Set Up Microsoft Entra ID SSO for Computer Backup Web Sign-In

Configure Microsoft Entra ID as the OpenID Connect (OIDC) identity provider for a Backblaze Computer Backup group with Enterprise Control. This guide covers sign-in to the Backblaze web console, group configuration, rollout, and recovery. It does not configure desktop or mobile application sign-in.

Note

These instructions provide general guidance for configuring Microsoft Entra ID SSO for a Backblaze Computer Backup group. Configuration requirements may vary by tenant and environment. Consult the linked Microsoft and Backblaze documentation, and test sign-in with a small group before enabling SSO for a production group.

Important

Enabling group SSO requires every member to use the configured identity provider. Existing members outside its authentication domains cannot sign in, and email addresses outside those domains cannot be added afterward. Confirm the domains, user access, and administrator recovery access before enabling SSO. If group members also use desktop or mobile apps, confirm those apps have a working SSO configuration before changing the group; this browser-only procedure does not establish their configuration.

Complete the Prerequisites

• A Microsoft Entra ID workforce tenant.

• Permission to create and manage the app registration, enterprise application, assignments, and credentials. A Cloud Application Administrator can perform application management tasks. Administrator consent may require additional authorization under your tenant’s policies.

• A Backblaze Computer Backup group with Enterprise Control enabled and group administrator access. Enterprise Control access is granted through Backblaze Sales or Support; see Configure Enterprise Control.

• A small test group and a test user for each intended SSO email domain.

• A populated Email/Mail value in each test user’s Entra profile that matches the intended Backblaze email address. Confirm that the sign-in flow supplies an email claim and opens the correct Backblaze account. Do not assume that a user principal name (UPN) guarantees a matching email claim.

• A secure location for the client secret and an owner responsible for its expiration and rotation.

• A group administrator with a verified recovery sign-in method. A Backblaze administrator who is not a member of the SSO-enabled group retains the original password sign-in method. An administrator who is a group member must be able to authenticate through OIDC.

The email permission does not guarantee an email claim for every user. Check each user’s Email (Mail) attribute and confirm that sign-in opens the intended Backblaze account. For more information, see the ID token claims reference.

Create an App Registration

1. Sign in to the Microsoft Entra admin center, and select the intended tenant.

2. Select Entra ID > App registrations.

3. Click New registration.

4. In Name, enter a descriptive name, such as Backblaze Computer Backup SSO.

5. Under Supported account types, select the single-tenant option, Accounts in this organizational directory only.

6. Under Redirect URI, select Web, and enter https://secure.backblaze.com/api/bz_oauth_sso_callback.

7. Click Register.

8. On Overview, copy the Application (client) ID and Directory (tenant) ID.

Configure the Web Redirect URIs

Configure the following HTTPS endpoints on the Web platform. The callback handles standard login; the verifier handles non-login SSO verification.

1. Open the app registration, and select Authentication.

2. In the Web redirect URI configuration, confirm that the callback URI is present.

3. Add the verifier URI to the Web configuration, preserving its exact spelling and path.

4. Click Save.

Entra’s newer Authentication interface uses Add Redirect URI to add a URI. Select Web when adding the HTTPS endpoint. Use the Web configuration editor when editing an existing entry.

Create a Client Secret

1. In the app registration, select Certificates & secrets.

2. Select Client secrets, and click New client secret.

3. Enter a description and an expiration period that follows your organization’s policy.

4. Click Add.

5. Copy the secret from the Value column, and store it securely with the expiration date.

Important

Copy the secret Value, not the Secret ID. The value cannot be retrieved after you leave the page. Do not include it in screenshots or documentation.

Configure API Permissions

1. In the app registration, select API permissions.

2. Click Add a permission.

3. Select Microsoft Graph, and select Delegated permissions.

4. Add the permissions in the following table.

5. Click Add permissions.

6. If your tenant requires administrator consent, have an authorized administrator grant that consent before testing.

For the separate organization-based SSO procedure, see Configure Entra SSO in the enterprise web console. Computer Backup groups use Group Management, as described below.

