How to build Microsoft Entra ID OIDC enterprise SSO with Android (Kotlin / Java)

For our new friends:

Logto is an Auth0 alternative designed for modern apps and SaaS products. It offers both Cloud and Open-source services to help you quickly launch your identity and management (IAM) system. Enjoy authentication, authorization, and multi-tenant management all in one.

We recommend starting with a free development tenant on Logto Cloud. This allows you to explore all the features easily.

In this article, we will go through the steps to quickly build the Microsoft Entra ID OIDC enterprise SSO sign-in experience (user authentication) with Android (Kotlin / Java) and Logto.

Prerequisites

A running Logto instance. Check out the introduction page to get started.
Basic knowledge of Android (Kotlin / Java).
A usable Microsoft Entra ID OIDC enterprise SSO account.

Create an application in Logto

Logto is based on OpenID Connect (OIDC) authentication and OAuth 2.0 authorization. It supports federated identity management across multiple applications, commonly called Single Sign-On (SSO).

To create your Native app application, simply follow these steps:

Open the Logto Console. In the "Get started" section, click the "View all" link to open the application frameworks list. Alternatively, you can navigate to Logto Console > Applications, and click the "Create application" button.
In the opening modal, click the "Native app" section or filter all the available "Native app" frameworks using the quick filter checkboxes on the left. Click the "Android" framework card to start creating your application.
Enter the application name, e.g., "Bookstore," and click "Create application".

🎉 Ta-da! You just created your first application in Logto. You'll see a congrats page which includes a detailed integration guide. Follow the guide to see what the experience will be in your application.

Integrate Android with Logto

tip:

The example is based on View system and View Model, but the concepts are the same when using Jetpack Compose.
The example is written in Kotlin, but the concepts are the same for Java.
Both Kotlin and Java sample projects are available on our SDK repository.
The tutorial video is available on our YouTube channel.

Installation

note:

The minimum supported Android API level of Logto Android SDK is level 24.

Before you install Logto Android SDK, ensure mavenCentral() is added to your repository configuration in the Gradle project build file:

settings.gradle.kts
dependencyResolutionManagement {
  repositories {
    mavenCentral()
  }
}

Add Logto Android SDK to your dependencies:

Kotlin
Groovy

build.gradle.kts
dependencies {
  implementation("io.logto.sdk:android:1.1.3")
}

build.gradle
dependencies {
  implementation 'io.logto.sdk:android:1.1.3'
}

Since the SDK needs internet access, you need to add the following permission to your AndroidManifest.xml file:

AndroidManifest.xml
<?xml version="1.0" encoding="utf-8"?>
<manifest xmlns:android="http://schemas.android.com/apk/res/android"
  xmlns:tools="http://schemas.android.com/tools">

  <!-- add internet permission -->
  <uses-permission android:name="android.permission.INTERNET" />

  <!-- other configurations... -->
</manifest>

Init LogtoClient

Create a LogtoViewModel.kt and init LogtoClient in this view model:

LogtoViewModel.kt
//...with other imports
import io.logto.sdk.android.LogtoClient
import io.logto.sdk.android.type.LogtoConfig

class LogtoViewModel(application: Application) : AndroidViewModel(application) {
    private val logtoConfig = LogtoConfig(
          endpoint = "<your-logto-endpoint>",
          appId = "<your-app-id>",
          scopes = null,
          resources = null,
          usingPersistStorage = true,
    )

    private val logtoClient = LogtoClient(logtoConfig, application)

    companion object {
        val Factory: ViewModelProvider.Factory = object : ViewModelProvider.Factory {
            @Suppress("UNCHECKED_CAST")
            override fun <T : ViewModel> create(
                modelClass: Class<T>,
                extras: CreationExtras
            ): T {
                // Get the Application object from extras
                val application = checkNotNull(extras[APPLICATION_KEY])
                return LogtoViewModel(application) as T
            }
        }
    }
}

then, create a LogtoViewModel for your MainActivity.kt:

MainActivity.kt
//...with other imports
class MainActivity : AppCompatActivity() {
    private val logtoViewModel: LogtoViewModel by viewModels { LogtoViewModel.Factory }
    //...other codes
}

Configure redirect URI

Let's switch to the Application details page of Logto Console. Add a Redirect URI io.logto.android://io.logto.sample/callback and click "Save changes".

note:

Before calling logtoClient.signIn, make sure you have correctly configured Redirect URI in Admin Console.

You can use logtoClient.signIn to sign in the user and logtoClient.signOut to sign out the user.

