Home / OCI

OCIRunbookIntermediate

Transformation: federate OCI identity domains with Microsoft Entra ID (SSO + provisioning)

Replace local OCI users with single sign-on from Microsoft Entra ID. Set up SAML federation, SCIM provisioning of users and groups, map groups to OCI policies, keep a break-glass local admin and retire local passwords.

Deepak Bhardwaj3 min read

Applies toOCI IAM identity domains, Microsoft Entra ID enterprise applications (Oracle Cloud Infrastructure Console app), SAML 2.0, SCIM

Why

Local OCI users mean separate passwords, separate MFA and manual offboarding. With federation, people sign in with their corporate account, Conditional Access applies, and disabling the account in Entra ID removes OCI access.

1. Plan

  • Which identity domain: usually the Default domain for console access.
  • Which Entra groups map to which OCI groups (by job role: oci-network-admins, oci-app-team-x, oci-readonly).
  • A break-glass local administrator in the domain that is not federated.

2. Configure SAML federation

  1. In Entra ID, add the gallery app Oracle Cloud Infrastructure Console as an enterprise application.
  2. In OCI, open the identity domain → Security → Identity providers → add a SAML IdP. Download the domain's SAML metadata and upload it to the Entra app; upload Entra's federation metadata to OCI.
  3. Map the user identity: Entra user.userprincipalname (or email) to the OCI username or primary email.
  4. Create an IdP policy rule that shows the Entra sign-in option (optionally make it the default, keeping local sign-in available for break-glass).

3. SCIM provisioning

So users and groups exist in OCI before first sign-in:

  1. In the identity domain, create a confidential application with the User Administrator role for provisioning, and note the client ID/secret (or use the documented token approach).
  2. In the Entra app → Provisioning → Automatic: tenant URL https://<domain-url>/admin/v1 and the secret token.
  3. Assign the Entra groups to the app; set provisioning scope to assigned users and groups.
  4. Start provisioning and check the provisioning logs in Entra.

4. Map groups to policies

Policies reference the synced groups:

Allow group 'Default'/'oci-network-admins' to manage virtual-network-family in compartment prod-network
Allow group 'Default'/'oci-readonly' to inspect all-resources in tenancy

oci iam group list --compartment-id $TENANCY --query 'data[].name' --output table   # synced groups appear here

5. Test and roll out

  • Pilot with one team: sign-in from the console's Entra option, check MFA and Conditional Access prompts, check access matches the group.
  • CLI users: federated users can't use passwords for the CLI; use oci session authenticate (browser-based) or API keys on a separate service user for automation.
oci session authenticate --region eu-frankfurt-1 --profile-name sso
oci iam region list --auth security_token --profile sso

6. Retire local users

  • Remove passwords and API keys from local accounts of people now federated.
  • Keep only break-glass and service users local; audit them monthly.

Warning

Test the break-glass account sign-in after enabling the IdP policy. If the policy hides local sign-in and Entra is down, you need a way in.

Checklist

  • SAML federation working with correct user mapping
  • SCIM provisioning users and groups
  • Policies reference synced groups only
  • CLI users moved to session tokens
  • Local passwords removed; break-glass tested

Related fixes