Step-by-Step Guide

Configure Microsoft Entra ID for OIDC Login

For: Speech Analytics App

Callback URL:

PART 1 — Configure Microsoft Entra (Azure AD)

Step 1 — Create the App Registration

1. Go to Microsoft Entra Admin Center (https://entra.microsoft.com/#home)

2. Navigate to App Registrations (left-hand menu)

3. Click on All Applications tab

4. Click + New registration

Fill in:

Click Register

Step 2 — Configure the Redirect URI (Critical Step)

1. Open the newly created app

2. Go to Authentication (Preview)

3. Click Redirect URI configuration tab

4. Click + Add Redirect URI

5. Choose Web

6. Enter this Redirect URI exactly:

6. Ensure:

   • ❌ Nothing is checked under  Implicit grant and hybrid flows

   • We are using Authorization Code Flow

7. Click Configure

✔️ Redirect URI must match exactly (including https and no trailing slash)

Step 3 — Create Client Secret

1. Go to Certificates & secrets

2. Click + New client secret

3. Add:

   • Description: Speech Analytics OIDC

   • Expiration: choose per security policy (e.g., 12 months)

4. Click Add

5. Immediately copy the Secret Value - you will need to enter it later into the Speech Analytics App

You now have:

• ✅ Client ID (Application ID - can be seen on the Overview page)

• ✅ Client Secret (value you just copied)

• ✅ Tenant ID (Directory ID - also on the Overview page)

Step 4 — Get the OIDC Discovery URL

1. Go to Overview

2. Click Endpoints

3. Copy the:

OpenID Connect metadata document (2nd from the bottom)

It will look like:

⚠️ Because we are using Single Tenant, make sure it contains your actual tenant ID — NOT common or organizations.

Example:

This is the ONLY URL you need to paste into Speech Analytics.

Step 5 — Add ID Token Claims

Speech Analytics maps users by email so we need to also do the following:

1. Go to Token configuration

2. Click + Add optional claim

3. Select:

   • Token type: ID

4. Then select:

   • email

   • preferred_username

   • given_name

   • family_name

5. Click Add

6. Check the box “Turn on the Microsoft Graph email, profile permission (required for claims to appear in token).”

7. Click Add

This ensures user identity fields are available during login.

Step 6 — No Enterprise App Assignment Required

Since the users will be assigned from the Speech Analytics App we do not need to configure Assignment.

PART 2 — Configure Speech Analytics App

Most likely Voicegain will create a Speech Analytics account for you and you will receive an email invitation. Create password and login. This password will allow you later to login using local non-sso login (which can be useful if your OIDC configuration in Speech Analytics App gets broken).

Open OIDC SSO settings - you can access them from Avatar icon (lower left corner), then Edit Profile, then SSO Configuration (bottom icon on the left)

Enable OIDC SSO

Turn ON:

Allowed Domains

Example:

This should match the domain of the email addresses of the users in your Entra. If needed you can enter more than on domain.

Discovery Endpoint URL

Paste here the discovery URL that we copied from Entra in Step 4 above:

Client ID

Paste the Client ID we copied in Step 3 above

From Entra → Overview.

Client Secret

Paste Client Secret you created in Step 3 above.

(Not the Secret ID — the VALUE.)

Save

Click Save

Summing Up

This configuration results in:

• ✅ OpenID Connect 1.0

• ✅ OAuth2 Authorization Code Flow

• ✅ Confidential Client (client secret)

• ✅ Standard JWT ID token

• ✅ Microsoft Entra as OIDC Identity Provider

Fully standards compliant.

End-to-End Login Flow (What Happens Internally)

1. User clicks login

2. Redirected to:

   login.microsoftonline.com/<tenant>/oauth2/v2.0/authorize 

3. User authenticates

4. Entra redirects to:

   https://analytics.voicegain.ai/auth-svc/openid-relay/callback 

5. Speech Analytics exchanges authorization code at:

   /oauth2/v2.0/token 

6. ID token validated using Entra JWKS

Standard OIDC.

Most Common Errors (If Something Fails)

Final Checklist

In Entra:

• Single Tenant

• Redirect URI added

• Client Secret created

• Using tenant-specific discovery URL

In Speech Analytics:

• OIDC Enabled

• Discovery URL correct

• Client ID correct

• Client Secret correct

• Allowed domain matches tenant email domain

Using Speech Analytics with SSO Enabled

The login URL is https://analytics.voicegain.ai/login

On the first page you enter your email, and if it matches the Entra email domain then you will be taken to Standard Microsoft login.

Fallback Local Login

If you had an account on Speech Analytics App before OIDC was configured you can also login using local login: https://analytics.voicegain.ai/login/local 

This bypasses OIDC and is handy if somehow the OIDC SSO login is not working.

Inviting Other Users

In order for other users to be able to login and use the Speech Analytics App, the Admin needs to Invite them: start from Avatar icon (lower left corner), then Edit Profile, then Users, then + (in the top right corner).