Microsoft OAuth

​

What you’ll need

• An Azure account and a tenant (or create a tenant).
• Your ngrok authtoken and an endpoint with the OAuth action in its Traffic Policy.

​

Register an application

• Supported account types: ngrok does not support single-tenant applications. Choose a multi-tenant option: either Accounts in any organizational directory or Accounts in any organizational directory and personal Microsoft accounts (for example, Skype, Xbox).
• Redirect URI: choose the Web platform and enter https://idp.ngrok.com/oauth2/callback.

​

Configure your application

• API permissions: ensure User.Read (or a more permissive scope such as User.Read.All) is granted. Add any additional scopes your application requires and note them for later.
  • Scopes that require application review by Microsoft are unsupported.
  • Scopes that require admin consent prevent tenants’ users from authorizing until consent is granted.
• Client secret: create a new client secret and copy its Value immediately, since it is shown only once.

​

Update your ngrok endpoint Traffic Policy

1. Access the ngrok Dashboard Endpoints page and locate an existing endpoint you’d like to add this to or create a new one.
2. In your traffic policy, add the following configuration:

on_http_request:
  - actions:
      - type: oauth
        config:
          provider: microsoft
          client_id: '{your app''s oauth client id}'
          client_secret: '{your app''s oauth client secret}'
          scopes:
            - openid
            - email
            - profile

{
  "on_http_request": [
    {
      "actions": [
        {
          "type": "oauth",
          "config": {
            "provider": "microsoft",
            "client_id": "{your app's oauth client id}",
            "client_secret": "{your app's oauth client secret}",
            "scopes": [
              "openid",
              "email",
              "profile"
            ]
          }
        }
      ]
    }
  ]
}

​

Configure access control

on_http_request:
  - expressions:
      - '!(actions.ngrok.oauth.identity.email in [''me@example.com''])'
    actions:
      - type: deny

{
  "on_http_request": [
    {
      "expressions": [
        "!(actions.ngrok.oauth.identity.email in ['me@example.com'])"
      ],
      "actions": [
        {
          "type": "deny"
        }
      ]
    }
  ]
}

​

Further resources

• Creating a Microsoft Entra ID tenant
• Permissions and consent (restricted permissions)
• Microsoft Graph User resource type (id, displayName, mail, userPrincipalName)