Help Center/ Workspace/ Best Practices/ Enabling OAuth 2.0 SSO for Workspace
Updated on 2026-05-18 GMT+08:00
View PDF
Share

Enabling OAuth 2.0 SSO for Workspace

Scenarios

Workspace uses OAuth 2.0 to enable SSO, delivering a secure and seamless unified authentication experience for users. With the standard authorization process, users can access all associated applications connected to Workspace with one login. There is no need to keep re-entering credentials. This mechanism uses tokens for identity authentication and resource authorization, securing accounts and significantly improving cross-system access efficiency and smoothness. Enterprises can flexibly control users' access to applications and data through centralized permissions management. This enhances security control and simplifies multi-system maintenance.

Step 1: Obtaining Configuration Information

  1. Log in to the Azure portal as a Microsoft Entra ID administrator.
  2. Click Microsoft Entra ID.

Obtaining the Azure Tenant ID

  1. Click Overview to obtain the tenant ID.

Obtaining the App ID

  1. Click the number on the right of Applications.

  2. Obtain the application ID (client ID).

Obtaining the App Secret

  1. Click the name of the application created under Owned applications.

  2. Click Certificate and secrets and click in the right pane. In the displayed dialog box, add the secret as prompted.

Obtaining the Access Address

  1. Log in to the management console.
  2. In the navigation pane, choose Tenant Configuration > Basic Settings to obtain the access address.

Step 2: Setting the Redirection URL

  1. Choose Manage > App registrations > Owned applications, and click the name of the application.

  2. Click Authentication (Preview), click on the right, and add the address obtained in 9.

  3. Click Save.

Step 3: Setting Permissions for an Application

  1. Log in to the Azure platform as an administrator.
  2. Choose Manage > App registrations > Owned applications, and click the name of the application.

  3. Click the Settings tab, and select ID tokens.

  4. Click API permissions in the navigation pane, click on the right to add permissions, and click Microsoft Graph.
  5. Under OpenId permissions, select offline_access and openid, and click Add a permission.

  6. Under Mail, select Mail.Read, and click Add a permission.

  7. Under User, select User.Read, and click Add a permission.

  8. Click Grant admin consent. In the displayed confirmation dialog box, click Yes.

Step 4: Creating a User on Azure

  1. On the All users page, click on the right to add a user.

    The user created on the Azure platform must be the same as the Workspace user. Otherwise, the verification fails.

Step 5: Configuring OAuth 2.0 on the Workspace Console

  1. Log in to the management console.
  2. In the navigation pane, choose Tenant Configuration > Authentication Configuration. The Authentication Configuration page is displayed.
  3. Click Modify. Under Primary Authentication Type, click Third-party SSO Authentication.

    • Protocol type: Select OAuth 2.0.
    • View type: Select Visual.
    • Third-party authentication source: Select AZURE.
    • App ID: Select the application ID (client ID) displayed in 5.
    • Verification field separator configuration:

      1. The system scans from back to front for the first occurrence of a separator and splits at that position, returning the preceding portion.

      2. The default separator is @.

      3. Separators can only contain letters, digits, or one of the following special characters: .-_$#@>.

      Example: test#EXT#&te@teleperformance.com. In this example, the separators are @ and #EXT#. After splitting, "test" is used.

    • App Secret: Select the key created in 7.
    • Azure tenant ID: Select the tenant ID obtained in 3.
    • Authentication success check: Retain the default value userPrincipalName.

  4. Click Save.

Step 6: Logging In to the Desktop

  1. Open the Huawei Cloud client, enter the server address and enterprise ID, and click Connect to the server.
  2. Click OAuth2 for login. You are directed to the Microsoft Entra ID authentication platform.
  3. Enter the username and password. You are directed to the desktop list.
  4. Click the desktop you want to log in to.