# Advanced Insights Azure AD (Entra ID) Authentication

*Applies to: Patch My PC Advanced Insights*

Advanced Insights supports authentication using Entra ID credentials using OpenID. To configure this is a two-step process:

1. Create an App Registration in Entra
2. Enter the App Registration details to Advanced Insights

### Creating the App Registration <a href="#creating-the-app-registration" id="creating-the-app-registration"></a>

Navigate to the Entra Admin Centre and log in with an account that has permissions to create App Registrations.

You will add a name for the App Registration (for example *"AdvancedInsights"*).

In Supported Accounts select ***"Accounts in this organizational directory only"***

**Redirect URI**

{% hint style="info" %}
**Redirect URI** is used for Microsoft to return the login token to Advanced Insights.

\
This URI must be configured with the value of the internal FQDN of the server hosting Advanced Insights, including the configured port.

*(https\://**{AdvancedInsightsInternalServerFQDN}:{port}**/account/login)*
{% endhint %}

Example redirect URI:

*<https://advinsightsserver01.contoso.local:444/account/login>*

Select ***"Single-Page Application (SPA)"*** from the dropdown list in the **"*****Redirect URI"*** section, and enter the URI.

<figure><img src="https://3773699522-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2F-MX7dvS0r_4fc0AikgJS%2Fuploads%2FxIAfDMb4CO7GOPId7fNI%2Fapp-reg.png?alt=media&#x26;token=9e0193cc-3484-4af8-9a0b-8895b707304f" alt=""><figcaption></figcaption></figure>

When you have filled in the required properties click **Register**.

You will be shown the App Registration overview screen. We need to copy some properties from here.

Copy **Application (client) ID** and **Directory (tenant) ID** values into a Notepad document.

<figure><img src="https://3773699522-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2F-MX7dvS0r_4fc0AikgJS%2Fuploads%2FmXhBktcmuN0isGng4JrX%2Fapp-reg2.png?alt=media&#x26;token=6586ca7e-7a7b-4bf0-a9e7-1fabc54925ef" alt=""><figcaption></figcaption></figure>

Now click the *"**Authentication"*** link on the left in the *"**Manage**"* section.

In the *"**Implicit grant for hybrid flows"*** section, tick both options for:&#x20;

***"Access tokens (used for implicit flows)"***&#x20;

***"ID tokens (used for implicit and hybrid flows)"***&#x20;

This grants the application permissions to issue the tokens used by Advanced Insights to validate login.&#x20;

To save changes, click **'Save'**.

<figure><img src="https://3773699522-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2F-MX7dvS0r_4fc0AikgJS%2Fuploads%2FCZ6nBaXLYWCqL5BPurK3%2Fapp-reg3.png?alt=media&#x26;token=9435494e-ae45-4231-bd93-ba56aee61853" alt=""><figcaption></figcaption></figure>

Click "**Certificates and secrets"**, then within the **"Client secrets"** section, click ***"New client secret"***.

Name the secret and set an expiry duration that is suitable for your environment.&#x20;

{% hint style="info" %}
On expiry, logins to Advanced Insights using Entra ID credentials will stop working if you don’t update the client secret.
{% endhint %}

<figure><img src="https://3773699522-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2F-MX7dvS0r_4fc0AikgJS%2Fuploads%2Fm8xBfXohkXd7sXcNAuXy%2Fapp-reg5.png?alt=media&#x26;token=1bb67c08-5d4f-43fa-af76-e511620c84fe" alt=""><figcaption></figcaption></figure>

Click 'Add' to save the **"Client secret"** configuration.

Now you can copy the **"Value"** of your client secret and add it to your Notepad document:

<figure><img src="https://3773699522-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2F-MX7dvS0r_4fc0AikgJS%2Fuploads%2FGStyzLWVLyaqTsC7MNCF%2Fapp-reg6.png?alt=media&#x26;token=7df97b06-6903-446a-ad3a-907533b14c66" alt=""><figcaption></figcaption></figure>

This completes the configuration work in the Azure Portal.

### Adding settings to Advanced Insights <a href="#adding-settings-to-callisto" id="adding-settings-to-callisto"></a>

1. Log into Advanced Insights with an **administrator** role account and navigate to the ***'Administration' > 'Settings'*** menu. Select the ***"AzureAD"*** tab.
2. Clear the ***"Deactivate"*** checkbox.
3. Enter the value for your **Application ID/ClientID**.
4. Enter the value for your **Client Secret**.
5. Enter the value for your **Directory (tenant) ID**.
6. Select ***'Save All'***.

