Skip to main content
AzureAD OAuth is part of the Formbricks Enterprise Edition

​
Microsoft Entra ID

Do you have a Microsoft Entra ID Tenant? Integrate it with your Formbricks instance to allow users to log in using their existing Microsoft credentials. This guide will walk you through the process of setting up an Application Registration for your Formbricks instance.

​
Requirements

Upgrading from v5.1 or earlier? This path changed once, at v5.2:
  • v5.1 and earlier: {WEBAPP_URL}/api/auth/callback/azure-ad
  • v5.2 and later (current): {WEBAPP_URL}/api/auth/oauth2/callback/azuread
The two are distinct URIs, because the provider id itself also changed (azure-ad → azuread). Add the current one under Redirect URIs in your app registration, or Azure AD sign-in fails with a redirect-URI mismatch. Upgrading from v5.2 or later needs no change — the callback URL is pinned and does not move with Formbricks’ authentication library. See the migration guide.

​
How to connect your Formbricks instance to Microsoft Entra

1

Access the Microsoft Entra admin center

first
2

Create a new app registration

  • Click the New registration button at the top.
second
3

Configure the application

  • Name your application something descriptive, such as Formbricks SSO.
third
  • If you have multiple tenants/organizations, choose the appropriate Supported account types option. Otherwise, leave the default option for Single Tenant.
fourth
  • Under Redirect URI, select Web for the platform and paste your Formbricks callback URI (see Requirements above).
fifth
  • Click Register to create the App registration. You will be redirected to your new app’s Overview page after it is created.
4

Collect application credentials

  • On the Overview page, under Essentials:
    • Copy the entry for Application (client) ID to populate the AZUREAD_CLIENT_ID variable.
    • Copy the entry for Directory (tenant) ID to populate the AZUREAD_TENANT_ID variable.
Use the Directory (tenant) ID GUID (or a verified domain) — with it set, Formbricks fully verifies Microsoft id_tokens against your tenant’s issuer.For a multi-tenant app registration, either leave AZUREAD_TENANT_ID unset, which is equivalent to common and accepts both work/school and personal accounts, or set it to organizations to accept work/school accounts only. Those two authorities advertise a placeholder issuer rather than a real one, so Formbricks skips id_token verification for them and takes the signed-in identity from Microsoft’s userinfo endpoint — the authority you configure still applies at sign-in, so organizations keeps restricting which accounts Microsoft will accept. consumers is unaffected: personal Microsoft accounts share one well-known tenant, so its id_tokens are verified normally.
sixth
5

Create a client secret

  • From your App registration’s Overview page, go to Manage > Certificates & secrets.
seventh
  • Make sure you have the Client secrets tab active, and click New client secret.
eighth
  • Enter a Description, set an Expires period, then click Add.
You will need to create a new client secret using these steps whenever your chosen expiry period ends.
ninth
  • Copy the entry under Value to populate the AZUREAD_CLIENT_SECRET variable.
Microsoft will only show this value to you immediately after creation, and you will not be able to access it again. If you lose it, simply create a new secret.
tenth
6

Update environment variables

  • Update these environment variables in your docker-compose.yml or pass it like your other environment variables to the Formbricks container.
You must wrap the AZUREAD_CLIENT_SECRET value in double quotes (e.g., “THis~iS4faKe.53CreTvALu3”`) to prevent issues with special characters.
An example .env for Microsoft Entra ID in Formbricks would look like this:
Formbricks Env for Microsoft Entra ID SSO
7

Restart and test

  • Restart your Formbricks instance.
  • You’re all set! Users can now sign up & log in using their Microsoft credentials associated with your Entra ID Tenant.

​
Keeping display names in step with your directory

SSO name synchronization is part of the Formbricks Enterprise Edition
A user’s name in Formbricks comes from the OIDC name claim, which is their Entra ID displayName. That attribute is free text, so its format is whatever your directory holds — accounts synced from on-premises Active Directory often read Surname, Givenname, while accounts created in the Entra admin center usually read Givenname Surname. Formbricks keeps whatever order your directory uses — it never reorders a name into First Last. It does normalize the value before storing it: characters outside the allowed set (letters, marks, spaces, and ' , . & ( ) - plus digits) collapse to a single space, so Doe, Jane is stored unchanged while stray markup or line separators are replaced with a single space. Formbricks re-reads that name from Entra ID on every sign-in, so a rename in your directory — a marriage, a legal rename, a corrected import — reaches Formbricks the next time that person logs in.
Because Entra ID is authoritative for the name, the Full name field under Account → Profile is read-only for users who signed in through SSO, exactly as the email field already is. Change the name in your directory instead.