# Auth with Azure AD

> Accept the tokens of Microsoft Entra ID (Azure AD) in API Maker - an Azure auth provider with the app id, the tenant, audience and issuer, the person found in your table, and the token sent in x-azure-authorization.

Source: https://docs.apimaker.dev/v1/docs/authorization/Azure.html

Your app signs people in with Microsoft Entra ID (Azure AD) and sends the token to API Maker. An auth provider of type **Azure** checks it against your application registration, finds the person in a table of yours, and runs the call with the groups of that person.

| | |
|---|---|
| Page | `API Security → Auth Providers` → type Azure. |
| Header | `x-azure-authorization: <Azure token>` |
| In code | `g.req.auth.authAzure` : the opened token, and the columns selected from your table. |

**The provider**

```typescript
import * as T from 'types';

let azureTokenGenerator: T.IAuthTokenAzureAD & { name: string; testObj?: any; } = {
    name: 'azure_token_generator',
    appId: '<application (client) id>',
    tenant: '<directory (tenant) id>',
    audience: '',                        // when your tokens carry another audience
    issuer: '',                          // when your tokens carry another issuer
    maxRetries: 3,                       // fetching the signing keys
    sourceFieldOfUniqueId: 'oid',        // or 'preferred_username' for the email
    groupsDataSource: { instance: 'mongodb', database: 'shop', collection: 'users', targetFieldForUniqueId: 'azure_oid', groupsColumn: 'groups', select: { name: 1, email: 1 } },
};
module.exports = azureTokenGenerator;
```

## The groups of the person

- `sourceFieldOfUniqueId` is the claim of the token which identifies the person (an email, `sub`, `oid`).
- `groupsDataSource` names the table of yours which holds that person : `targetFieldForUniqueId` is the column with the same value, `groupsColumn` the comma separated [groups](https://docs.apimaker.dev/v1/docs/apis-security/api-group-permission.html) of the person, `select` the columns to put in `g.req.auth`.
- Without `groupsDataSource`, the token is checked but the person gets no group of its own : only the API user decides.

## Require it

- `authProviders: ['azure_token_generator']` in the settings of the APIs, tables or databases, or in `common.authProviders` of the secret.
- The call carries the API user token in `x-am-authorization` and the token of the provider in ``x-azure-authorization``.
- `testObj` in the provider is the person the API testing page pretends to be.

## Related

- [Single sign-on](https://docs.apimaker.dev/v1/docs/features/single-sign-on-authentication.html) · [Auth of a database user](https://docs.apimaker.dev/v1/docs/authorization/AMDB.html) · [API group permissions](https://docs.apimaker.dev/v1/docs/apis-security/api-group-permission.html)