> ## Documentation Index
> Fetch the complete documentation index at: https://docs.keephq.dev/llms.txt
> Use this file to discover all available pages before exploring further.

# Azure AD Authentication

> [!TIP]
>
> Keep Cloud: ✅ \\
>
> Keep Enterprise On-Premises: ✅ \\
>
> Keep Open Source: ⛔️

Keep supports enterprise authentication through Azure Entre ID (formerly known as Azure AD), enabling organizations to use their existing Microsoft identity platform for secure access management.

## When to Use

* **Microsoft Environment:** If your organization uses Microsoft 365 or Azure services, Azure AD integration provides seamless authentication.
* **Enterprise SSO:** Leverage Azure AD's Single Sign-On capabilities for unified access management.

## Setup Instructions (on Azure AD)

### Creating an Azure AD Application

1. Sign in to the [Azure Portal](https://portal.azure.com)
2. Navigate to **Microsoft Entra ID** > **App registrations** > **New registration**

![Azure AD App Registration](https://mintcdn.com/keep-docs/SMI4wgz6Tw4qDsiL/images/azuread_1.png?fit=max\&auto=format\&n=SMI4wgz6Tw4qDsiL\&q=85\&s=a1ae1b5b77d1e565b6e00e3610df2ebd)

3. Configure the application:
   * Name: "Keep"

> [!NOTE]
>
> Note that we are using "Register an application to integrate with Microsoft Entra ID (App you're developing)" since you're self-hosting Keep and need direct control over the authentication flow and permissions for your specific instance - unlike the cloud/managed version where Keep's team has already configured a centralized application registration.

![Azure AD App Registration](https://mintcdn.com/keep-docs/jGkt7cWtIlPdKHEY/images/azuread_2.png?fit=max\&auto=format\&n=jGkt7cWtIlPdKHEY\&q=85\&s=e7890b2ddac9ef1e0d5b9722b52e4407)

4. Configure the application (continue)

* Supported account types: "Single tenant"

> [!NOTE]
>
> We recommend using "Single tenant" for enhanced security as it restricts access to users within your organization only. While multi-tenant configuration is possible, it would allow users from any Azure AD directory to access your Keep instance, which could pose security risks unless you have specific cross-organization requirements.

* Redirect URI: "Web" + your redirect URI

> [!NOTE]
>
> We use "Web" platform instead of "Single Page Application (SPA)" because Keep's backend handles the authentication flow using client credentials/secrets, which is more secure than the implicit flow used in SPAs. This prevents exposure of tokens in the browser and provides stronger security through server-side token validation and refresh token handling.

> [!TIP]
>
> For localhost, the redirect would be [http://localhost:3000/api/auth/callback/microsoft-entra-id](http://localhost:3000/api/auth/callback/microsoft-entra-id)
>
> For production, it should be something like http\://your\_keep\_frontend\_domain/api/auth/callback/microsoft-entra-id

![Azure AD App Registration](https://mintcdn.com/keep-docs/jGkt7cWtIlPdKHEY/images/azuread_3.png?fit=max\&auto=format\&n=jGkt7cWtIlPdKHEY\&q=85\&s=cd461d2200433e4e51333f5d8099bf8f)

5. Finally, click "register"

### Configure Authentication

After we created the application, let's configure the authentication.

1. Go to "App Registrations" -> "All applications"

![Azure AD Authentication Configuration](https://mintcdn.com/keep-docs/jGkt7cWtIlPdKHEY/images/azuread_4.png?fit=max\&auto=format\&n=jGkt7cWtIlPdKHEY\&q=85\&s=67209e9f7257f617ec084c8dcf306b02)

2. Click on your application -> "Add a certificate or secret"

![Azure AD Authentication Configuration](https://mintcdn.com/keep-docs/jGkt7cWtIlPdKHEY/images/azuread_5.png?fit=max\&auto=format\&n=jGkt7cWtIlPdKHEY\&q=85\&s=8cdeefbcfad07bb83ea039516109b4a4)

3. Click on "New client secret" and give it a name

![Azure AD Authentication Configuration](https://mintcdn.com/keep-docs/jGkt7cWtIlPdKHEY/images/azuread_6.png?fit=max\&auto=format\&n=jGkt7cWtIlPdKHEY\&q=85\&s=9617e701252531e062626bab40bd7b44)

4. Keep the "Value", we will use it soon as `KEEP_AZUREAD_CLIENT_SECRET`

![Azure AD Authentication Configuration](https://mintcdn.com/keep-docs/jGkt7cWtIlPdKHEY/images/azuread_7.png?fit=max\&auto=format\&n=jGkt7cWtIlPdKHEY\&q=85\&s=9817c24ed8e4a3c83a0c98a6139d47fd)

### Configure Groups

Keep maps Azure AD groups to roles with two default groups:

1. Admin Group (read + write)
2. NOC Group (read only)

To create those groups, go to Groups -> All groups and create two groups:

![Azure AD Authentication Configuration](https://mintcdn.com/keep-docs/jGkt7cWtIlPdKHEY/images/azuread_16.png?fit=max\&auto=format\&n=jGkt7cWtIlPdKHEY\&q=85\&s=842181a123e6fee215497ea78326720c)

Keep the Object id of these groups and use it as `KEEP_AZUREAD_ADMIN_GROUP_ID` and `KEEP_AZUREAD_NOC_GROUP_ID`.

