OSS Grafana and AzureAD

  • What Grafana version and what operating system are you using?
    Grafana v11.2.2 (dbf571744d)
  • What are you trying to achieve?
    Authenticate using AzureAD
  • How are you trying to achieve it?
    Setting AzureAD basic SAML Configuration and adding required info in Grafana UI.
  • What happened?
    AADSTS50011: The redirect URI ‘’ specified in the request does not match the redirect URIs configured for the application ‘05f94d6d-2598-440d-bd42-c56d7eee6a60’. Make sure the redirect URI sent in the request matches one added to your application in the Azure portal.
  • What did you expect to happen?
    Success login
  • Can you copy/paste the configuration(s) that you are having problems with?
    Identifier (Entity ID)

    Reply URL (Assertion Consumer Service URL)

    /login/azuread
    Sign on URL
    /login
  • Did you receive any errors in the Grafana UI or in related logs? If so, please tell us exactly what they were.
    Pod logs looks normal.
  • Did you follow any online instructions? If so, what is the URL?
    Configure Azure AD OAuth2 authentication | Grafana documentation

I followed the instruction posted in Grafana website but I’m not able to use Azure AD OAuth2. There’s also an additional thing not clear to me. In Azure SSO there’s this field “Identifier (Entity ID)” but I didn’t saw anything related in the documentation so I’m not sure what to input here.

I’m defining the following environment variables in Grafana:
- name: GF_SERVER_DOMAIN
value: <SERVER_DOMAIN>
- name: GF_SERVER_ROOT_URL
value: “https://%(domain)s:%(http_port)s/grafana/”
- name: GF_SERVER_SERVE_FROM_SUB_PATH
value: “true”
- name: GF_SERVER_PROTOCOL
value: “https”
- name: GF_LOG_LEVEL
value: “debug”
- name: GF_AUTH_AZUREAD_ENABLED
value: “true”
- name: GF_AUTH_AZUREAD_ALLOW_SIGN_UP
value: “true”
- name: GF_AUTH_AZUREAD_AUTH_URL
value: <AZUREAD_AUTH_URL>
- name: GF_AUTH_AZUREAD_TOKEN_URL
value: <AZUREAD_TOKEN_URL>
- name: GF_AUTH_AZUREAD_CLIENT_ID
value: <Client_ID>

You followed OAuth doc. OAuth != SAML. OSS version also doesn’t support SAML.