Microsoft Azure Active Directory authentication

Prerequisites

The Microsoft Azure Active Directory connector supports the following authentication methods:

• Application access - OAuth2.0 (Client Credentials)
• Delegated access - OAuth 2.0 (Authorization Grant)
• Client Certificate Authentication - OAuth2.0 (Client Certificate)

Before creating a connection, you need an active Microsoft Azure application registration. To set one up:

1. Sign in to the Azure Portal and navigate to Azure Active Directory > App registrations.
2. Select New registration.
3. Enter a name for your application (for example, UiPath IS Azure AD).
4. Under Supported account types, select one of the following:
   • Accounts in this organizational directory only — for a single-tenant application.
   • Accounts in any organizational directory — for a multi-tenant application.
5. Select Register.

After registration, collect the following values from the app's Overview page — you will need them when creating the connection in Integration Service:

Value	Where to find it
Application (client) ID	Overview page of the app registration
Directory (tenant) ID	Overview page of the app registration

To create a connection, you need to provide the following credentials:

• For Application access:
  • Client ID
  • Client secret
  • Tenant ID
• For Delegated access:
  • Client ID
  • Client secret
  • Tenant ID
  • Username
  • Password
• For Client Certificate Authentication:
  • Client ID
  • OAuth base64 client certificate
  • Password for the certificate
  • Tenant ID
  • OAuth Scope

To learn more about authentication credentials and how to set up the Azure Active Directory integration, refer to Setting up the Azure AD Integration in the Automation Cloud Guide.

Additional information is available in the Microsoft official documentation: Authentication and authorization basics, Introduction to permissions and consent, and Retrieving credentials.

Application access

Use this option to authenticate as the application itself, without a signed-in user context. This is the recommended option for unattended automation scenarios.

Setting up the client secret in Azure

1. In your Azure app registration, go to Certificates & secrets > Client secrets > New client secret.
2. Enter a description and select an expiry period.
3. Select Add and immediately copy the Value — it is shown only once.

Important:

Client secrets expire. Rotate the secret before the expiry date to avoid connection failures.

Required API permissions

In your Azure app registration, go to API permissions > Add a permission > Microsoft Graph > Application permissions and add the following:

Minimum required

Permission	Type	Description
User.Read.All	Application	Read all users' full profiles
Group.Read.All	Application	Read all groups
Directory.Read.All	Application	Read directory data
RoleManagement.Read.Directory	Application	Read all directory RBAC settings

Optional (add only if your automation creates or modifies objects)

Permission	Type	Description
Group.ReadWrite.All	Application	Read and write all groups
Directory.ReadWrite.All	Application	Read and write directory data
RoleManagement.ReadWrite.Directory	Application	Read and write all directory RBAC settings

After adding the permissions, select Grant admin consent for [your organization].

Connection fields

Field	Description
Client ID	The Application (client) ID from the Overview section of your Azure app registration.
Client Secret	The secret value from the Certificates & secrets section. Use the Value, not the Secret ID.
Tenant ID	The Directory (tenant) ID from the Overview section of your Azure app registration.

Delegated access

Use this option to perform actions on behalf of a signed-in user. The connection authenticates using OAuth 2.0 delegated permissions and prompts the user for consent during connection creation.

Setting up delegated access in Azure

1. In your Azure app registration, go to Authentication > Add a platform > Web.

2. In the Redirect URIs field, enter the callback URL displayed on the UiPath connection screen: https://{baseURL}/provisioning_/callback (for example, https://cloud.uipath.com/provisioning_/callback for Automation Cloud).

   Note:

   The exact callback URL is shown on the connection creation screen in Integration Service. Copy it from there, as it may differ depending on your deployment (Automation Cloud, Automation Suite, or private cloud).

3. Under Implicit grant and hybrid flows, leave both checkboxes unselected.

4. Select Configure.

Required API permissions

In your Azure app registration, go to API permissions > Add a permission > Microsoft Graph > Delegated permissions and add the following:

Minimum required (needed to establish the OAuth connection)

Permission	Type	Description
openid	Delegated	Sign users in
profile	Delegated	View users' basic profile
email	Delegated	View users' email address
offline_access	Delegated	Maintain access to data when the user is not present
User.Read	Delegated	Sign in and read user profile

Optional (add based on the operations your automation performs; permissions marked with * require admin consent)

Permission	Type	Description
User.ReadWrite	Delegated	Read and update user profile
User.Read.All*	Delegated	Read all users' full profiles
Group.Read.All*	Delegated	Read all groups
Group.ReadWrite.All*	Delegated	Read and write all groups
Directory.Read.All*	Delegated	Read directory data
Directory.ReadWrite.All*	Delegated	Read and write directory data

For permissions that require admin consent, select Grant admin consent for [your organization] after adding them.

