Knowledge Base

Microsoft Entra ID (Azure AD) Authentication Flow Guide: Ray Captive Portal

Last updated: Jul 29, 2026
This document explains the Microsoft Entra ID configuration and authentication flow required to allow users to sign in to the Ray Captive...

This document explains the Microsoft Entra ID configuration and authentication flow required to allow users to sign in to the Ray Captive Portal using their organization’s Microsoft accounts.

 

Simple objective

The customer creates and controls the Microsoft Entra ID application. The customer then securely shares the required application identifiers and secret with Ray. Ray configures the captive portal and validates the end-to-end login flow.

1. Sign in and open Microsoft Entra ID

Sign in to the Azure portal using an authorized administrator account. Search for Microsoft Entra ID (the current name for Azure Active Directory) and open the service.

  • Portal URL: https://portal.azure.com
  • Required role: an account permitted to manage app registrations
  • Expected result: the Microsoft Entra ID tenant overview is available

 

 

2. Verify the customer tenant and copy the Tenant ID

Open the correct organization tenant. Verify the tenant name and primary domain, then copy the Directory (Tenant) ID.

  • Confirm that users who require captive portal access exist in this tenant
  • Do not use an unrelated test tenant for production integration
  • Record the Tenant ID in the customer handover table

 

 

3. Register the RayPortal application

Navigate to App registrations and create a new registration. Use a clear application name such as RayPortal. For a customer-only corporate login, Single tenant is normally appropriate unless the solution scope explicitly requires multiple organizations.

  • Application name: RayPortal
  • Account type: confirm with Ray and customer security team
  • Platform: Web
  • Redirect URI: enter the exact HTTPS callback supplied by Ray

After registration, copy the Application (Client) ID

 

 

 

4. Create the client secret

Open the registered application, select Certificates & secrets, and create a new client secret. Copy the Secret Value immediately.

  • Share the Secret Value – not the Secret ID
  • The Secret Value is displayed only once
  • Record the secret expiry date and plan rotation before expiry
  • Treat the value as a confidential credential

 

End-to-End Authentication Flow

The following flow shows how Microsoft authentication is linked to the Ray captive portal session. The user credentials are entered only on the Microsoft sign-in page; RayPortal receives the resulting authorization response and validates the returned identity.

 

 

What are your feelings

🙂😐🙁