### Configure Group Claims

1. Navigate to **Token configuration**

![Azure AD Authentication Configuration](https://mintcdn.com/keep-docs/jGkt7cWtIlPdKHEY/images/azuread_8.png?fit=max\&auto=format\&n=jGkt7cWtIlPdKHEY\&q=85\&s=c0b99a97eb88f55cbe9c4dd6cccfddc3)

2. Add groups claim:
   * Select "Security groups" and "Groups assigned to the application"
   * Choose "Group ID" as the claim value

![Azure AD Authentication Configuration](https://mintcdn.com/keep-docs/jGkt7cWtIlPdKHEY/images/azuread_9.png?fit=max\&auto=format\&n=jGkt7cWtIlPdKHEY\&q=85\&s=0eab7846339f8fcf4efc3b88f9c5e789)

![Azure AD Authentication Configuration](https://mintcdn.com/keep-docs/SMI4wgz6Tw4qDsiL/images/azuread_10.png?fit=max\&auto=format\&n=SMI4wgz6Tw4qDsiL\&q=85\&s=3f1b7f83c27ed2b6407c615310eba0ac)

### Configure Application Scopes

1. Go to "Expose an API" and click on "Add a scope"

![Azure AD Authentication Configuration](https://mintcdn.com/keep-docs/SMI4wgz6Tw4qDsiL/images/azuread_11.png?fit=max\&auto=format\&n=SMI4wgz6Tw4qDsiL\&q=85\&s=e61778c576aa68ec040fa34aa9473177)

2. Keep the default Application ID and click "Save and continue"

![Azure AD Authentication Configuration](https://mintcdn.com/keep-docs/SMI4wgz6Tw4qDsiL/images/azuread_12.png?fit=max\&auto=format\&n=SMI4wgz6Tw4qDsiL\&q=85\&s=2621fe773fe0fc5f8a259c8de7dc00dd)

3. Add "default" as scope name, also give a display name and description

![Azure AD Authentication Configuration](https://mintcdn.com/keep-docs/SMI4wgz6Tw4qDsiL/images/azuread_13.png?fit=max\&auto=format\&n=SMI4wgz6Tw4qDsiL\&q=85\&s=cbe634a8a29805f500014bda2f40a56a)

3. Finally, click "Add scope"

![Azure AD Authentication Configuration](https://mintcdn.com/keep-docs/SMI4wgz6Tw4qDsiL/images/azuread_14.png?fit=max\&auto=format\&n=SMI4wgz6Tw4qDsiL\&q=85\&s=50c6ac911c34d240f0cdbba984537dd7)

## Setup Instructions (on Keep)

After you configured Azure AD you should have the following:

1. Azure AD Tenant ID
2. Azure AD Client ID

How to get:

![Azure AD Authentication Configuration](https://mintcdn.com/keep-docs/SMI4wgz6Tw4qDsiL/images/azuread_15.png?fit=max\&auto=format\&n=SMI4wgz6Tw4qDsiL\&q=85\&s=3f8ac72d3aa9873f9dcf965744ad6de4)

3. Azure AD Client Secret [See Configure Authentication](#configure-authentication).
4. Azure AD Group ID's for Admins and NOC (read only) [See Configure Groups](#configure-groups).

### Configuration

#### Frontend

| Environment Variable | Description | Required | Default Value |
| - | - | :-: | :-: |
| AUTH\_TYPE | Set to 'AZUREAD' for Azure AD authentication | Yes | - |
| KEEP\_AZUREAD\_CLIENT\_ID | Your Azure AD application (client) ID | Yes | - |
| KEEP\_AZUREAD\_CLIENT\_SECRET | Your client secret | Yes | - |
| KEEP\_AZUREAD\_TENANT\_ID | Your Azure AD tenant ID | Yes | - |
| NEXTAUTH\_URL | Your Keep application URL | Yes | - |
| NEXTAUTH\_SECRET | Random string for NextAuth.js | Yes | - |

#### Backend

| Environment Variable | Description | Required | Default Value |
| - | - | :-: | :-: |
| AUTH\_TYPE | Set to 'AZUREAD' for Azure AD authentication | Yes | - |
| KEEP\_AZUREAD\_TENANT\_ID | Your Azure AD tenant ID | Yes | - |
| KEEP\_AZUREAD\_CLIENT\_ID | Your Azure AD application (client) ID | Yes | - |
| KEEP\_AZUREAD\_ADMIN\_GROUP\_ID | The group ID of Keep Admins (read write) | Yes | - |
| KEEP\_AZUREAD\_NOC\_GROUP\_ID | The group ID of Keep NOC (read only) | Yes | - |

## Features and Limitations

#### Supported Features

* Single Sign-On (SSO)
* Role-based access control through Azure AD groups
* Multi-factor authentication (when configured in Azure AD)

#### Limitations

See [Overview](https://docs.keephq.dev/deployment/authentication/overview.md)


This documentation is built and hosted on [Mintlify](https://mintlify.com), a developer documentation platform.