For example, in an Android app:

LogtoModelView.kt
//...with other imports
class LogtoViewModel(application: Application) : AndroidViewModel(application) {
    // ...other codes

    // Add a live data to observe the authentication status
    private val _authenticated = MutableLiveData(logtoClient.isAuthenticated)
    val authenticated: LiveData<Boolean>
        get() = _authenticated

    fun signIn(context: Activity) {
        logtoClient.signIn(context, "io.logto.android://io.logto.sample/callback") { logtoException ->
            logtoException?.let { println(it) }
            // Update the live data
            _authenticated.postValue(logtoClient.isAuthenticated)
        }
    }

    fun signOut() {
        logtoClient.signOut { logtoException ->
            logtoException?.let { println(it) }
            // Update the live data
            _authenticated.postValue(logtoClient.isAuthenticated)
        }
    }
}

Then call the signIn and signOut methods in your activity:

MainActivity.kt
class MainActivity : AppCompatActivity() {
    override fun onCreate(savedInstanceState: Bundle?) {
        //...other codes

        // Assume you have a button with id "sign_in_button" in your layout
        val signInButton = findViewById<Button>(R.id.sign_in_button)
        signInButton.setOnClickListener {
            logtoViewModel.signIn(this)
        }

        // Assume you have a button with id "sign_out_button" in your layout
        val signOutButton = findViewById<Button>(R.id.sign_out_button)
        signOutButton.setOnClickListener {
            if (logtoViewModel.authenticated) { // Check if the user is authenticated
                logtoViewModel.signOut()
            }
        }

        // Observe the authentication status to update the UI
        logtoViewModel.authenticated.observe(this) { authenticated ->
            if (authenticated) {
                // The user is authenticated
                signInButton.visibility = View.GONE
                signOutButton.visibility = View.VISIBLE
            } else {
                // The user is not authenticated
                signInButton.visibility = View.VISIBLE
                signOutButton.visibility = View.GONE
            }
        }

    }
}

Checkpoint: Test your application

Now, you can test your application:

Run your application, you will see the sign-in button.
Click the sign-in button, the SDK will init the sign-in process and redirect you to the Logto sign-in page.
After you signed in, you will be redirected back to your application and see the sign-out button.
Click the sign-out button to clear token storage and sign out.

Add Microsoft Entra ID OIDC enterprise SSO connector

To simplify access management and gain enterprise-level safeguards for your big clients, connect with Android as a federated identity provider. The Logto enterprise SSO connector helps you establish this connection in minutes by allowing several parameter inputs.

To add an enterprise SSO connector, simply follow these steps:

Navigate to Logto console > Enterprise SSO.

Click "Add enterprise connector" button and choose your SSO provider type. Choose from prebuilt connectors for Microsoft Entra ID (Azure AD), Google Workspace, and Okta, or create a custom SSO connection using the standard OpenID Connect (OIDC) or SAML protocol.
Provide a unique name (e.g., SSO sign-in for Acme Company).

Configure the connection with your IdP in the "Connection" tab. Check the guides above for each connector types.

Customize the SSO experience and enterprise’s email domain in the "Experience" tab. Users sign in with the SSO-enabled email domain will be redirected to SSO authentication.

Save changes.

Set up Azure AD SSO application

Step 1: Create an Microsoft EntraID OIDC application

Go to the Microsoft Entra admin center and sign in as an administrator.
Browse to Identity > Applications > App registrations.

Select New registration.
Enter the application name and select the appropriate account type for your application.
Select Web as the application platform.
Copy and paste the redirect URI from Logto's SSO settings page. The redirect URI is the URL where the user is redirected after they have authenticated with Microsoft Entra ID.

Click Register to create the application.

Step 2: Configure Microsoft Entra ID OIDC SSO at Logto

After successfully creating an Microsoft Entra OIDC application, you will need to provide the IdP configurations back to Logto. Navigate to the Connection tab at Logto Console, and fill in the following configurations:

Client ID: A unique identifier assigned to your OIDC application by the Microsoft Entra. This identifier is used by Logto to identify and authenticate the application during the OIDC flow. You can find it in the application overview page as Application (client) ID.

Client Secret: Create a new client secret and copy the value to Logto. This secret is used to authenticate the OIDC application and secure the communication between Logto and the IdP.

Issuer: The issuer URL, a unique identifier for the IdP, specifying the location where the OIDC identity provider can be found. It is a crucial part of the OIDC configuration as it helps Logto discover the necessary endpoints.

Instead of manually provide all these OIDC endpoints, Logto fetch all the required configurations and IdP endpoints automatically. This is done by utilizing the issuer url you provided and making a call to the IdP's discover endpoint.

To get the issuer URL, you can find it in the Endpoints section of the application overview page.

Locate the OpenID Connect metadata document endpoint and copy the URL WITHOUT the trailing path .well-known/openid-configuration. This is because Logto will automatically append the .well-known/openid-configuration to the issuer URL when fetching the OIDC configurations.

