// Docs

Microsoft Entra ID Integration

PortGuard v1.1.12 · ← back to documentation

PortGuard integrates with Microsoft Entra ID (formerly Azure AD) via SAML 2.0 or OIDC, enabling centralized authentication and group-based VLAN mapping.

1. Application registration on Entra ID

  1. In the Entra portal: App registrations → New registration
  2. Set the Redirect URI: https://[PORTGUARD-IP]/auth/oidc/callback
  3. Note the Application (client) ID and Directory (tenant) ID
  4. Under Certificates & secrets generate a client secret and copy it

2. Configuration on PortGuard

  1. Dashboard → Settings → Identity Providers → Add Entra ID
  2. Enter the Tenant ID, Client ID and Client Secret
  3. Select the protocol (OIDC recommended)
  4. Save and use "Test connection" to verify

3. Group-Based VLAN mapping

To assign VLANs based on Entra ID groups:

  1. Enable emission of the groups claim in the app registration (Token configuration)
  2. In PortGuard → Policies → VLAN mapping associate the Entra group ID with the desired VLAN
  3. Define a default VLAN for users without a mapped group
Tip: use the group's Object ID (not the name) for mapping — it is immutable.

Support

[email protected]