Connect Commercetools to Microsoft Entra ID (Azure Active Directory / Azure AD) to centralize admin and B2B access with SSO, MFA, conditional access, and role-based permissions.
• Single sign-on uses OAuth 2.0 / OpenID Connect between Commercetools and Microsoft Entra ID (Azure AD), with tokens validated per request.
• User identity attributes from Entra ID (email, name, group claims) are mapped to Commercetools project roles and permission sets.
• MFA and conditional access decisions are evaluated by Entra ID during authentication, and Commercetools relies on the resulting token context.
• Just-in-time provisioning can create or update Commercetools users at first login, while deprovisioning follows Entra ID account disablement.
• Group-to-role mapping supports B2B/admin access management, with changes reflected on next sign-in or token refresh.
• Authentication events and failures are logged in Entra ID sign-in logs and correlated with Commercetools audit trails for access reviews.
.png)
We configure Commercetools authentication to trust Entra ID as the identity provider, then map users, groups, and roles for admin and B2B access. SSO runs through Entra ID, so MFA and Conditional Access stay enforced in one place.
Yes, when Commercetools uses Entra ID for sign-in, MFA and Conditional Access are evaluated by Entra ID at login. Policies can differ by user type, group, location, device, or risk.
Yes, we can map Entra ID groups to Commercetools roles so access matches your org structure. This keeps least-privilege access manageable across teams, agencies, and regions.
We align Commercetools access to Entra ID lifecycle rules, so disabling a user in Entra ID blocks sign-in immediately. This reduces manual offboarding steps and audit gaps.
Yes, we can apply the same identity pattern across dev, staging, and production, and across multiple Commercetools projects. Policies and role mappings can be standardized or split per environment as needed.




