-11T04%3A07%3A29Z&se=2026-11-11T05%3A07%3A29Z&sr=c&sp=r&sig=jSYvVN3Wz9jtzwcidb%2FFD68Kx2IrXAZM5rKFNGHMi3I%3D)
10. Verify the application name and then register the application by clicking **application registration**.  

![Image](https://cdn.document360.io/30792387-cdcb-4791-aa14-94929bbcd3fe/Images/Documentation/image-8S8QBTTE.png?sv=2026-02-06&spr=https&st=2026-11-11T04%3A07%3A29Z&se=2026-11-11T05%3A07%3A29Z&sr=c&sp=r&sig=jSYvVN3Wz9jtzwcidb%2FFD68Kx2IrXAZM5rKFNGHMi3I%3D)
11. Add text to **Internal notes** and click **Save**.
12. Click **Authentication** in the **Manage** section.  

![Image](https://cdn.document360.io/30792387-cdcb-4791-aa14-94929bbcd3fe/Images/Documentation/image-RPSGRHXJ.png?sv=2026-02-06&spr=https&st=2026-11-11T04%3A07%3A29Z&se=2026-11-11T05%3A07%3A29Z&sr=c&sp=r&sig=jSYvVN3Wz9jtzwcidb%2FFD68Kx2IrXAZM5rKFNGHMi3I%3D)
13. click **Add Redirect URI**  

![Image](https://cdn.document360.io/30792387-cdcb-4791-aa14-94929bbcd3fe/Images/Documentation/image-D53V10IF.png?sv=2026-02-06&spr=https&st=2026-11-11T04%3A07%3A29Z&se=2026-11-11T05%3A07%3A29Z&sr=c&sp=r&sig=jSYvVN3Wz9jtzwcidb%2FFD68Kx2IrXAZM5rKFNGHMi3I%3D)
14. Click **Web**.
15. Add the following redirect URIs:  

`https://<base_URL>/oauth/callback`  

`https://<base_URL>/oauth/openid/callback`  

` https://<base_URL>/admin/sso/callback`
16. Click **Configure**.  

![Image](https://cdn.document360.io/30792387-cdcb-4791-aa14-94929bbcd3fe/Images/Documentation/image-0WNG9E6J.png?sv=2026-02-06&spr=https&st=2026-11-11T04%3A07%3A29Z&se=2026-11-11T05%3A07%3A29Z&sr=c&sp=r&sig=jSYvVN3Wz9jtzwcidb%2FFD68Kx2IrXAZM5rKFNGHMi3I%3D)
**Note**

The URIs must be accessible from the client.
17. Click the **Settings** tab and under **Implicit grant and hybris flows** make sure that the **Access tokens** and **ID tokens**  are checked.  

![Image](https://cdn.document360.io/30792387-cdcb-4791-aa14-94929bbcd3fe/Images/Documentation/image-VHG45AUR.png?sv=2026-02-06&spr=https&st=2026-11-11T04%3A07%3A29Z&se=2026-11-11T05%3A07%3A29Z&sr=c&sp=r&sig=jSYvVN3Wz9jtzwcidb%2FFD68Kx2IrXAZM5rKFNGHMi3I%3D)
18. Click **Save**.
19. Click **Certificate and secrets** in the **Manage** section.  

![Image](https://cdn.document360.io/30792387-cdcb-4791-aa14-94929bbcd3fe/Images/Documentation/image-OY5Y6FEE.png?sv=2026-02-06&spr=https&st=2026-11-11T04%3A07%3A29Z&se=2026-11-11T05%3A07%3A29Z&sr=c&sp=r&sig=jSYvVN3Wz9jtzwcidb%2FFD68Kx2IrXAZM5rKFNGHMi3I%3D)
20. Click **New client secret**.  

