# Azure AD interactive login via UI

**URL:** <https://discuss.hashicorp.com/t/azure-ad-interactive-login-via-ui/11052>\
**Category:** Vault\
**Created:** [July 6, 2020, 6:36am UTC](https://discuss.hashicorp.com/t/azure-ad-interactive-login-via-ui/11052 "2020-07-06T06:36:00Z")\
**Posts on this page:** 4\
**Page:** 1

<div class="post-metadata">

**Author:** ![eric](https://sea2.discourse-cdn.com/hashicorp/user_avatar/discuss.hashicorp.com/eric/32/9029_2.png) [@eric](https://discuss.hashicorp.com/u/eric)\
**Post date:** [July 6, 2020, 6:36am UTC](https://discuss.hashicorp.com/t/azure-ad-interactive-login-via-ui/11052/1 "2020-07-06T06:36:00Z")

</div>

Hi!

I wonder if it’s possible to integrate Vault UI with Azure Active Directory to allow my users to take advantage of its 2FA solution, conditional access and more. Anybody has pointers on that?

Every tutorial or presentation found so far only talks about CLI, and I’d like to offer an UI experience to my users.  
Thanks

---

<div class="post-metadata">

**Author:** ![rooftop90](https://sea2.discourse-cdn.com/hashicorp/user_avatar/discuss.hashicorp.com/rooftop90/32/6247_2.png) [@rooftop90](https://discuss.hashicorp.com/u/rooftop90)\
**Post date:** [July 7, 2020, 9:49am UTC](https://discuss.hashicorp.com/t/azure-ad-interactive-login-via-ui/11052/2 "2020-07-07T09:49:55Z")

</div>

Hello eric,

yes this is possible. You need to specify the correct allowed redirect URL to your ui following this scheme:

[https://hostname.domain:8200/ui/vault/auth/oidc/oidc/callback](https://hostname.domain:8200/ui/vault/auth/oidc/oidc/callback)

This scheme assumes you have mounted the jwt/oidc auth method at /auth/oidc.

You need to configure this in your Azure AD App Registration and those values have to match exactly for your role configuration.

Hope this helps

Best regards!

---

<div class="post-metadata">

**Author:** ![eric](https://sea2.discourse-cdn.com/hashicorp/user_avatar/discuss.hashicorp.com/eric/32/9029_2.png) [@eric](https://discuss.hashicorp.com/u/eric)\
**Post date:** [July 8, 2020, 7:06am UTC](https://discuss.hashicorp.com/t/azure-ad-interactive-login-via-ui/11052/3 "2020-07-08T07:06:11Z")

</div>

Thank you @rooftop90  
OIDC! That looks super promising. I will have a look at it and reply back the results if someone else needs it.

Thank you!

---

<div class="post-metadata">

**Author:** ![eric](https://sea2.discourse-cdn.com/hashicorp/user_avatar/discuss.hashicorp.com/eric/32/9029_2.png) [@eric](https://discuss.hashicorp.com/u/eric)\
**Post date:** [July 9, 2020, 12:11am UTC](https://discuss.hashicorp.com/t/azure-ad-interactive-login-via-ui/11052/4 "2020-07-09T00:11:07Z")

</div>

I’ve successfully configured Azure AD with Vault using this [documentation](https://www.vaultproject.io/docs/auth/jwt_oidc_providers#azure-active-directory-aad) as base. Instead of using groups in AAD, I’ve created roles and mapped them to the group-alias in Vault to distribute local policies to these AAD roles.

This blog post helped a lot (I didn’t use Terraform though):

> **[Azure AD OIDC auth in HashiCorp Vault using Terraform](https://stronglybranched.io/2020/06/azure-ad-oidc-auth-in-hashicorp-vault-using-terraform/)**
>
> Configuring Azure AD with Azure AD App Roles as an OIDC authentication backend in HashiCorp Vault using Terraform