Assign Users to the Enterprise Application

1. In the Microsoft Entra admin center, select Entra ID > Enterprise applications.

2. Select the enterprise application created for the Backblaze app registration.

3. Under Manage, select Users and groups.

4. Click Add user/group.

5. Select the pilot users or a supported group-assignment option available under your Entra license.

6. Click Select, and click Assign.

If the enterprise application requires assignment, every user who will sign in must have an effective assignment. If assignment is not required, an assignment list alone does not restrict access. Review the application’s Assignment required? setting and your access policy.

Collect the Entra Configuration Values

1. Return to the app registration’s Overview page.

2. Click Endpoints.

3. Copy the tenant-specific OpenID Connect metadata document endpoint.

For the Microsoft public cloud, the tenant-specific v2 metadata URL has this form. Replace <TENANT_ID> with the Directory (tenant) ID:

https://login.microsoftonline.com/<TENANT_ID>/v2.0/.well-known/openid-configuration

Enter a tenant-specific issuer URL or metadata document URL. This guide uses the v2.0 metadata endpoint shown above. The issuer base URL is https://login.microsoftonline.com/<TENANT_ID>/v2.0. Replace <TENANT_ID> with your Directory (tenant) ID; do not use the common or organizations endpoint.

Configure SSO in Backblaze

Use a test group first. The steps below apply to the target group you select, including a production group only after testing.

1. Sign in to the Backblaze web console as a group administrator.

2. Under Business Groups, select Group Management.

3. Locate the target group, and click Edit Group.

4. Under Group Single Sign-On, select OpenID Connect as the provider.

5. In OIDC Issuer, enter the tenant-specific metadata URL, and click Auto-discover Endpoints.

6. Enter Web Client ID and Web Client Secret using the mapping above. For this browser-only setup, enter not-used in Native Client ID.

7. Click Authenticate, and complete the Entra authentication prompt.

8. Under Domains, enter each email domain used by the intended group members, and click Add Domain for each one.

9. Click Update Group. Saving this change enables SSO for the target group immediately. Its members must then use the configured identity provider.

Test Sign-In Before Rollout

1. Confirm the test group contains only users whose email addresses use the configured SSO domains and that pilot users have the required application assignments. Clicking Update Group in the previous procedure enabled SSO for this group.

2. In a private browser window, open the Backblaze sign-in page.

3. Enter a test user’s Backblaze email address, and complete Entra sign-in.

4. Confirm that the correct Backblaze account and group are accessible.

5. Repeat for each accepted email domain.

6. If the configuring administrator is a group member, verify that the administrator can complete OIDC sign-in and reopen the group settings.

7. Verify the independent administrator recovery sign-in method.

Roll Out SSO

• Confirm that all production group members can authenticate through the selected Entra tenant and use accepted email domains.

• Confirm that the email claim corresponds to the intended Backblaze account for each tested user population.

• Complete required application assignments and consent.

• If users rely on desktop or mobile apps, confirm those apps already have a working SSO configuration before enabling group-wide SSO. This guide configures browser sign-in only.

• Communicate the sign-in change and the support contact.

• Record the secret expiration, rotation owner, and administrator recovery procedure.

After the required checks succeed, repeat Configure SSO in Backblaze for the production group.

Rotate the Client Secret

1. Create a new client secret in Entra while the current secret is still valid.

2. Copy the new secret Value and record its expiration.

3. Update Web Client Secret in the Backblaze group configuration, and save the group changes.

4. Test a new browser sign-in session. If your organization has separately configured desktop or mobile SSO, verify those existing flows before deleting the replaced secret.

5. After successful verification, delete the replaced secret from Entra.

Disable SSO and Recover Access

1. Sign in using the administrator access method verified before rollout. If no administrator can access the settings, contact Backblaze Support.

2. Under Business Groups, select Group Management.

3. Locate the target group, and click Edit Group.

4. Under Group Single Sign-On, disable the SSO provider.

5. Click Update Group.

Members return to their previous sign-in methods, including two-factor authentication if previously configured. Users added after SSO was enabled may not have a Backblaze password and must use Forgot Password? before password sign-in. See Disable SSO for a Group.

Troubleshooting

For Microsoft error details, see Microsoft Entra authentication and authorization error codes and consent troubleshooting.

Additional Resources

• Enable and Disable Single Sign-On for a Group

• Configure Enterprise Control

• Configure Entra SSO in the enterprise web console (a separate organization-based workflow)

• Register an application in Microsoft Entra ID

• Redirect URI restrictions

• ID token claims reference