---
title: Setting up Entra ID authentication in Factry Historian
slug: how-tos/8fvF-azure-entra-id
createdAt: 2025-08-13T11:30:07.212Z
---

## Requirements

Before starting, make sure you have completed the App registration process. You can find the full instructions here: [Registering an App in Entra ID](docId\:y7NflUbTgVhBFaHpGvCBe).

You will need:

- **Tenant ID** – The unique identifier for your Entra ID tenant.
- **Client ID** – The application’s identifier created during app registration.
- **Client Secret** – The secret generated for the application in Entra ID.

***

## Configure authentication provider

1. In Factry Historian, go to: **Configuration > Server Settings > Authentication providers**.
2. Click **Create provider**.
3. Fill in:
   - **Name** – A friendly name for the authentication provider. This must be the exact name used as `<My-AUTH-PROVIDER>` as part of the callback URL [when registering the app in Entra ID.](docId\:y7NflUbTgVhBFaHpGvCBe)
   - **Tenant ID** – Your Entra ID tenant’s unique ID.
   - **Client ID** – The app’s unique ID from Azure.
   - **Client Secret** – The secret corresponding to the client ID.
4. Don't enable **group mapping** in this section (allows Azure groups to map to Factry Historian user groups). To configure this, see [Configure group mapping](docId:8fvF2zGAngAF70QY5yYeC).
5. Decide whether security groups or app roles are used to determine the Entra ID groups which the user is added to by setting the `Group mapping type`:
   - For security groups: select `Security groups`
   - For app roles: select `App roles`
6. Click **Save & test** to verify the configuration.

![](https://api.archbee.com/api/optimize/5fbu7Arve_PpG6EAsx3L9--0aKTjr83nT6xYyckzqxW-20250819-093959.png)

## Configure group mapping

Enable group mapping to automatically map user groups defined in Azure to user groups defined in Factry Historian, granting the according privileges to the users present in the Azure groups.

:::hint{type="info"}
When group mapping is enabled on the authentication provider, a user in Factry Historian can not be manually configured into a user group, since on each login the user will be linked to the user groups matching the authentication provider. To manually assign users to groups in Factry Historian, skip this section.
:::

1. In Factry Historian, go to **Configuration > Server Settings > Authentication providers** and select the configured Entra ID authentication provider to enable group mapping for it.
2. In Entra ID, find the **Object IDs** of the security groups or app roles you want to use. These can be found in the group overview.

:::hint{type="warning"}
Copy the **Object ID&#x20;**(and not the Name of the group) to paste in the Factry Historian user group mapping.
:::

::Image[]{src="https://api.archbee.com/api/optimize/5fbu7Arve_PpG6EAsx3L9-3Ne5XCvLfLlqChrQYTjCd-20250819-095939.png" size="100" width="3840" height="2022" position="center" showCaption="false" indent="3"}

3. In Factry Historian, go to **Configuration > Groups** and click the edit icon of the user group that you want to map to an Entra ID group.
4. In the Manage user group screen, Click **+ Create user group mapping**. Enter the Entra ID group **Object ID** (not the name) from Step 1 in the `Name` field in Factry Historian. Select the Entra ID Authentication provider e.g. `Microsoft` from the dropdown menu.
5. Click **Submit**.

![](https://api.archbee.com/api/optimize/SMPo4IS9FkillUAMsur2c/P0jJ_8yA-7Yi3EHI0hK6U-20251013-162523.png)

On saving a user group mapping, all the users in the Entra ID group matching the given Object ID will be granted the permissions of the mapped Factry Historian user group. This will automatically assign users to the correct groups when they log in into Factry Historian.

:::hint{type="success"}
We recommend to continue by configuring a user group mapping for each user group in Factry Historian: Administrators, Managers and Readers.
:::

## Test authentication and group mapping

To test Entra ID authentication and group mapping in Factry Historian:

1. Log out of Factry Historian.
2. Select the Entra ID authentication provider in the login screen and log in using your Entra ID account.
3. Verify:
   - If login succeeds without errors.
   - If the correct user groups and permissions are applied (if group mapping was enabled).

When successfully logging in with an Entra ID user in Factry Historian, the user will be automatically created in Factry Historian (if it does not exist yet).

**Trouble logging in?**
See [Entra ID authentication provider troubleshooting](docId:8fvF2zGAngAF70QY5yYeC) and/or [Entra ID app registration troubleshooting](docId\:y7NflUbTgVhBFaHpGvCBe) and look for your error.

## Troubleshooting

- [Troubleshooting Entra ID Authentication](docId\:qOg3bRlwI2HFPDLojGFXm)