> For the complete documentation index, see [llms.txt](https://docs.collibra.com/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://docs.collibra.com/data-quality-self-hosted/admin-configuration/admin-console/user-management/oauth2-provider-configuration/configuring-azure-ad-b2c-user-authentication.md).
# Configuring Azure AD B2C user authentication
This topic describes how to configure Microsoft Azure Active Directory B2C (Azure AD B2C) as the primary OAuth2 authentication provider for Data Quality & Observability (self-hosted). Once configured, users can log in to Collibra DQ using their Azure AD B2C credentials.
{% hint style="warning" %}
After successful login, users will only gain access to the Collibra DQ application if their Azure AD B2C roles are correctly mapped to DQ roles. This topic covers basic role mapping; advanced role population is covered in [Configuring Azure AD B2C for user authentication via graph API](/data-quality-self-hosted/admin-configuration/admin-console/user-management/oauth2-provider-configuration/configuring-azure-ad-b2c-user-authentication-via-graph-api.md).
{% endhint %}
## Configure the Azure AD B2C portal
The following procedures are performed in the Azure AD B2C portal, in which you will create the application registration that represents your Collibra DQ application. You must have an active Azure subscription with permissions to manage Azure AD B2C tenants, applications, and user flows. For more detailed information, refer to the [Microsoft documentation on registering applications](https://learn.microsoft.com/en-us/azure/active-directory-b2c/register-apps).
If you have not yet created an Azure AD B2C tenant, do so now. For more information, see [Microsoft's tutorial on creating an Azure AD B2C tenant](https://learn.microsoft.com/en-us/azure/active-directory-b2c/tutorial-create-tenant).
### Register the DQ application in Azure AD B2C
Begin by creating the application registration in Azure AD B2C that represents your Collibra DQ application.
{% stepper %}
{% step %}
Navigate to **Azure AD B2C** in your Azure portal.
{% endstep %}
{% step %}
Under **Manage**, click **App registrations**.
{% endstep %}
{% step %}
Click **New registration**.
{% endstep %}
{% step %}
Provide a meaningful name for your application (for example, "DQ Application").
{% endstep %}
{% step %}
Under **Supported account types**, select the appropriate option for your B2C tenant.
{% endstep %}
{% step %}
Do not specify a **Redirect URI** at this stage. The DQ application will provide this value later.
{% endstep %}
{% step %}
Click **Register**.
{% endstep %}
{% step %}
Keep this application's overview page open in a separate tab or window. You will need its Application (client) ID.
{% endstep %}
{% endstepper %}
### Create a client secret for the DQ Application
The client secret is a confidential key used by your Collibra DQ application to authenticate with Azure AD B2C.
{% stepper %}
{% step %}
From the registered application's overview page in the Azure portal, go to **Certificates & secrets** in the left-hand navigation.
{% endstep %}
{% step %}
Click **New client secret**.
{% endstep %}
{% step %}
Provide a description (for example, "DQ App Secret") and set an expiration (for example, 24 months).
{% endstep %}
{% step %}
Click **Add**.
{% endstep %}
{% step %}
The client secret value displays. Copy this value immediately and store it securely. You will need it for the Collibra DQ application configuration. This value will not be visible again once you leave this page.
{% endstep %}
{% endstepper %}
The client secret value is displayed only once. Copy this value immediately and store it securely.
### Create a sign-up and sign-in user flow
This user flow defines the user experience for sign-up and sign-in in your Azure AD B2C tenant.
{% stepper %}
{% step %}
From the main Azure AD B2C screen in the Azure portal, under **Policies**, click **User flows**.
{% endstep %}
{% step %}
Click **New user flow**.
{% endstep %}
{% step %}
Select **Sign up and sign in** and choose the recommended version.
{% endstep %}
{% step %}
Click **Create**.
{% endstep %}
{% step %}
Give your user flow a name (for example, "B2C\_1\_YourOrganizationSignin").
{% endstep %}
{% step %}
Select the Identity providers you want to use (for example, "Email signup").
{% endstep %}
{% step %}
Under **User attributes and token claims**, you can keep the defaults for now. You will add a custom attribute for roles in the next section.
{% endstep %}
{% step %}
Click **Create**. Note the name of this user flow, as you will need it for the Collibra DQ application configuration.
{% endstep %}
{% endstepper %}
### Create a custom attribute for roles
To enable role mapping from Azure AD B2C to Collibra DQ, you need to create a custom user attribute. This attribute stores a comma-separated list of roles for each user in Azure AD B2C. For more information, refer to the [Microsoft documentation on user flow custom attributes](https://learn.microsoft.com/en-us/azure/active-directory-b2c/user-flow-custom-attributes?pivots=b2c-user-flow).
