Skip to content
This repository was archived by the owner on May 12, 2026. It is now read-only.

Update README.md#330

Open
perrytheproducer wants to merge 1 commit into
9p4:mainfrom
perrytheproducer:patch-1
Open

Update README.md#330
perrytheproducer wants to merge 1 commit into
9p4:mainfrom
perrytheproducer:patch-1

Conversation

@perrytheproducer

Copy link
Copy Markdown

I have tested and confirmed that EntraID works as well. I will create steps to support this soon.

I have tested and confirmed that EntraID works as well. I will create steps to support this soon.
@perrytheproducer

Copy link
Copy Markdown
Author

Where would I put instructions for this? Sorry I am still learning GitHub but here is what I got so far. This should help some:

Steps to configure EntraID SSO
Prerequisites:
Microsoft account
•You can configure an account for free for this use case
Helpful if you have your own domain, but if not you can use http://localhost/
Open a notepad to copy over important information.
The Jellyfin SSO app should be installed already.

Login into the Entra Admin Center -> https://entra.microsoft.com/
Navigate to App Registrations and click New Registration
Name your application (Jellyfin SSO works!)
For Supported account types
Select "Accounts in this organizational directory only (Default Directory only - Single tenant)"
For the Redirect URI, select "web" in the first column.
Enter your Redirect URI.
If you have you own domain, the URL will likely look like https://jellyfin.a-really-good-domain.com/sso/OID/redirect/microsoft
If you do not have a domain use http://localhost/sso/OID/redirect/microsoft
You can use both redirect URIs as you can have more than one.
Register your app.
Click "Endpoints"
Locate "OpenID Connect metadata document" and copy the URL
It should look similar to https://login.microsoftonline.com/Directory (tenant) ID here/v2.0/.well-known/openid-configuration

Navigate to Enterprise Applications
Take note of your Application (client) ID
Take note of your Directory (tenant) ID
Click Authentication
You should see your Redirect URIs here already. If not, please add them as notated above.
Click Settings
Enabled "ID tokens (used for implicit and hybrid flows)"
Confirm "Supported account types" is configured for "Accounts in this organizational directory only (Default Directory only - Single tenant)"
Click Save

Click Certificates & Secret
Click New client secret
Create a new client secret. You can set when the secret expires. When it expires you will need to come back here to generate another one or your Jellyfin SSO will no longer work.

Please note the value from your client secret. Put it somewhere safe as the value is only visible immediately after creation.

Click Token Configuration
Click Add optional claim and select "ID" for the token type
Select email, preferred_username, and upn and click "Add"

Click API permissions
Click Add a permission
Select Microsoft Graph
Select Email, profile under OpenId permissions
Select User.Read under User permissions
You can also search for these permissions as well

At this point you should have your
.well-known/openid-configuration URL
Application (client) ID
Directory (tenant) ID
And client secret value

If something is missing, please review the previous steps again.

Navigate to the JellyfinSSO plugin
Confirm the plugin is enabled
Open the settings
Configure the plugin
Name of OpenID Provider: microsoft
OpenID Endpoint: .well-known/openid-configuration URL
OpenID Client ID: Application (client) ID
OpenID client secret: client secret value
Enabled checkbox checked/enabled
Enable "Do Not Validate OpenID Endpoints (Insecure)"
Depending on your configuration you may need to configure Scheme Override. Set to https if the plugin does not work without it.

After implementing these changes, restart your server and give it a try.

@9p4

9p4 commented Jan 8, 2026

Copy link
Copy Markdown
Owner

Put it in providers.md please

Sign up for free to subscribe to this conversation on GitHub. Already have an account? Sign in.

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

2 participants