I am trying to implement Azure AD in my Content Hub portal. I have created the App in Azure Active Directory and also add the Application ID URI, federation metadata & get the Entity Id.

In my Content Hub portal, I have updated the ExternalAuthenticationProviders.saml and saved the same.

"ExternalAuthenticationProviders": {
    "global_username_claim_type": "http://schemas.xmlsoap.org/ws/2005/05/identity/claims/name",
    "global_email_claim_type": "http://schemas.xmlsoap.org/ws/2005/05/identity/claims/emailaddress",
    "saml": [
        "metadata_location": "https://login.microsoftonline.com/<id>/federationmetadata/2007-06/federationmetadata.xml",
        "sp_entity_id": "api://<id>",
        "idp_entity_id": "https://sts.windows.net/<id>/",
        "password": null,
        "certificate": null,
        "binding": "HttpRedirect",
        "authn_request_protocol_binding": null,
        "is_enabled": true,
        "provider_name": "SamlNewLocal",
        "messages": {
          "signIn": "Azure AD",
          "signInDescription": "Azure AD",
          "signInTitle": "Azure AD"
        "authentication_mode": "Active"

After this, I can do the login using the admin (my own email id) successfully. But the problem is I am not able to log in with other users.

Getting the below error from Content Hub:

Need your help on this, I have also enabled EnableRegister to true for new users. The domain I am using is user@<my domain>.onmicrosoft.com (Free AD).

Can anyone please highlight any point or any configuration?

2 Answers 2


To enable the Microsoft login, you just need the client id & secret. And put the follwing json settings in ExternalAuthenticationProviders.

"microsoft": [
        "authentication_mode": "Passive",
        **"client_id": "<client id>",**
        **"client_secret": "<client secret>",**
        "email_claim_type": "http://schemas.xmlsoap.org/ws/2005/05/identity/claims/emailaddress",
        "external_user_creation_url": "",
        "is_enabled": true,
        "messages": {
          "signIn": "Microsoft Sign In",
          "signInDescription": "",
          "signInTitle": "Microsoft Sign In"
        "provider_name": "Microsoft",
        "username_claim_type": "http://schemas.xmlsoap.org/ws/2005/05/identity/claims/name",

And make sure the AutoCreateUsers & EnableCredentialless is true.


To log in with the other user you need to perform the below steps:

  1. Create Groups into Azure AD like Author, Editor, or a single group like you have created Admin Group in your Azure AD. It will give you a unique GUID. Assign that group to all those users, which you want to log in.
  2. Next, you need to create the same group as a Role into the Sitecore and assign that role to the users.
  3. Now you need to map the claims between both Azure Group Id and Sitecore Role into your Sitecore.Plugin.IdentityProvider.AzureAd.xml file. You can find this file from location: {root path}\{your SC Identity Server Instance name}\Config\production

Find sample code below: I have created Approver Group on AD which Id is 14e9c831-bb83-4870-gh29-60b3354b215e and Role into the Sitecore named 'sitecore\Approver'.

<AzureADUserToApprover type="Sitecore.Plugin.IdentityProviders.DefaultClaimsTransformation, Sitecore.Plugin.IdentityProviders">
                <Claim1 type="groups" value="14e9c831-bb83-4870-gh29-60b3354b215e" />                
                <Claim1 type="role" value="sitecore\Approver" />

For more details, see the blog post: Setting Up Azure Active Directory Integration with Sitecore Identity Server

  • 1
    Hi Himmat, thanks for sharing this but my ask is for Sitecore Content Hub. Not Sitecore XP or XM
    – Arkadeep
    May 18, 2021 at 10:42

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.