Scope (Optional): Logto automatically includes the required scopes (openid, profile, and email) in all requests. You can specify additional scopes as a space-separated list if your application requires extra permissions or access levels from the IdP.

Click Save to finish the configuration process

Step 3: Additional scopes (Optional)

Scopes define the permissions your app requests from users and control which data your app can access from their Microsoft Entra ID accounts. Requesting Microsoft Graph permissions requires configuration on both sides:

In Microsoft Entra admin center:

Navigate to Microsoft Entra ID > App registrations and select your application.
Go to API permissions > Add a permission > Microsoft Graph > Delegated permissions.
Select only the permissions your app requires:
- OpenID permissions:
  - openid (Required) - Sign users in
  - profile (Required) - View users' basic profile
  - email (Required) - View users' email address
  - offline_access (Optional) - Required only if you enable Store tokens for persistent API access in the Logto connector and need to obtain refresh tokens for long-lived access to Microsoft Graph APIs.
- API access (Optional): Add any additional permissions needed for your app. Common Microsoft Graph permissions include Mail.Read, Calendars.Read, Files.Read, etc. Browse the Microsoft Graph permissions reference to find available permissions.
Click Add permissions to confirm the selection.
If your app requires admin consent for certain permissions, click Grant admin consent for [Your Organization].

In Logto Microsoft Entra ID connector:

Logto automatically includes openid, profile, and email scopes to retrieve basic user identity information. You can leave the Scopes field blank if you only need basic user information.
Add offline_access to the Scopes field if you plan to store tokens for persistent API access. This scope enables refresh tokens for long-lived API access.
Add additional scopes (separated by spaces) in the Scopes field to request more data from Microsoft Graph. Use standard scope names, for example: User.Read Mail.Read Calendars.Read

tip:

If your app requests these scopes to access the Microsoft Graph API and perform actions, make sure to enable Store tokens for persistent API access in Logto Microsoft Entra ID connector. See the next section for details.

Step 4: Store tokens to access Microsoft APIs (Optional)

If you want to access Microsoft Graph APIs and perform actions with user authorization, Logto needs to get specific API scopes and store tokens.

Add the required scopes in your Microsoft Entra admin center API permissions configuration and Logto Microsoft Entra ID connector.
Enable Store tokens for persistent API access in Logto Microsoft Entra ID connector. Logto will securely store Microsoft access and refresh tokens in the Secret Vault.
To ensure refresh tokens are returned, add the offline_access scope to your Microsoft Entra ID application permissions and include it in your Logto Microsoft Entra ID connector scopes. This scope allows your application to maintain access to resources for extended periods.

Step 5: Set email domains and enable the SSO connector

Provide the email domains of your organization on the connector experience tab. This will enable the SSO connector as an authentication method for those users.

Users with email addresses in the specified domains will be exclusively limited to use your SSO connector as their only authentication method.

Save your configuration

Double check you have filled out necessary values in the Logto connector configuration area. Click "Save and Done" (or "Save changes") and the Microsoft Entra ID OIDC enterprise SSO connector should be available now.

You don’t need to configure enterprise connectors individually, Logto simplifies SSO integration into your applications with just one click.

Navigate to: Console > Sign-in experience > Sign-up and sign-in.
Enable the "Enterprise SSO" toggle.
Save changes.

Once enabled, a "Single Sign-On" button will appear on your sign-in page. Enterprise users with SSO-enabled email domains can access your services using their enterprise identity providers (IdPs).

Auto detect SSO sign-in via email domain

Navigate to SSO sign-in via manually click link button

To learn more about the SSO user experience, including SP-initiated SSO and IdP-initiated SSO, refer to User flows: Enterprise SSO.

Testing and Validation

Return to your Android (Kotlin / Java) app. You should now be able to sign in with Microsoft Entra ID OIDC enterprise SSO. Enjoy!

Create an application in Logto​

Integrate Android with Logto​

Installation​

Init LogtoClient​

Configure redirect URI​

Implement sign-in and sign-out​

Checkpoint: Test your application​

Add Microsoft Entra ID OIDC enterprise SSO connector​

Set up Azure AD SSO application​

Step 1: Create an Microsoft EntraID OIDC application​

Step 2: Configure Microsoft Entra ID OIDC SSO at Logto​

Step 3: Additional scopes (Optional)​

Step 4: Store tokens to access Microsoft APIs (Optional)​

Step 5: Set email domains and enable the SSO connector​

Save your configuration​

Enable Microsoft Entra ID OIDC enterprise SSO connector in Sign-in Experience​

Testing and Validation​

Further readings​