<figure><img src="https://3773699522-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2F-MX7dvS0r_4fc0AikgJS%2Fuploads%2FCwKx39XSB36Bov5R5Au8%2Fadvins1.png?alt=media&#x26;token=e0fcc6df-bd01-4a73-bbe0-03ff25a641fb" alt=""><figcaption></figcaption></figure>

## **New users**

{% hint style="info" %}
By default, new users configured in Advanced Insights **(including new Entra ID logins)** will not be active (and can not login) until an administrator manually activates the account.

<img src="https://3773699522-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2F-MX7dvS0r_4fc0AikgJS%2Fuploads%2FHjUO66r0YqS5wOtS0Wsl%2Factivation.png?alt=media&#x26;token=493bc1f6-473b-454c-bc1e-26fbb7951539" alt="" data-size="original">
{% endhint %}

1. Log into Advanced Insights with an **administrator** role account and navigate to the ***'Administration' > 'Settings'*** menu. Select the ***"User Management"*** tab.
2. Enable ***"New registered users are active by default."*** checkbox.
3. Select ***'Save All'***.

<figure><img src="https://3773699522-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2F-MX7dvS0r_4fc0AikgJS%2Fuploads%2Fd7Fs98YpMT3eKoQ9XhLO%2Fnewusers1.png?alt=media&#x26;token=bd1f2a50-c8a9-4e2d-965f-757fad4a7665" alt=""><figcaption></figcaption></figure>

This completes the configuration for adding the Entra ID App Registration details to Advanced Insights.

## **First login - Consent to Permissions**

The Advanced Insights logon screen will now show a ***"Sign in with Microsoft"*** button.

<figure><img src="https://3773699522-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2F-MX7dvS0r_4fc0AikgJS%2Fuploads%2F2zRaIkSikNcMpj74aohu%2Fadvinslogin1.png?alt=media&#x26;token=08b748e6-e676-424e-af3f-f0c74793e6ca" alt=""><figcaption></figcaption></figure>

At first logon, an Azure administrator will have to consent to the application registration requested permissions.

<figure><img src="https://3773699522-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2F-MX7dvS0r_4fc0AikgJS%2Fuploads%2FYxeouHPCMCamiy3qK5pX%2Fadvinslogin2.png?alt=media&#x26;token=387d379d-8136-41ef-80c6-9deaf2982902" alt=""><figcaption></figcaption></figure>

{% hint style="info" %}
By default, new users will only be granted access to the Advanced Insights overview home page.

Advanced Insights administrator can then enable access to additional dashboard views.&#x20;
{% endhint %}

<figure><img src="https://3773699522-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2F-MX7dvS0r_4fc0AikgJS%2Fuploads%2FhfubAfFNYocgbuRLa54w%2Fhome.png?alt=media&#x26;token=0715fae3-b631-43e5-a9b3-2d88740e1f2e" alt=""><figcaption></figcaption></figure>

### User requirements <a href="#user-requirements" id="user-requirements"></a>

You should check in the Users area in Advanced Insights that there are no existing user accounts with email addresses that match the Entra ID accounts you are going to have logging in. If you do, you can delete these accounts and they will be recreated on first login by that user.

You will always be able to log in as the Advanced Insights "Admin" to make configuration changes.

If the Entra ID account a user logs into Advanced Insights with has a matching on-prem AD Account with the same Email Address set, any RBAC role they have in ConfigMgr for their on-prem AD account will be maintained in Advanced Insights.

For example, if a log in with this Entra ID Account is used:

<figure><img src="https://3773699522-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2F-MX7dvS0r_4fc0AikgJS%2Fuploads%2FibfNS2K4lHPFvs8eQ0v7%2Fuser1.png?alt=media&#x26;token=581fbac1-b4c2-4e3e-955b-8bedb7fcbbbb" alt=""><figcaption></figcaption></figure>

The on-premises Active Directory object of this account has the users Entra ID UPN set as the email property:

<figure><img src="https://3773699522-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2F-MX7dvS0r_4fc0AikgJS%2Fuploads%2Fx4XywtyIcbb1luTSSoro%2Fuser2.png?alt=media&#x26;token=91f3cab7-7615-4c43-9451-a3072609d418" alt=""><figcaption></figcaption></figure>


---

# Agent Instructions: Querying This Documentation

If you need additional information that is not directly available in this page, you can query the documentation dynamically by asking a question.

Perform an HTTP GET request on the current page URL with the `ask` query parameter:

```
GET https://docs.patchmypc.com/patch-my-pc-insights/advanced-insights-azure-ad-entra-id-authentication.md?ask=<question>
```

The question should be specific, self-contained, and written in natural language.
The response will contain a direct answer to the question and relevant excerpts and sources from the documentation.

Use this mechanism when the answer is not explicitly present in the current page, you need clarification or additional context, or you want to retrieve related documentation sections.