![Image](https://cdn.document360.io/30792387-cdcb-4791-aa14-94929bbcd3fe/Images/Documentation/image-1DHLZCJI.png?sv=2026-02-06&spr=https&st=2026-11-11T04%3A07%3A29Z&se=2026-11-11T05%3A07%3A29Z&sr=c&sp=r&sig=jSYvVN3Wz9jtzwcidb%2FFD68Kx2IrXAZM5rKFNGHMi3I%3D)
21. Enter **OPENID_CLIENT_SECRET** as the description and an expiration value and click **Add**.  

![Image](https://cdn.document360.io/30792387-cdcb-4791-aa14-94929bbcd3fe/Images/Documentation/image-20L66BY3.png?sv=2026-02-06&spr=https&st=2026-11-11T04%3A07%3A29Z&se=2026-11-11T05%3A07%3A29Z&sr=c&sp=r&sig=jSYvVN3Wz9jtzwcidb%2FFD68Kx2IrXAZM5rKFNGHMi3I%3D)
22. Note the **Value** value which is used later for the OPENID_CLIENT_SECRET value and also note the **Secret ID** value.
23. Click **Token configuration** in the **Manage** section.  

![Image](https://cdn.document360.io/30792387-cdcb-4791-aa14-94929bbcd3fe/Images/Documentation/image-KJJNAV3N.png?sv=2026-02-06&spr=https&st=2026-11-11T04%3A07%3A29Z&se=2026-11-11T05%3A07%3A29Z&sr=c&sp=r&sig=jSYvVN3Wz9jtzwcidb%2FFD68Kx2IrXAZM5rKFNGHMi3I%3D)
24. Click **Add groups claim**.  

![Image](https://cdn.document360.io/30792387-cdcb-4791-aa14-94929bbcd3fe/Images/Documentation/image-RU9YVJPC.png?sv=2026-02-06&spr=https&st=2026-11-11T04%3A07%3A29Z&se=2026-11-11T05%3A07%3A29Z&sr=c&sp=r&sig=jSYvVN3Wz9jtzwcidb%2FFD68Kx2IrXAZM5rKFNGHMi3I%3D)
25. Check **All groups** and click **Add**.  

Both **Security groups** and **Directory roles** are automatically checked.  

![Image](https://cdn.document360.io/30792387-cdcb-4791-aa14-94929bbcd3fe/Images/Documentation/image-SIFLOO2C.png?sv=2026-02-06&spr=https&st=2026-11-11T04%3A07%3A29Z&se=2026-11-11T05%3A07%3A29Z&sr=c&sp=r&sig=jSYvVN3Wz9jtzwcidb%2FFD68Kx2IrXAZM5rKFNGHMi3I%3D)
26. Click **API permissions** in the **Manage** section.  

![Image](https://cdn.document360.io/30792387-cdcb-4791-aa14-94929bbcd3fe/Images/Documentation/image-H8WTG0WR.png?sv=2026-02-06&spr=https&st=2026-11-11T04%3A07%3A29Z&se=2026-11-11T05%3A07%3A29Z&sr=c&sp=r&sig=jSYvVN3Wz9jtzwcidb%2FFD68Kx2IrXAZM5rKFNGHMi3I%3D)
27. Click **Add a permission**.  

![Image](https://cdn.document360.io/30792387-cdcb-4791-aa14-94929bbcd3fe/Images/Documentation/image-R2H74OJ2.png?sv=2026-02-06&spr=https&st=2026-11-11T04%3A07%3A29Z&se=2026-11-11T05%3A07%3A29Z&sr=c&sp=r&sig=jSYvVN3Wz9jtzwcidb%2FFD68Kx2IrXAZM5rKFNGHMi3I%3D)
28. Click **Microsoft Graph**.  

![Image](https://cdn.document360.io/30792387-cdcb-4791-aa14-94929bbcd3fe/Images/Documentation/image-SAE3FF9M.png?sv=2026-02-06&spr=https&st=2026-11-11T04%3A07%3A29Z&se=2026-11-11T05%3A07%3A29Z&sr=c&sp=r&sig=jSYvVN3Wz9jtzwcidb%2FFD68Kx2IrXAZM5rKFNGHMi3I%3D)
29. Click **Delegated permissions** and scroll down to **Directory** and check **Directory.Read.All**.  

