2. FAQ
  3. Single Sign-On
Articles in this section
Updated Jan 30, 2026

Configure OpenID Connect Authentication with Microsoft Entra (Plugin & Apps)

This guide explains how to configure OpenID Connect authentication with Microsoft Entra ID for your organization in Mixup.

Overview

Mixup supports OpenID Connect authentication for desktop and mobile applications. This allows your users to authenticate with their Microsoft Entra ID accounts. Both SAML (for web) and OpenID Connect (for native apps) share the same user accounts based on email addresses.

Prerequisites

1. Microsoft Entra ID Application Setup

  1. Go to the Microsoft Entra admin center
  2. Navigate to App registrations → New registration
  3. Configure your application:
    • Name: Mixup Mobile/Desktop App
    • Supported account types: Choose based on your needs
    • Redirect URI:
      • Type: Web
      • URI: https://mixup.media/api/oauth/your-org-id/callback
      • Note: This URL can be copied from the OpenID Connect tab on the Single Sign-On settings page in Mixup
  4. After registration, note down:
    • Application (client) ID
    • Directory (tenant) ID
  5. Go to Certificates & secrets → New client secret
    • Add description and expiration
    • Copy the secret value immediately (it won't be shown again)
  6. Go to API permissions
    • Add Microsoft Graph permissions:
      • User.Read (Delegated)
      • email (Delegated)
      • profile (Delegated)
    • Grant admin consent if required

2. Configure OpenID Connect in Mixup

Now you'll configure Mixup with the Microsoft Entra ID application details you gathered in Step 1.

Access OpenID Connect Configuration

  1. Log in to your Mixup account as an organization administrator.
  2. Navigate to your organization settings:
    • Click on your organization name in the sidebar
    • Select Organization Settings
    • Click on Single Sign-On in the settings menu

  3. On the Single Sign-On page, you'll see multiple tabs. Click on the OpenID Connect tab.

Configure OpenID Connect Settings

  1. You'll see the OpenID Connect configuration section with the following fields:
    • Client ID (Required):
      • Paste the Application (client) ID from Microsoft Entra ID (from Step 1, point 4)
      • Example: 12345678-1234-1234-1234-123456789012
    • Client Secret (Required):
      • Paste the client secret value you copied from Microsoft Entra ID (from Step 1, point 5)
      • Important: This is the secret value, not the secret ID
      • Example: abc123~XyZ789...
    • Tenant ID (Required):
      • Paste your Directory (tenant) ID from Microsoft Entra ID (from Step 1, point 4)
      • For multi-tenant apps, use common instead of your tenant ID
      • Example: 87654321-4321-4321-4321-210987654321 or common
    • Redirect URI (Read-only):
      • This field displays your organization's callback URL
      • Copy this URL - you'll need it in Microsoft Entra ID configuration
      • Example: https://mixup.media/api/oauth/your-org-id/callback
      • This URL was used in Step 1, point 3 when configuring the Redirect URI in Microsoft Entra ID
  2. Review all entered information to ensure accuracy.
  3. Click Save to save your OpenID Connect configuration.
  4. You should see a success message confirming that your OpenID Connect configuration has been saved.

Important Notes:

  • An organization can have SAML only, OpenID Connect only, or both configured
  • You can use the same Microsoft Entra ID application for both SAML and OpenID Connect authentication
  • The OpenID Connect credentials are encrypted in the database for security
  • Make sure the Redirect URI in Microsoft Entra ID exactly matches the one shown in Mixup

Once configured, users will be able to authenticate through their desktop and mobile Mixup applications using their Microsoft Entra credentials. The authentication process is handled automatically by the Mixup applications.

Account Linking

The OpenID Connect implementation automatically handles account linking:

  1. New user: If no user exists with the email, a new account is created
  2. Existing SAML user: If a user was created via SAML web login, the OpenID Connect flow will link the Microsoft Entra ID to the existing account
  3. Existing OpenID Connect user: If the user already authenticated via OpenID Connect, they are logged in

All authentication methods (SAML web, OpenID Connect desktop/mobile) share the same user accounts based on email addresses.

Security Considerations

  1. Client Secret Protection: Store your OpenID Connect client secret securely. Never commit it to version control or share it publicly.
  2. Token Expiration: Access tokens expire after 1 year. Users will need to re-authenticate when their tokens expire.
  3. HTTPS: All OpenID Connect communication uses HTTPS for security.

Troubleshooting

Common Issues

  1. Authentication Fails
    • Verify the Client ID, Client Secret, and Tenant ID are correct in the Identity Provider configuration
    • Ensure the redirect URI in Microsoft Entra ID matches exactly: https://mixup.media/api/oauth/your-org-id/callback (replace your-org-id with your organization's ID)
    • Check that the Microsoft Entra ID app has the required API permissions: User.Read, email, and profile
    • Verify that admin consent has been granted for these permissions if required by your organization
  2. Users Can't Sign In
    • Ensure the Microsoft Entra ID app is enabled and not expired
    • Verify that users exist in your Microsoft Entra ID tenant
    • Check that the correct account types are configured (single tenant vs. multi-tenant)

Additional Resources