// Module included in the following assemblies:
//
// * rosa_hcp/rosa-hcp-sts-creating-a-cluster-quickly.adoc
:_mod-docs-content-type: PROCEDURE
[id="rosa-hcp-sts-example-microsoft-entra-id-configuration_{context}"]
= Configuring Microsoft Entra ID as an external provider
:source-highlighter: pygments
:pygments-style: emacs
:icons: font

[role="_abstract"]
You can configure Microsoft Entra ID as an external authentication provider for your {product-title} cluster by using the {rosa-cli-first}. Before you configure this provider, you must have a Microsoft Entra ID server already set up.

For more information about setting up Microsoft Entra ID, see the link:https://learn.microsoft.com/en-us/entra/identity/?culture=en-us&country=us[Microsoft Entra ID documentation].

.Procedure

. Create an external authentication provider that uses Microsoft Entra ID by running the following command:
+
[NOTE]
====
You must set your own environment variables with values specific to your Microsoft Entra ID server.
====
+
[source,terminal]
----
$ rosa create external-auth-provider -c $CLUSTER_NAME \  
    --claim-mapping-groups-claim groups \
    --claim-mapping-username-claim <authorized_user_name> \ 
    --console-client-id $CONSOLE_CLIENT_ID \ 
    --console-client-secret $CONSOLE_CLIENT_SECRET_VALUE \ 
    --issuer-audiences "$AUDIENCE_1" \
    --issuer-ca-file ca-bundle.crt --issuer-url $ISSUER_URL \
    --name m-entra-id
----
+
The output should indicate that the external authentication provider was successfully created.
+
[source,terminal]
----
I: Successfully created an external authentication provider for cluster 'ext-auth-test'. It can take a few minutes for the creation of an external authentication provider to become fully effective.
----

. List the external authentication provider for your cluster to see the issuer URL, or use `rosa describe` to see all details, by running one of the following commands:
+
.. List the external authentication configuration on a specified cluster by running the following command:
+
[source,terminal]
----
$ rosa list external-auth-provider -c <cluster_name>
----
+
The output should show the issuer URL for the external authentication provider.
+
[source,terminal]
----
NAME        ISSUER URL
m-entra-id  https://login.microsoftonline.com/<group_id>/v2.0
----
+
.. Display the external authentication configuration on a specified cluster by running the following command:
+
[source,terminal]
----
$ rosa describe external-auth-provider \
    -c <cluster_name> --name <name_of_external_authentication>
----
+
The output displays the details of the external authentication provider.
+
[source,terminal]
----
ID:                          ms-entra-id
Cluster ID:                  <cluster_id>
Issuer audiences:
                             - <audience_id>
Issuer Url:                  https://login.microsoftonline.com/<group_id>/v2.0
Claim mappings group:        groups
Claim mappings username:     email
----
