Improve DVLS server Microsoft authentication

Resolved

Improve DVLS server Microsoft authentication

avatar
Marcel Gerber

Hello.

I have a suggestion to improve the MS authentication configuration documentation.

Configure Microsoft authentication with Entra ID - Devolutions Documentation

First, I would avoid jumping around between Entra ID and DVLS Server Administration.

I would show how to completely configure the application registration and then copy / paste most values from its overview.

This is obviously different for the secret for the secret configuration.

Secondly, I would show a complete example of how to configure an app registration with application permissions and one for delegated rights permissions. This because it's always tricky to follow a guide which has exceptions and small additions to avoid missing an important setting.

Thirdly, I would advise to show all app permissions required for both application permissions and delegated rights permissions:

  1. Configure DVLS with application permissions

    1. delegated rights for :

      1. openid

      2. profile

      3. offline_access

    2. application permissions for :

      1. user.read

      2. user.read.all

      3. group.read.all

  2. Configure DVLS with delegated rights permissions

    1. openid

    2. profile

    3. offline_access

    4. user.read

    5. user.read.all

    6. group.read.all

Last, please add additional required settings like the token "ID tokens (used for implicit and hybrid flows)" required for the application permission authentication mode.

Thank you.

Marcel

Devolutions Server, RDM and GW admin.

avatar
Patrick Ouimet

Recommended Answer

Hello Marcel,

Thank you for the 2026.2.7.0 redirect URI list, that detail closes the gap we left in the article.

I have confirmed the three URIs you provided are the correct ones for Delegated permissions.

While we are at it, I want to clarify one point so that future readers do not over-configure their Entra app.

The three URIs are required only when you choose Delegated permissions, because the Connect to Microsoft button runs its own OAuth flow on top of the regular user sign-in.

The Application permissions mode (the recommended default) uses the client credentials grant and never hits the connect or connect-callback endpoints, so a single redirect URI (the external-provider-response one) is enough in that case.

The revised KB will split step 7 into the two cases, so this is no longer ambiguous.

On a related note, we are looking into surfacing the exact redirect URIs directly in the DVLS administration UI with copy buttons.

That way, readers will not have to discover them through a doc, and the displayed values will always match the running build.

Thanks again for the thorough testing and the screenshots. This kind of feedback is exactly what makes the documentation better for everyone configuring Microsoft authentication with DVLS.

Best regards,

Patrick Ouimet

1

All Comments (10)

avatar
Emile Simard
Disabled

Hello Marcel,

Thank you for your feedback. This is a great suggestion and we will look into it to see if we can make the page easier to follow.

Regards,

Émile Simard

Technical writer

avatar
Emile Simard
Disabled

Hello again Marcel,

We've updated our documentation based on your suggestion.

Regards,

Émile Simard

Technical writer

avatar
Marcel Gerber

Hello @Emile Simard

Thank you for the update, which looks promising.

A few notes from my side.

Step 8 here is not very clear to me:

Is it to be repeated ? If so, in which case ? If not maybe it needs cleanup.

I think for Delegated rights, we need two different redirect URI's but I might be wrong.

This is not quite correct. If you do not add it here, the first user logging in will be required to do the Admin Consent.

I would rather add those manually, admin consent them and be done with it.

Instead of repeating 3 times "For Delegated permissions" I would add sub-steps for these 3 items and name the main step something like "For delegated permissions only do the following".

Thank you and best regards.

Marcel

Devolutions Server, RDM and GW admin.

avatar
Emile Simard
Disabled

Hi Marcel,

I have made the changes you requested. There was indeed a redundancy in step #8, as there is no need to input the redirect URI again, only the "ID tokens (used for implicit and hybrid flows)" checkbox is required for the application permissions configuration. I moved this instruction to step #7 instead, as it makes more sense.

For the "openid", "profile", and "offline_access" permissions, although they do not require admin consent by default, I have modified the box below step #15 for your use case. Thanks for bringing this to our attention, it may help others.

Regards,

Émile Simard

Technical writer

1
avatar
Marcel Gerber

Thanks @Emile Simard !

Let's see once we manage a successful delegated rights version if we need to URI's or not.

PS: For now, I can connect it, but not login to DVLS with it.

Marcel

Devolutions Server, RDM and GW admin.