How to Set Up Microsoft Entra ID (Azure AD) SSO for Apache Superset

 

Apache Superset SSO with Microsoft Entra ID

If your organisation uses Microsoft 365, Microsoft Entra ID (formerly Azure Active Directory) already manages employee identities and access. Integrating Superset with Entra ID lets you centralise authentication instead of maintaining separate passwords. Flask-AppBuilder provides a built-in Azure OAuth handler, making configuration possible without custom code.

This guide complements our Okta SSO guide, focusing on Entra-specific app registration, role mapping, and common authentication errors. General authentication mechanics, reverse-proxy settings, and break-glass procedures remain unchanged.

The configuration covers Apache Superset 2.1 through 4.x, with examples based on version 4.x.

Groups or app roles?

Entra can put either the user’s group memberships or their app roles into the token. Flask-AppBuilder’s Azure handler reads the roles claim, which is app roles, and uses it as the list of keys to match against AUTH_ROLES_MAPPING.

App roles are also the better design for Superset:

• No overage problem. Entra stops emitting the groups claim when a user is in more than a couple of hundred groups and replaces it with an overage indicator. Large organisations hit this routinely. App roles are specific to your application and never overflow.

• Assignment lives on the application. You assign a group or a user to an app role in the Superset enterprise application. The Entra admin sees exactly who can reach Superset and as what, without decoding group names.

• Role names are yours. Superset.Admin, Superset.Analyst, Superset. Viewer are clearer than a security group created five years ago for something else.

So this guide uses app roles. If you must use groups, the section near the end explains what to change.

Curious How It Works? →