Machine-to-machine authentication error Azure Entra ID

[marcelo-modolo]

Preflight Checklist

• I agree to follow the Code of Conduct that this project adheres to.
• I have searched the issue tracker for an issue that matches the one I want to file, without success.
• I am not looking for support or already pursued the available support channels without success.

Version

2.39.1

Storage Type

Postgres

Installation Type

Official Helm chart

Expected Behavior

Hi!
We read and followed the documentation for machine-to-machine authentication, but using Azure (Entra ID).
Below is the created configuration

- name: azure-entra-id
  type: oidc
  id: azure-entra-id
  config:
    issuer: https://sts.windows.net/{tenant_id}/
    issuerAlias: https://login.microsoftonline.com/{tenant_id}/
    scopes:
      - openid
      - profile
    userNameKey: sub
    getUserInfo: true

The connector is configured successfully!
{"level":"info","msg":"config connector: azure-entra-id","time":"2025-02-25T14:02:58Z"}

Actual Behavior

Although the token generated in Azure is valid, we receive the following error when trying to authenticate
{"level":"error","msg":"failed to verify subject token: oidc: error loading userinfo: 400 Bad Request: ","time":"2025-02-21T22:56:31Z"}

{"level":"info","msg":"Dex Version: v2.39.1, Go Version: go1.22.2, Go OS/ARCH: linux amd64","time":"2025-02-25T14:02:58Z"}

Steps To Reproduce

No response

Additional Information

No response

Configuration

Logs