Connection fields

Field	Description
Client ID	The Application (client) ID from the Overview section of your Azure app registration.
Client Secret	The secret value from the Certificates & secrets section. Use the Value, not the Secret ID.
Tenant ID	The Directory (tenant) ID from the Overview section of your Azure app registration. For multi-tenant applications, use common. For single-tenant applications, enter your specific tenant ID.

After filling in the fields, select Connect. A Microsoft sign-in window opens — sign in with the user account to be used for automation and grant the requested permissions.

Client Certificate Authentication

Use this option to authenticate using a client certificate instead of a client secret.

Setting up a certificate in Azure

1. In your Azure app registration, go to Certificates & secrets > Certificates.
2. Select Upload certificate and upload your .cer or .pem public key file.
3. After upload, note the thumbprint value for your records.

Generating the certificate locally

To generate a certificate locally (if you do not already have one):

1. Create a self-signed certificate with Subject set to CN=uipath.com and Content Type set to PEM.
2. Download the certificate in .pfx format.
3. Convert the .pfx file to Base64-encoded format before entering it in the connection field.

You can also use a Powershell script. For example, the following script generates a self-signed certificate and exports it in the required formats:

# Generate self-signed cert
$cert = New-SelfSignedCertificate `
    -Subject "CN=uipath.com" `
    -CertStoreLocation "Cert:\CurrentUser\My" `
    -KeyExportPolicy Exportable `
    -KeySpec Signature `
    -KeyLength 2048 `
    -HashAlgorithm SHA256 `
    -NotAfter (Get-Date).AddYears(2)

# Export public key (.cer) — upload this to Azure
Export-Certificate -Cert $cert -FilePath ".\uipath.cer" -Type CERT

# Export private key (.pfx)
$pfxPassword = Read-Host "Enter PFX password" -AsSecureString
Export-PfxCertificate -Cert $cert -FilePath ".\uipath.pfx" -Password $pfxPassword

# Convert .pfx to Base64 — paste this value into the connection field
$base64 = [Convert]::ToBase64String([IO.File]::ReadAllBytes(".\uipath.pfx"))
$base64 | Out-File ".\uipath_base64.txt"

Write-Host "Thumbprint: $($cert.Thumbprint)"
Write-Host "Base64 saved to uipath_base64.txt"
Write-Host "Upload uipath.cer to Azure > Certificates & secrets > Certificates"

Required API permissions

In your Azure app registration, go to API permissions > Add a permission > Microsoft Graph > Application permissions and add the following:

Minimum required

Permission	Type	Description
User.Read.All	Application	Read all users' full profiles
Group.Read.All	Application	Read all groups
Directory.Read.All	Application	Read directory data

Optional (add only if your automation creates or modifies objects)

Permission	Type	Description
Group.ReadWrite.All	Application	Read and write all groups
Directory.ReadWrite.All	Application	Read and write directory data

After adding the permissions, select Grant admin consent for [your organization].

Connection fields

Field	Description
OAuth base64 client certificate	The client certificate in Base64-encoded format, converted from the .pfx file downloaded from Azure.
Password for the certificate	The password set during certificate creation.
Client ID	The Application (client) ID from the Overview section of your Azure app registration.
Tenant ID	The Directory (tenant) ID from the Overview section of your Azure app registration.

Add the connection

To create a connection to your Microsoft Azure Active Directory instance, you need to perform the following steps:

1. Select Orchestrator from the product launcher.
2. Select a folder, and then navigate to the Connections tab.
3. Select Add connection.
4. To open the connection creation page, select the connector from the list. You can use the search bar to find the connector.
5. From the Authentication Type dropdown, select one of the available options: Client Certificate Authentication, Application access, or Delegated access. By default, Application access is selected.
6. Enter the required credentials and select Connect.