{% stepper %}
{% step %}
From the main Azure AD B2C screen in the Azure portal, under **Manage**, click **User attributes**.
{% endstep %}
{% step %}
Click **Add**.
{% endstep %}
{% step %}
For **Name**, enter a descriptive name (for example, "dqroles").
{% endstep %}
{% step %}
For **Data Type**, select **String**.
{% endstep %}
{% step %}
Enter a **Description** (for example, "Comma-separated list of DQ roles").
{% endstep %}
{% step %}
Click **Create**.
{% endstep %}
{% endstepper %}
{% hint style="info" %}
When this attribute appears in the OAuth2 token, Azure AD B2C automatically prepends `extension_` to its name. So, if you named it dqroles, it will appear as `extension_dqroles` in the token. You will use this version of the name in the DQ configuration.
{% endhint %}
## Configure the DQ Application
Next, configure your Collibra DQ application to integrate with the Azure AD B2C setup.
### Enable the OAuth2 login feature
The OAuth2 login feature must be enabled in the Collibra DQ application in order for the OAuth2 Provider Configuration section to be active and editable.
{% tabs %}
{% tab title="Standalone" %}
Add the following value to the `owl-env.sh` file:
`export OAUTH2_LOGIN_ENABLED=true`
{% endtab %}
{% tab title="Cloud Native" %}
Add the following value to the Web ConfigMap:
`OAUTH2_LOGIN_ENABLED: true`
{% endtab %}
{% endtabs %}
### Configure the Azure AD B2C OAuth2 Provider in DQ
This section details how to add your Azure AD B2C tenant as an authentication provider within the Collibra DQ application's administrative interface.
{% stepper %}
{% step %}
Sign in to Collibra DQ as an administrator and click 
in the left navigation pane.
{% endstep %}
{% step %}
Click **Admin Console**.
{% endstep %}
{% step %}
Click **User Management**, then click **OAuth2 Provider Configuration**.
A setup page displays with fields to add a new OAuth2 Provider.
{% endstep %}
{% step %}
Fill in the following fields:
| Field Name | Description | Details & Where to Find | Example Value |
| ----------------------------------- | ---------------------------------------------------------------------------------------------------------------------------------------------------- | ---------------------------------------------------------------------------------------------------------------------------------------------------------------------- | ---------------------------------------- |
| **Identity Provider** | Specifies the type of OAuth2 provider. | Select **Azure B2C**. | **Azure B2C** |
| **Registration ID** | A unique, arbitrary name for this provider within your Collibra DQ environment. It is used internally by DQ to identify this specific configuration. | Choose a name that is meaningful to you (for example, **my-azureb2c**, **company-b2c**). | **my-azureb2c** |
| **Enabled** | Controls whether the **Azure AD B2C** login button displays on the Collibra DQ login screen. | Set to **False** initially. You can toggle this to **True** after completing all configurations. | **False** |
| **Client ID** | The unique identifier for your Collibra DQ application in Azure AD B2C. | Found in Azure AD B2C on the Overview page of your registered DQ application. | **c3250bf3-bcb3-81c5-9acd-d31998da7b29** |
| **Client Secret** | The confidential key generated for your Collibra DQ application in Azure AD B2C. | Found in Azure AD B2C, copy this value from **Certificates & secrets** in your registered DQ application. This value is only shown once in Azure AD B2C. | **someSuperSecretValue...** |
| **OAuth2 Claim Field Name** | The name of the custom attribute in your Azure AD B2C token that contains the user's roles. | This must be the name of your custom user attribute (for example, **dqroles**) prefixed with `extension_`. So, if you named it **dqroles**, enter `extension_dqroles`. | **extension\_dqroles** |
| **Azure B2C Tenant ID** | Your Azure AD B2C tenant name. | Often found in the **Application ID URI** of your Azure AD B2C app registration (for example, `` ). | **yourorganization** |
| **Azure B2C Signup/Signin Policy** | The name of the Sign-up and Sign-in user flow you created in Azure AD B2C that defines the user authentication experience. | The Name of the user flow you created in Azure AD B2C. | **B2C\_1\_YourOrganizationSignin** |
| **Azure B2C Profile Edit Policy** | Reserved for future use. | Leave blank or default. | |
| **Azure B2C Password Reset Policy** | Reserved for future use. | Leave blank or default. | |
| {% endstep %} | | | |
{% step %}
Click **Save**. After saving, your newly configured provider will appear in a list. Note the **Redirect URI** displayed for your provider. This URI will typically be in the format ``.
{% endstep %}
{% step %}
Copy the **Redirect URI**.
{% endstep %}
{% endstepper %}
### Update the Azure AD B2C Application Redirect URI
This is a critical step for successful authentication redirection. The Redirect URI tells Azure AD B2C where to send the user after they've successfully logged in.
