This guide describes a feature of the dbt Cloud Enterprise plan. If you’re interested in learning more about an Enterprise plan, contact us at email@example.com.
dbt Cloud Enterprise supports single-sign on via Azure Active Directory (Azure AD). You will need permissions to create and manage a new Azure AD application. Currently supported features include:
- IdP-initiated SSO
- SP-initiated SSO
- Just-in-time provisioning
dbt Cloud supports both single tenant and multi-tenant Azure Active Directory SSO Connections. For most Enterprise purposes, you will want to use the single tenant flow when creating an Azure AD Application.
Creating an application
Log into the Azure portal for your organization. Using the Azure Active Directory page, you will need to select the appropriate directory and then register a new application.
- Under Manage, select App registrations
- Click + New Registration to begin creating a new application
- Supply configurations for the Name and Supported account types fields as shown in the table below.
|Supported account types||Accounts in this organizational directory only (single tenant)|
- Configure the Redirect URI. The table below shows the appropriate
Redirect URI values for single-tenant and multi-tenant deployments. For most
enterprise use-cases, you will want to use the single-tenant Redirect URI. Replace
YOUR_AUTH0_URIwith the appropriate Auth0 URI for your region and plan.
|Application Type||Redirect URI|
- Save the App registration to continue setting up Azure AD SSO
Configuration with the new Azure AD interface (optional)
Depending on your Azure AD settings, your App Registration page might look different than the screenshots shown above. If you are not prompted to configure a Redirect URI on the New Registration page, then follow steps 6 and 7 below after creating your App Registration. If you were able to set up the Redirect URI in the steps above, then skip ahead to step 8.
After registering the new application without specifying a Redirect URI, navigate to the Authentication tab for the new application.
Click + Add platform and enter a Redirect URI for your application. See step 4 above for more information on the correct Redirect URI value for your dbt Cloud application.
Azure <-> dbt Cloud User and Group mapping
The Azure users and groups you will create in the following steps are mapped to groups created in dbt Cloud based on the group name. Reference the docs on enterprise permissions for additional information on how users, groups, and permission sets are configured in dbt Cloud.
Adding Users to an Enterprise Application
Once you've registered the application, the next step is to assign users to it. Add the users you want to be viewable to dbt with the following steps:
- From the Default Directory click Enterprise Applications
- Click the name of the application you created earlier
- Click Assign Users and Groups
- Click Add User/Group
- Assign additional users and groups as-needed
Under Properties check the toggle setting for User assignment required? and confirm it aligns to your requirements. Most customers will want this toggled to Yes so that only users/groups explicitly assigned to dbt Cloud will be able to sign in. If this setting is toggled to No any user will be able to access the application if they have a direct link to the application per Azure AD Documentation
- Under Manage, click API Permissions
- Click +Add a permission and add the permissions shown below
- Save these permissions, then click Grant admin consent to grant admin consent for this directory on behalf of all of your users.
Creating a client secret
- Under Manage, click Certificates & secrets
- Click +New client secret
- Name the client secret "dbt Cloud" (or similar) to identify the secret
- Select 730 days (24 months) as the expiration value for this secret (recommended)
- Click Add to finish creating the client secret value (not the client secret ID)
- Record the generated client secret somewhere safe. Later in the setup process, we'll use this client secret in dbt Cloud to finish configuring the integration.
Collect client credentials
- Navigate to the Overview page for the app registration
- Note the Application (client) ID and Directory (tenant) ID shown in this form and record them along with your client secret. We'll use these keys in the steps below to finish configuring the integration in dbt Cloud.
Configuring dbt Cloud
To complete setup, follow the steps below in the dbt Cloud application.
- Click the gear icon at the top right and select Profile settings. To the left, select Single Sign On under Account Settings.
- Click the Edit button and supply the following SSO details:
|Log in with||Azure AD Single Tenant|
|Client ID||Paste the Application (client) ID recorded in the steps above|
|Client Secret||Paste the Client Secret (remember to use the Secret Value instead of the Secret ID) recorded in the steps above; |
Note: When the client secret expires, an Azure AD admin will have to generate a new one to be pasted into dbt Cloud for uninterrupted application access.
|Tenant ID||Paste the Directory (tenant ID) recorded in the steps above|
|Domain||Enter the domain name for your Azure directory (such as |
|Slug||Enter your desired login slug. Users will be able to log into dbt Cloud by navigating to |
- Click Save to complete setup for the Azure AD SSO integration. From here, you can navigate to the login URL generated for your account's slug to test logging in with Azure AD.
Users can now log into the dbt Cloud by navigating to the following URL, replacing
LOGIN-SLUG with the value used in the previous steps and
YOUR_ACCESS_URL with the appropriate Access URL for your region and plan:
Setting up RBAC
Now you have completed setting up SSO with Azure AD, the next steps will be to set up RBAC groups to complete your access control configuration.
Ensure that the domain name under which user accounts exist in Azure matches the domain you supplied in Supplying credentials when you configured SSO.Obtaining the user domain from Azure