![Image](https://cdn.document360.io/30792387-cdcb-4791-aa14-94929bbcd3fe/Images/Documentation/image-E32X4ZB3.png?sv=2026-02-06&spr=https&st=2026-11-11T04%3A07%3A29Z&se=2026-11-11T05%3A07%3A29Z&sr=c&sp=r&sig=jSYvVN3Wz9jtzwcidb%2FFD68Kx2IrXAZM5rKFNGHMi3I%3D)
30. Scroll down to **Group** and check **Group.Read.All**.
31. Scroll down to **User** and check **User.Read.All**.
32. Scroll back up to the top and click **Application permissions** and scroll down to **Directory** and check **Directory.Read.All**.
33. Scroll down to **Group** and check **Group.Read.All**.
34. Scroll down to **User** and check **User.Read.All**.
35. Click **Add permissions**.  

![Image](https://cdn.document360.io/30792387-cdcb-4791-aa14-94929bbcd3fe/Images/Documentation/image-U9Q94CVS.png?sv=2026-02-06&spr=https&st=2026-11-11T04%3A07%3A29Z&se=2026-11-11T05%3A07%3A29Z&sr=c&sp=r&sig=jSYvVN3Wz9jtzwcidb%2FFD68Kx2IrXAZM5rKFNGHMi3I%3D)
36. Click **Expose an API** in the **Manage** section.  

![Image](https://cdn.document360.io/30792387-cdcb-4791-aa14-94929bbcd3fe/Images/Documentation/image-S2Q0C4KB.png?sv=2026-02-06&spr=https&st=2026-11-11T04%3A07%3A29Z&se=2026-11-11T05%3A07%3A29Z&sr=c&sp=r&sig=jSYvVN3Wz9jtzwcidb%2FFD68Kx2IrXAZM5rKFNGHMi3I%3D)
37. Click **Add**.  

![Image](https://cdn.document360.io/30792387-cdcb-4791-aa14-94929bbcd3fe/Images/Documentation/image-ZAXP3AO0.png?sv=2026-02-06&spr=https&st=2026-11-11T04%3A07%3A29Z&se=2026-11-11T05%3A07%3A29Z&sr=c&sp=r&sig=jSYvVN3Wz9jtzwcidb%2FFD68Kx2IrXAZM5rKFNGHMi3I%3D)
**Note**

The Application ID, which is the OPENID_CLIENT_ID, was created when the application was created.
38. Click **Save**.
39. Click **App roles** in the **Manage** section.  

![Image](https://cdn.document360.io/30792387-cdcb-4791-aa14-94929bbcd3fe/Images/Documentation/image-ZXMS70TG.png?sv=2026-02-06&spr=https&st=2026-11-11T04%3A07%3A29Z&se=2026-11-11T05%3A07%3A29Z&sr=c&sp=r&sig=jSYvVN3Wz9jtzwcidb%2FFD68Kx2IrXAZM5rKFNGHMi3I%3D)
40. Click **Create app role**.  

![Image](https://cdn.document360.io/30792387-cdcb-4791-aa14-94929bbcd3fe/Images/Documentation/image-EKPR90EP.png?sv=2026-02-06&spr=https&st=2026-11-11T04%3A07%3A29Z&se=2026-11-11T05%3A07%3A29Z&sr=c&sp=r&sig=jSYvVN3Wz9jtzwcidb%2FFD68Kx2IrXAZM5rKFNGHMi3I%3D)
41. Create a role:  