{% stepper %}
{% step %}
Go back to your Azure portal and navigate to the App registration for your Collibra DQ application.
{% endstep %}
{% step %}
Under **Manage**, click **Authentication** in the left-hand navigation.
{% endstep %}
{% step %}
Under **Platform configurations**, click **Add a platform** and select **Web**.
{% endstep %}
{% step %}
In the **Redirect URIs** field, paste the Redirect URI you copied from the Collibra DQ application.
{% endstep %}
{% step %}
Click **Configure**.
{% endstep %}
{% endstepper %}
{% hint style="info" %}
It can take up to 30 minutes for Azure to propagate this change.
{% endhint %}
## Restart the DQ Application
You must restart the Collibra DQ application when a new OAuth2 provider is added to ensure it is properly registered. If you are only modifying an existing provider (e.g., enabling/disabling), a restart is generally not necessary.
## Test basic login functionality
{% hint style="warning" %}
At this point in the configuration, the user does not yet have any roles assigned or mapped that grant them access. As a result, you may see an "Access Denied" message despite a successful authentication. This is expected behavior. In the following section, you will map roles to the user.
{% endhint %}
{% stepper %}
{% step %}
Open the Data Quality & Observability (self-hosted) login page.
You should now see a new button, typically labeled **Azure B2C Login** or similar, below the standard login fields. If the button is not present, ensure that the `OAUTH2_LOGIN_ENABLED` property is set to true.
{% endstep %}
{% step %}
Click the **Azure B2C Login** button.
* If the configuration is correct, you will be redirected to the Microsoft Azure AD B2C sign-in window.
* If nothing happens or you encounter an immediate error, check your Collibra DQ application logs and browser developer console network logs. The most common issue at this stage is an incorrect or unpropagated Redirect URI in Azure AD B2C.
{% endstep %}
{% step %}
From the Microsoft login window, sign in with an existing Azure AD B2C user account or create a new one through the configured user flow.
* Upon successful authentication in Azure AD B2C, you should be redirected to the Collibra DQ application. If you cannot successfully authenticate into Azure B2C, you may need to grant this user permission in your Azure AD B2C application.
* Even after logging in through Microsoft, you will likely see a message from Collibra DQ indicating "Access Denied" or similar. This is expected behavior at this point. It confirms that authentication through Azure AD B2C was successful, but the user does not yet have any roles assigned or mapped that grant them access to the Collibra DQ application's features.
{% endstep %}
{% step %}
To grant users access, you must populate user roles in Azure AD B2C and complete the role mapping in Collibra DQ.
{% endstep %}
{% endstepper %}
## Basic role mapping in DQ
Without role mapping, even successfully authenticated users will be denied any access to the Collibra DQ application. This basic setup allows you to map one or two roles to quickly test user access. For advanced role management, refer to [Configuring Azure AD B2C for user authentication via graph API](/data-quality-self-hosted/admin-configuration/admin-console/user-management/oauth2-provider-configuration/configuring-azure-ad-b2c-user-authentication-via-graph-api.md).
{% stepper %}
{% step %}
Sign in to Collibra DQ as an administrator (using a non-B2C login, if still available, or an account with existing roles).
{% endstep %}
{% step %}
Click in the left navigation pane.
{% endstep %}
{% step %}
Click **Admin Console**.
{% endstep %}
{% step %}
Click **User Management**, then click **OAuth2 Provider Configuration**.
{% endstep %}
{% step %}
For your Azure B2C provider, click to edit the role mappings.
The **Edit Mapping for \[Provider Name]** page displays.
{% endstep %}
{% step %}
Map the B2C roles to the Collibra DQ application roles:
* For each role you want to map, find it in the **Not Included** section. If it’s not there, you must add your expected B2C roles:
* In the text box with the placeholder **Enter a name or names (comma delimited)**, type the exact name(s) of the roles you expect to assign to users in Azure AD B2C (for example, **dq-user**, **dq-admin**).
* Click the 
next to the textbox. These will appear in the **Not Included** section.
* Click the 
next to the **Application Role (Destination)** field for that specific row.
* From the list of available DQ Application Roles, select the desired internal DQ role (for example, **ROLE\_ADMIN**, **ROLE\_CONNECTION\_MANAGER**).
* Click **Submit** to save the mapping for that specific role.
* Repeat this process for all Azure AD B2C roles you intend to use.
{% endstep %}
{% endstepper %}
## What's next
[Configuring Azure AD B2C for user authentication via graph API](/data-quality-self-hosted/admin-configuration/admin-console/user-management/oauth2-provider-configuration/configuring-azure-ad-b2c-user-authentication-via-graph-api.md)