Authentication with Azure AD Token

This guide walks you through exchanging your Microsoft Azure AD token for Ejento access tokens — no browser redirect required. This flow is designed for server-side applications, CLIs, and native apps that already authenticate users via Microsoft.

Overview

If your application already handles Microsoft authentication, pass the Azure AD id_token directly to Ejento to receive both Ejento tokens in return.

What you'll need

Your Azure AD id_token

The user's email address

Your Azure AD application's client ID registered with Ejento

What you'll get back

access_token — for calling Ejento Auth Service endpoints (valid 7 days)

ejento_access_token — for calling Ejento Platform APIs (valid 7 days)

Exchange for Ejento Tokens

Use your Azure AD token to authenticate with Ejento:

POST /auth-service/api/v2/sso/microsoft/azure-token-login
Content-Type: application/json

{
    "email": "[email protected]",
    "azure_ad_token": "<your Azure AD id_token>",

    "full_name": "Jane Doe",      // optional — used only on first-time account creation
    "auto_create": true,          // optional — set to false to block user creation if the user does not exist
    "organization_id": 1         // optional — org to assign the user to on first-time creation
}

No Authorization header is needed — the Azure AD token is the credential.

Response

{
    "success": true,
    "message": "Login successful",
    "data": {
        "access_token": "eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9...",
        "ejento_access_token": "a1b2c3d4e5f6...",
        "token_type": "bearer"
    }
}

Token Expiry & Refresh

Both tokens are valid for 7 days.

Each time you call this endpoint with a valid Azure AD token, Ejento automatically refreshes both tokens — no separate refresh step needed. Once your tokens are near expiry, call this endpoint again with a fresh Azure AD token to get a new pair.

Alternatively, if you only need to refresh the access_token without a full Azure AD re-authentication, use the standard refresh endpoint:

Note: Azure AD id_token expire in ~1 hour. Always use a fresh one when calling this endpoint.

Optional Parameters

Parameter	Type	Description
`full_name`	string	User's display name. Used only on first-time account creation.
`auto_create`	boolean	Set to `false` to return a 404 if the user doesn't exist instead of creating them. Default: `true`.
`organization_id`	integer	Ejento organization to assign the user to on first-time creation. Uses the environment default if not provided.

Troubleshooting

Error	Cause	Fix
`Azure AD token has expired`	The `id_token` is older than ~1 hour	Use a fresh Azure AD token
`Audience doesn't match`	Your Azure app client ID isn't registered with Ejento	Contact Ejento support to register your client ID
`Token email does not match provided email`	The `email` in the body doesn't match the email claim in the token	Ensure the email matches `preferred_username` from your token claims
`User not found`	`auto_create=false` and the user doesn't exist	Set `auto_create=true` or create the user first
`422 Validation Error`	Missing `email` or `azure_ad_token`	Ensure both fields are present and `Content-Type: application/json` is set

Authentication with Azure AD Token

Overview#

Exchange for Ejento Tokens#

Token Expiry & Refresh#

Optional Parameters#

Troubleshooting#

Overview

Exchange for Ejento Tokens

Token Expiry & Refresh

Optional Parameters

Troubleshooting