**Display name** – Enter  a display name, such as `ctera-di-admin-prod`  

**Allowed member types** – Select `Users/Groups`  

**Value** – Enter `ctera-ai-admin` – The value must not be changed.  

**Description** – Enter a description for this role, such as `Admin role`  

**Do you want to enable this app role?** – Check this option.
42. Click **Apply**.
43. Note the **ID** value for the `ctera-di-admin-prod` **Display name**, which is used later for the OPENID_ADMIN_ROLE_ID value.
44. Repeat the previous three steps to create a second role:
  1. Click **Create app role**.
  2. Create a role:  

**Display name** – Enter  a display name, such as `ctera-di-user-prod`  

**Allowed member types** – Select `Users/Groups`  

**Value** – Enter `ctera-ai-user` – The value must not be changed.  

**Description** – Enter a description for this role, such as `Enduser role`  

**Do you want to enable this app role?** – Check this option.
  3. Click **Apply**.
45. Note the **ID** value for the `ctera-di-user-prod` **Display name**, which is used later for the OPENID_USER_ROLE_ID value.
46. Apart from these two roles, click any other role and, if required, add a **Value** and then uncheck **Do you want to enable this app role?** and then click **Apply** to disable the role.
**Note**

After disabling a role, you can again click the role and then click **Delete** and confirm the deletion to remove the role.

![Image](https://cdn.document360.io/30792387-cdcb-4791-aa14-94929bbcd3fe/Images/Documentation/image-8N85SBIL.png?sv=2026-02-06&spr=https&st=2026-11-11T04%3A07%3A29Z&se=2026-11-11T05%3A07%3A29Z&sr=c&sp=r&sig=jSYvVN3Wz9jtzwcidb%2FFD68Kx2IrXAZM5rKFNGHMi3I%3D)
47. Go to the Enterprise applications from the Microsoft Entra ID home page and select the enterprise application you just defined and then click **1. Assign users and groups**.  

![Image](https://cdn.document360.io/30792387-cdcb-4791-aa14-94929bbcd3fe/Images/Documentation/image-W637BQVJ.png?sv=2026-02-06&spr=https&st=2026-11-11T04%3A07%3A29Z&se=2026-11-11T05%3A07%3A29Z&sr=c&sp=r&sig=jSYvVN3Wz9jtzwcidb%2FFD68Kx2IrXAZM5rKFNGHMi3I%3D)  

The **Users and groups** screen is displayed.  

![Image](https://cdn.document360.io/30792387-cdcb-4791-aa14-94929bbcd3fe/Images/Documentation/image-LLRY25PJ.png?sv=2026-02-06&spr=https&st=2026-11-11T04%3A07%3A29Z&se=2026-11-11T05%3A07%3A29Z&sr=c&sp=r&sig=jSYvVN3Wz9jtzwcidb%2FFD68Kx2IrXAZM5rKFNGHMi3I%3D)
48. Click **Add user/group**.  

The **Add assignment** screen is displayed.  

![Image](https://cdn.document360.io/30792387-cdcb-4791-aa14-94929bbcd3fe/Images/Documentation/image-IDV5MNME.png?sv=2026-02-06&spr=https&st=2026-11-11T04%3A07%3A29Z&se=2026-11-11T05%3A07%3A29Z&sr=c&sp=r&sig=jSYvVN3Wz9jtzwcidb%2FFD68Kx2IrXAZM5rKFNGHMi3I%3D)
49. Add users or groups of users that you want to have access as end users and then add the role `ctera-di-user-prod` and then click **Assign**.
50. Add users or groups of users that you want to have access as administrators and then add the role `ctera-di-admin-prod` and then click **Assign**.

The following values that were noted throughout the procedure are used during the CTERA Content Services installation:

- OPENID_ISSUER – The identifier for the entity that issues the authentication tokens (typically the tenant ID).
- OPENID_CLIENT_ID – The secret key associated with the main application client.
- OPENID_CLIENT_SECRET – The secret key associated with your main application client.
- OPENID_ADMIN_ROLE_ID – The unique identifier for the administrator role in the identity system.
- OPENID_USER_ROLE_ID – The unique identifier for the standard user role in the identity system.