---
title: "Creating an OIDC Provider on Microsoft Entra ID"
slug: "creating-an-oidc-provider-on-microsoft-entra-id"
description: "Learn to create an OIDC provider on Microsoft Azure and connect it to VMS for secure authentication and S3 access with JWT tokens."
updated: 2026-11-03T00:42:51Z
published: 2026-11-03T00:42:51Z
canonical: "docs.vastdata.com/creating-an-oidc-provider-on-microsoft-entra-id"
---

> ## Documentation Index
> Fetch the complete documentation index at: https://docs.vastdata.com/llms.txt
> Use this file to discover all available pages before exploring further.

# Creating an OIDC Provider on Microsoft Entra ID

Follow these steps in Microsoft Azure to create an OIDC provider that you can connect to VMS. You must have permissions in Azure to create Enterprise Applications.

1. On Azure, navigate to Enterprise Applications.
2. Click Create your own application.
3. Enter a name for the application, then select Register an application to integrate with Microsoft Entra ID.
4. Click Create. The application is created.
5. Assign users to the app, as necessary.
6. On Azure, navigate to App Registrations and select the app created above.
7. Click on Endpoints (at the top). In the Endpoints side panel, copy the OpenID Connect metadata document URL. Use this as the Discovery URL to configure the provider in VAST VMS.

For V1.0 this looks like this: `https://login.microsoftonline.com/<TENANT>/.well-known/openid-configuration`

For V2.0: `https://login.microsoftonline.com/<TENANT>/v2.0/.well-known/openid-configuration` where `TENANT` is your tenant ID on Entra ID. See, for example, [https://learn.microsoft.com/en-us/entra/fundamentals/how-to-find-tenant](https://learn.microsoft.com/en-us/entra/fundamentals/how-to-find-tenant) for details on how to find your tenant ID.
8. Optionally, navigate to Authentication (Preview) (in the navigation pane on the left) and add a Redirect URI. To test the OIDC configuration, enter `https://jwt.ms`.
9. Navigate to API permissions, and select Grant admin consent for Default Directory. Alternatively, add specific permissions manually.

### **Authenticating to the OIDC Provider**

Once the OIDC provider is configured, you can use this URL to authenticate a user and obtain a JWT (this example uses OAuth 2.0):

```plaintext
curl -X POST \
-H "Content-Type: application/x-www-form-urlencoded" \
-d "client_id=<client ID>" \
-d "client_secret=<secret>" \
-d "username=user1@vastdata.com" \
-d 'password=<password>' \
-d "grant_type=password" \
-d "resource=https://graph.windows.net" \
https://login.microsoftonline.com/<tenant>/oauth2/token | jq -r .access_token
```

where `client ID` is your Entra ID client, `client_secret` your secret key, `tenant` is your Entra ID tenant, and `password` is your password.

### **Using the VAST STS and OIDC Provider to Generate Credentials for S3 Access**

Once you have configured the OIDC provider on Entra ID, following the steps above, and configured the OIDC provider on the VAST Web UI (see [OIDC Provider](/docs-5-5/docs/oidc-provider)), follow the steps to create a JWT token, and then, with this token, a temporary access key to access S3 resources on the cluster.

- Generate a temporary access key by assuming an IAM Role in VMS and using the JWT; for example, use this command from the AWS CLI:

```plaintext
aws sts assume-role-with-web-identity \
 --duration-seconds 3600 \
 --role-arn "arn:vast::<VAST_TENANT>:role/<IAMROLE>" \
 --role-session-name "AnythingYouWantHere" \
 --web-identity-token "<JWT>" \
 --endpoint-url https://<VIP> \
 --no-verify-ssl
```

where `VAST_TENANT` is the tenant on VMS associated with the OIDC provider, `IAMROLE` is the IAM role created on VMS, `JWT` is the token obtained in [Authenticating to the OIDC Provider](/docs-5-5/docs/oidc-provider), and `VIP` is a VIP to access the S3 resource on the cluster (for example, if the resource is an S3 bucket, one of the VIP addresses for it).