Sign in to Odoo with Microsoft Azure / Entra ID
A ready-to-use, pre-configured Azure single sign-on for Odoo. Add your Client ID and tenant, enable it, and your team logs in with their Microsoft accounts — no fragile per-user linking, and it keeps working after database copies.
1
Sign in with Microsoft
on the login page
→
2
Microsoft Entra ID
OAuth 2.0 / OIDC
→
3
Logged into Odoo
matched by e-mail
Odoo 19
Entra ID / Azure AD
OAuth 2.0 · OIDC
Built on auth_oauth
Why teams install it
Azure SSO that just works — without the usual battle
Wiring Odoo up to Azure by hand means copying endpoints, fighting oauth_error=3, and re-linking every user. This module ships the provider pre-configured and fixes those failures for you.
Pre-configured provider
The Microsoft Azure OAuth provider — endpoints, scope and login button — is created on install. You only add your Client ID and tenant.
No more oauth_error=3
Existing users are matched by their Azure e-mail / UPN, so there is no per-user “reset password” linking step — and it survives environment copies.
Handles the missing e-mail claim
Azure often omits the email claim; the address is read from upn / preferred_username and, if needed, from the token itself.
Everything included
A complete, production-ready SSO
One-click Microsoft sign-in
Adds a Sign in with Microsoft Azure button to the Odoo login page — ready the moment you enable the provider.
Match users by e-mail
Turn on Match Users by E-mail and accounts that already exist in Odoo sign in via Azure — without turning on public signup.
Robust e-mail resolution
Reads the address from email, mail, preferred_username, upn, unique_name or userPrincipalName — or from the token payload.
Tenant field & redirect URI
Type your directory (tenant) ID and the authorization URL is rebuilt for you. The redirect URI to register in Azure is shown right on the form, ready to copy.
Zero manual system params
Sets auth_oauth.authorization_header for you — Microsoft Graph’s userinfo endpoint needs the Bearer header, which Odoo otherwise omits.
Standard & unobtrusive
Built on Odoo’s native auth_oauth — no core patches and no external Python dependencies.
Set up in minutes
From install to Microsoft sign-in in four steps
1
Install
Install the module; the Microsoft Azure provider appears (disabled) with endpoints and scope already filled in.
2
Register an Azure app
In Entra ID, create an app registration and add the redirect URI Odoo shows you (/auth_oauth/signin), with implicit access tokens enabled.
3
Enter Client ID + tenant
Open Settings → Microsoft Azure and paste the Client ID and your directory (tenant) ID.
4
Enable & log in
Tick Allowed; the Sign in with Microsoft button appears on the login page and your team is in.
The hard parts, solved
Fixes the classic Azure + Odoo failures
The two errors that stop most manual Azure setups — and a few more — are handled automatically.
✓oauth_error=3 (no matching user) — solved by e-mail / UPN matching.
✓Missing email claim — read from the UPN or the token payload.
✓No per-user “reset password” linking step.
✓Case-insensitive e-mail matching.
✓Keeps working after restoring or copying the database.
✓auth_oauth.authorization_header set for you.
Pre-configured out of the box
The Microsoft endpoints, already wired
You never copy these by hand — the provider ships with the correct Entra ID endpoints and scope.
Authorization endpoint
login.microsoftonline.com/<tenant>/oauth2/v2.0/authorize
Scope openid profile email
Userinfo (validation)
graph.microsoft.com/oidc/userinfo
Login button Sign in with Microsoft Azure
openid
profile
email
match by e-mail
v2.0 endpoints
Enterprise sign-in, minimal setup
A focused, standards-based connector — no boilerplate, no core patches, no surprises.
1-click
Microsoft sign-in on the login page
6
E-mail claim sources checked automatically
0
Per-user linking or reset-password steps
OIDC
OAuth 2.0 / OpenID Connect standard
Before you start
Requirements
A quick checklist to have Microsoft sign-in live.
✓Odoo 19.0 (Community or Enterprise).
✓Odoo’s auth_oauth module (ships with Odoo — installed automatically).
✓A Microsoft Entra ID (Azure AD) tenant.
✓An Azure app registration (Client ID) with a Web redirect URI https://<your-odoo>/auth_oauth/signin.
✓Users whose Odoo login / e-mail matches their Microsoft e-mail or UPN.
Good to know
Frequently asked questions
Do I have to configure the OAuth endpoints?
No. The Microsoft Azure provider ships pre-configured — authorization endpoint, userinfo endpoint, scope and login button. You only add your Client ID and tenant, then enable it.
What is oauth_error=3, and how is it fixed?
By default Odoo matches OAuth users by the provider’s numeric subject id, which breaks for users created before SSO (and after database copies). This module matches by e-mail / UPN instead, so existing users sign in with no manual linking step.
Azure isn’t returning an e-mail — will it still work?
Yes. Azure frequently returns the address as upn / preferred_username / unique_name instead of email. The module reads any of those and, if the endpoint drops them, decodes the token payload.
Does it survive copying or restoring the database?
Yes — because matching is by e-mail, not a stored numeric subject id, SSO keeps working after you restore, duplicate or move the database between environments.
Do users need public signup enabled?
No. Pre-provision users (or let admins create them) and they sign in via Microsoft — no open public signup required.
Which redirect URI do I register in Azure?
The one Odoo shows on the provider form — typically https://<your-domain>/auth_oauth/signin — added as a Web redirect URI on your app registration.
Microsoft Azure Login (SSO) for Odoo 19
Developed by Codevia
Microsoft, Azure, Entra ID and Microsoft 365 are trademarks of the Microsoft group of companies. This module is an independent integration and is not affiliated with or endorsed by Microsoft.
Please log in to comment on this module