Connectors

Microsoft / Entra ID Connector

The Microsoft connector integrates Kiwire with Azure Active Directory (Microsoft Entra ID) via OAuth 2.0 / OIDC. Employees and guests can sign in to the captive portal or enterprise WiFi using their existing Microsoft 365 or Azure AD account — no separate Kiwire password required.

'alt' => 'Dashboard overview', 'caption' => 'The default Kiwire dashboard layout', 'screenshot' => true, 'class' => '', ]) Drop images into: public/assets/img/docs/{page}/{filename} --}}

Image not uploaded yet public/assets/img/docs/connector-microsoft/overview.png

The Microsoft connector — enter your Azure tenant ID, client ID, and client secret.

Use Cases

Corporate WiFi (Enterprise) — Employees log in to the enterprise WiFi using their Microsoft 365 credentials. No VPN or separate account needed.
Guest Captive Portal — Visitors with a Microsoft or personal Outlook account can authenticate on the guest portal using the "Sign in with Microsoft" button.
Workforce Identity — Combine with group filtering to restrict access to specific departments or Azure AD security groups.

Azure App Registration Setup

Before configuring the connector in Kiwire, you must register an application in the Azure Portal. Follow these steps:

Register a new application

In the Azure Portal, go to Microsoft Entra ID → App registrations → New registration. Give the app a meaningful name (e.g. "Kiwire WiFi Portal") and select the appropriate supported account types for your use case.

Add the redirect URI

Under Authentication → Add a platform → Web, add the Redirect URI shown in Kiwire's connector settings page. It follows the format: https://your-kiwire-domain.com/admin/oauth/microsoft/callback

Create a client secret

Go to Certificates & secrets → New client secret. Choose an expiry period and copy the secret value immediately — Azure only shows it once.

Copy IDs to Kiwire

From the app's Overview page, copy the Directory (tenant) ID and Application (client) ID into the Kiwire connector form.

Client secrets expire. Set a calendar reminder to rotate the secret before it expires — an expired secret will immediately block all Microsoft logins. Kiwire will display an error in the connector status panel when the secret is approaching expiry.

'alt' => 'Dashboard overview', 'caption' => 'The default Kiwire dashboard layout', 'screenshot' => true, 'class' => '', ]) Drop images into: public/assets/img/docs/{page}/{filename} --}}

Image not uploaded yet public/assets/img/docs/connector-microsoft/azure-app-registration.png

Azure Portal — App registration showing the Directory (tenant) ID and Application (client) ID to copy into Kiwire.

Configuration Fields

Field	Description
`tenant_id`	Your Azure AD Directory (tenant) ID — found on the app registration Overview page
`client_id`	Application (client) ID of the registered Azure app
`client_secret`	Client secret value created in Certificates & secrets
`redirect_uri`	OAuth callback URL — shown in Kiwire; must exactly match what is registered in Azure
`scopes`	OpenID Connect scopes requested from Azure: `openid profile email` (default — do not change unless advised)

How Authentication Works

When a user clicks Sign in with Microsoft on the captive portal:

Kiwire generates an OAuth 2.0 authorization request and redirects the user to Microsoft's login page.
The user authenticates with Microsoft (password, MFA if configured in Azure, etc.).
Microsoft redirects back to Kiwire's callback URL with an authorization code.
Kiwire exchanges the authorization code for an access token and ID token via the Microsoft token endpoint.
Kiwire calls the Microsoft Graph API (/me) to retrieve the user's profile: display name, email, and UPN.
Kiwire creates or updates a local WiFi account and grants network access.

Auto-Registration

On a user's first login, Kiwire automatically creates a WiFi account using the user's Microsoft email address as the username. The account is assigned the profile configured on the connector instance. Subsequent logins reuse the existing account.

Auto-created accounts are linked to the Microsoft identity by their email. If a user changes their Microsoft email address, a new Kiwire account will be created on next login — the old account is not merged automatically.

Group Filtering

Optionally restrict WiFi access to members of specific Azure AD security groups. Enable group filtering in the connector advanced settings and enter the Azure AD group Object IDs (one per line). Kiwire will call the Graph API to check group membership after authentication; users not in any listed group will be denied access with a clear error message on the portal.

To find a group's Object ID, go to Microsoft Entra ID → Groups in the Azure Portal, click the group, and copy the Object ID from the Overview page.

Required Permissions

view-connector-microsoft · edit-connector-microsoft