Azure AD - Invalid verification, no login possible
Asked by Benjamin Brummer:

1. We connected Crowd to Azure AD/Office365
2. In Crowd: we added Directory "Azure AD" to Jira and Confluence and allowed All Groups (Tested also to only allow specific groups)
3. In Azure AD we created group confluence-users and jira-users and made a testuser member of these groups
4. Azure is successfully synced to crowd and crowd to confluence/jira
5. Crowd Authentication Test:

![image.png](/t5/image/serverpage/image-id/16153iD31AA7E9D92BF915/image-size/large?v=v2&px=999 "image.png")

Login on Jira/Confluence:

![image.png](/t5/image/serverpage/image-id/16154i91890801068AAE42/image-size/large?v=v2&px=999 "image.png")


Answers:
author: AnnWorley
body: Hi Benjamin,

Please let me know if you are following this guide: [Configuring Azure Active Directory](https://confluence.atlassian.com/crowd/configuring-azure-active-directory-935372375.html)

It looks like there are some steps on the Azure side:
> **Create a web application to allow Crowd to communicate with Azure AD.**

1.
   > Log in to your Azure Portal, and go to Azure Active Directory.
2.
   > Go to App registrations
3.
   > Create a new application registration with the following details:Application type: Web app / APISign-on URL: Crowd's base URL
   >
   > Configure permissions for the web application to allow Crowd to read data from Azure AD.
   > 1. Click your web application.
   > 2. In the `API ACCESS` section, click **Required permissions**.
   > 3. Click **Add \> Select an API** , and select **Microsoft Graph** . Then, add the following permission from:  
   >    * Read directory data  
   >      Make sure you add the permission from the *application permissions* list (not *delegated permissions*).
   > 4. Click **Save** and close the **Enable Access** blade.
   > 5. Click **Grant Permissions** and confirm.
   >
   > Create a key for the web application. Crowd will use this key to authenticate to Azure AD.
   > 1. Click your web application.
   > 2. In the `API ACCESS` section, click **Keys**.
   > 3. Choose a name and an expiry date for your key, then save it. Keep in mind that when the key expires and you don't replace it, Crowd will not be able to communicate with Azure AD.
   > 4. Copy and store the key value. You will not be able to view it after navigating away from the key settings.
   >
   > #### Native application {#toc-hId-1399585713}
   >
   > Create a native application that will be used by Crowd to validate user credentials.
   > 1. Again, go to **App registrations**, and create a new application registration with the following details:
   >
   > *
   >   * Type: Native
   >   * Redirect URL: Crowd's base URL
   >
   > Configure permissions for the native application to allow Crowd to validate user credentials.
   > 1. Click your native application.
   > 2. In the `API ACCESS` section, click **Required permissions**.
   > 3. Click **Grant Permissions** and confirm.

I look forward to hearing if that helps.

Thanks,

Ann

comments: author: Benjamin Brummer
body: I didi it a second time and now everything works. There must have been something wrong with the permissions on my first attempt. So everything works now as it should.


author: AnnWorley
body: That's great news! Thanks for the follow-up.


Tags: confluence

jira