> For the complete documentation index, see [llms.txt](https://docs.collibra.com/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://docs.collibra.com/data-quality-self-hosted/admin-configuration/admin-console/user-management/oauth2-provider-configuration/configuring-microsoft-graph-api-user-authentication.md).

# Configuring Microsoft Graph API user authentication

This topic describes how to configure Microsoft Graph API as the primary OAuth2 authentication provider for Data Quality & Observability (self-hosted). Once configured, users can log in to Collibra DQ using their Microsoft Graph API credentials.

## Prerequisites

In the Azure Portal, you have:

* Registered an application.
* Noted the **Application (client) ID** and **Directory (tenant) ID**.
* Noted the **Client Secret** value.

## Steps

{% stepper %}
{% step %}
In Data Quality & Observability (self-hosted), set the environment variable OAUTH2\_LOGIN\_ENABLED to **TRUE**.

<i class="fa-chevrons-right">:chevrons-right:</i> The OAuth 2.0 functionality activates.
{% endstep %}

{% step %}
Click <img src="https://4121921244-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FWCrP7Albs8DfJjIQxUxw%2Fuploads%2Fgit-blob-268a786d787f353b92e094a60945df32bf9cb208%2FCogwheelIcon.svg?alt=media" alt="Cogwheel icon" data-size="line"> in the left navigation pane.
{% endstep %}

{% step %}
Click **Admin Console > User Management > OAuth2 Provider Configuration**.

<i class="fa-chevrons-right">:chevrons-right:</i> The OAuth2 Provider Setup page opens.
{% endstep %}

{% step %}
Fill in the following fields:

| Field Name            | Description                                                                                                                                          | Details & Where to Find                                                                                                                                             |
| --------------------- | ---------------------------------------------------------------------------------------------------------------------------------------------------- | ------------------------------------------------------------------------------------------------------------------------------------------------------------------- |
| **Identity Provider** | Specifies the type of OAuth2 provider.                                                                                                               | Select **Microsoft Graph API**.                                                                                                                                     |
| **Registration ID**   | A unique, arbitrary name for this provider within your Collibra DQ environment. It is used internally by DQ to identify this specific configuration. | Choose a name that is meaningful to you (for example, **my-ms-graph**, **company-ms-graph**).                                                                       |
| **Enabled**           | Controls whether the **Microsoft Graph API** login button displays on the Collibra DQ login screen.                                                  | Set to **False** initially. You can toggle this to **True** after completing all configurations.                                                                    |
| **Client ID**         | The unique identifier for your Collibra DQ application in Microsoft Graph API.                                                                       | The Application (client) ID from Azure for your registered DQ application.                                                                                          |
| **Client Secret**     | The confidential key generated for your Collibra DQ application in Azure.                                                                            | Found in Azure, copy this value from **Certificates & secrets** in your registered DQ application. This value is only shown once in Azure.                          |
| **Redirect URI**      | The URI that matches your Azure application configuration.                                                                                           | The redirect URI(s) configured in your OAuth2 provider's application settings.                                                                                      |
| **Tenant ID**         | The Directory (tenant) ID from Azure.                                                                                                                | Enter the first part of your domain name or resource name. For example, if your domain name is "yourmsgraphtenant.onmicrosoft.com", then enter "yourmsgraphtenant". |
| {% endstep %}         |                                                                                                                                                      |                                                                                                                                                                     |

{% step %}
Click **Save**.
{% endstep %}
{% endstepper %}