Set up SSO: OpenID Connect and Microsoft Entra ID

Prerequisites

• Admin access to DeepL
• Protocol: OIDC (Open ID Connect)
• Identity provider: Microsoft Entra ID (formerly AzureAD)
• A SSO domain has been defined in the Single sign-on section of your DeepL admin account. For more information, see this article. 

Set the SSO configuration in Microsoft Entra ID

Register application

1. Go to your Microsoft Entra ID instance and select Enterprise apps in the left-side panel.
2. Click on New application in the top panel.
3. Click on Create your own application in the top panel.
4. Enter DeepL SSO under What's the name of your app?.
5. Select Integrate any other application you don't find in the gallery (Non-gallery) and click Create.
6. Select App registration in the left-side panel.
7. Open the app registration of the app you just created.
8. Click on Add a Redirect URI on the Overview page. 
   
9. Click on Add a platform under Platform configurations.
10. Select Web and enter https://w.deepl.com/auth/realms/prod/broker/ALIAS/endpoint.
    (Replace ALIAS with your chosen company SSO domain. The ALIAS value can be found under Company SSO domain in the Single sign-on section in your DeepL admin account.)
    
11. Click Configure.

Create client secret

1. Select Certificates & secrets in the left-hand panel.
2. Under Client secrets, click on New client secret.
3. Add a description and select an expiration period.
4. Click Add and copy the secret value to a safe place. You will need it later in the DeepL set up.

Set permissions

1. Select API permissions in the left-hand panel.
2. By default the permission User.Read should be listed below Microsoft Graph. If not, insert it manually.
3. Click Add a permission in the center panel.
4. Select Microsoft Graph, then select Delegated permissions.
5. Check the box for email and GroupMember.Read.All and click Add permissions.
6. Click Grant admin consent and confirm with Yes.

Configure assignment

1. Go to Applications and select Enterprise applications in the left-hand menu.
2. Select your registered application.
3. Under Manage, select Properties in the left-hand panel.
4. Set Assignment required to Yes.

Collect endpoints

1. Go back to App registrations under Applications and select your registered application.
2. Select Overview in the left-hand panel.
3. Copy the Application (client) ID, which you need to enter in your DeepL account in the next step.
4. Select Endpoints from the top menu bar.
5. Copy the URL of the OpenID Connect metadata document from the list of endpoints.
   You will need to enter them in your DeepL account in the next step.

Set the SSO configuration in DeepL Accounts

1. Click on your user and select Account and go to the Settings tab.
   Under Team and Single sign-on the SSO domain has the status Domain name approved.
   

2. Click Set up SSO next to Single sign-on.

   

3. Enter the following information from the configured application in OneLogin.
   • OpenID Connect metadata
     Enter the URL from Microsoft Entra ID. For more information, see Collect endpoints.
   • Client ID
     You find the Client ID in Microsoft Entra ID in your registered Application when you select Overview in the left-side menu under Application (client) ID.
   • Client Secret
     For more information, see Create client secret.
4. Confirm and Save changes

If you only setting up SSO, test the configuration with a test user and activate SSO in your DeepL admin account.