Sign-in

Microsoft sign-in is always on, through the app registration. Add Google or any OpenID Connect provider beside it if some people have no Microsoft account, and passkeys so a person who signed in once comes back without Microsoft. If everyone has a Microsoft account, you can pass this step with no change.

For what each way of signing in changes about who gets in, read Sign-in providers.

Before you start

The app registration has passed. Its two redirect URIs already cover Microsoft.
For each provider you add, an account in its console that can create an application.

Steps

On step 5, Sign-in, the Providers list shows Microsoft (always on) and two buttons, Add Google and Add an OpenID Connect provider. Each provider you add shows a Redirect URI to copy and takes a Client id. Its secret goes under Credentials, in Client secret of the provider’s id, with The secret expires on.

Add Google

In the setup press Add Google. Leave Name on the sign-in page as Google. Copy the redirect URI:
```
https://metrics.example.com/api/auth/callback/google
```
In the Google Cloud console open the Google Auth Platform Clients page. If it asks you to create a project or register the app, do that first.
Select Create client and choose the application type Web application.
Under Authorized redirect URIs add the address above, then select Create.
Copy the Client ID into the setup’s Client id. Copy the Client secret into Client secret of google. Google shows the secret once.

Source: Google, Manage OAuth Clients.

Add Okta, Auth0, Keycloak or another OpenID Connect provider

Any provider that serves an OpenID Connect discovery document works. The product asks for the scopes openid, profile and email, uses the authorization code flow with PKCE, and needs a confidential client (one with a secret).

In the setup press Add an OpenID Connect provider. Enter a Name on the sign-in page (people see it on the button), and an Id: lower case letters, digits and underscores, such as okta. The id names the provider’s secret and cannot change after you save.

Copy the redirect URI the setup shows:

https://metrics.example.com/api/auth/sso/callback

In the provider, create a web application with that redirect URI.
- Okta: in the Admin Console go to Applications and Resources > Applications, select Create App Integration, Classic experience, OIDC - OpenID Connect, then Web Application. Add the address under Sign-in redirect URIs. The issuer is your Okta domain, https://example.okta.com, or a custom authorization server such as https://example.okta.com/oauth2/default. Source: Okta, Create OIDC app integrations and Authorization servers.
- Auth0: in the Dashboard go to Applications > Applications, select Create Application, Create it manually, choose Regular Web Applications and select Create. The application’s settings show Domain, Client ID and Client Secret, and take the address under Allowed Callback URLs. The issuer’s discovery document is at https://your-domain/.well-known/openid-configuration. Source: Auth0, Create Applications, Application Settings and OIDC discovery.
- Keycloak: create an OpenID Connect client in your realm with Client authentication switched on, which makes it a confidential client. Put the address in its Valid Redirect URIs, and read the secret on the client’s Credentials tab. The issuer is https://your-host/realms/your-realm. Source: Keycloak, the Server Administration Guide on creating an OpenID Connect client and client credentials, and OIDC endpoints.
Copy the provider’s client id into Client id and its secret into Client secret of your id.
In Issuer enter the issuer address. The check opens <issuer>/.well-known/openid-configuration and requires its issuer field to equal what you typed, character for character, so copy the issuer value from that document. A trailing slash counts.

Passkeys

Tick Let people sign in with a passkey to let a signed-in person add one. A passkey signs in only within 7 days of the person’s last sign-in through a provider, and only when the device verified the person (a PIN, fingerprint or face). A passkey is bound to the host in PUBLIC_BASE_URL: changing the address makes every passkey stop working.

Save and check

Press Check the sign-in providers. Each added provider’s secret is saved with it, and the secret and its expiry date are checked daily.

Check

The step passes when every added provider has a secret and every OpenID Connect issuer answers its discovery document. Then open https://metrics.example.com/sign-in in a private window and sign in through each provider once, as a test. Run the check again with:

pbmb admin check sign_in

A person who signs in with Google or OpenID Connect connects Power BI as a separate step, the first time a tool needs it, with the Microsoft account that has the same verified email. If a sentence appears, find it on When a check fails.

Next: Who gets in.