---
title: Configure Activate Anywhere to use Azure AD to Authenticate External Users
slug: configure-activate-anywhere-to-use-azure-ad-to-authenticate-external-users
createdAt: 2025-06-11T20:26:17.824Z
---

## Introduction

Your customer may be wanting to access Activate from internet connected devices. Activate would recommend you deploy the Activate Anywhere web site onto a DMZ server which allows remote users to access Activate securely without needing to publish the internal Activate Web Portal. This provides a layer of protection and isolation from the Internet to your Activate Server using a secure reverse proxy.

By default, Activate uses a secure cookie based authentication scheme. However, some customers may wish to use Azure AD to authenticate users instead. This guide will step you through the process to configure Activate and the associated Azure AD Tenant to facilitate this requirement. 

## Assumptions

1. Activate Anywhere website configured and running - please refer to the Anywhere Web Site Installation Guide.
2. The steps below are performed with an Azure AD Global Administrator account
3. The Activate Anywhere server has web access to the Azure AD tenant
4. The environment has an Azure AD tenant which is populated with the users who wish to authenticate 

## Guide

## Register the Azure Application for Activate 

1. Create a new Application Registration in Azure for the tenant you are wanting Activate to use for authentication



![](https://api.archbee.com/api/optimize/Lfto9rn2ELed8aLNOgwlJ/ziA-qHSBm9JjDN7pFyQxI_image.png)

2. Fill in Name and Redirect URI, eg: “https\://\<serverfqdn>/signin-oidc-anywhere”, in this case https\://activate/signin-oidc-anywhere



![](https://api.archbee.com/api/optimize/Lfto9rn2ELed8aLNOgwlJ/1GbWukZp7boC62Brtko1K_image.png)

3. Click Register
4. Open the application from the App Registrations tile, click Authentication under the Manage heading, tick the Implicit Grant 'ID Tokens' tickbox. Click save



![](https://api.archbee.com/api/optimize/Lfto9rn2ELed8aLNOgwlJ/XpmKiAZV1MfMaQxPZLkTa_image.png)

5. Copy the application (client) ID you will need this for activate RemoteAccess parameter

:::hint{type="info"}
You can check the tenant name in the Entra ID Tile and overview
:::





## Anywhere Server IIS Configuration



1. Make sure you have IIS/Certificates all setup, bound and listening on for the Activate Anywhere site. This guide assumes you have already setup Activate Anywhere with Activate Cookie based authentication over HTTPS/SSL and you have this published externally, internally or both<u>.</u>
2. Check the IIS bindings for Activate Anywhere:



![](https://api.archbee.com/api/optimize/Lfto9rn2ELed8aLNOgwlJ/bxfUq-EyNd7l4XxRSbr-r_image.png)



1. Here’s an example of a lab setup, binding is for SSL and has a valid cert for this site.&#x20;

![](https://api.archbee.com/api/optimize/Lfto9rn2ELed8aLNOgwlJ/6FXISGcmtSTuDD4uQM88Z_image.png)

2. In Activate Studio - open Resources/Configuration/External Web/RemoteAccess XML parameter.&#x20;

![](https://activate.activatelive.com/images/activate/JzZw6bM6y6IvDKrPD6KBHx90wDD)

3. Add the authentication node as per below xml example to the RemoteAccess xml parameter. In this example we have pointed it at a set of parameters on the Azure resource - Activate Azure AAD Integration Guide. Alternatively, they can be the explicitly the values of the application/tenant as configured above.

```xml
<remoteAccess>
 <requireTerms>true</requireTerms>
 <tokenSettings>
 <allowKeepMeSignedIn>true</allowKeepMeSignedIn>
 <tokenLifetimeDays>90</tokenLifetimeDays>
 <sessionTimeoutMinutes>60</sessionTimeoutMinutes>
 <autoRenew>true</autoRenew>
 <requireSSL>true</requireSSL>
 </tokenSettings>
 <images>
 <anonymous>true</anonymous>
 </images>
 <api>
 <policy>
 <enable>false</enable>
 <match>
 <url>Custom/*</url>
 <ipAddress>*</ipAddress>
 </match>
 </policy>
 </api>
 <rateLimiter>
 <enable>true</enable>
 <permitLimit>100</permitLimit>
 <window>1</window>
 <queueLimit>25</queueLimit>
 <segmentsPerWindow>4</segmentsPerWindow>
 </rateLimiter>
 <authentication>
 <provider>azure</provider>
 <applicationID>=//Resources/ActiveDirectory/External Directories/Azure/ApplicationID</applicationID>
 <tenantName>=//Resources/ActiveDirectory/External Directories/Azure/TenantName</tenantName>
<postLogoutRedirectURI>https://activate.domain.local/</postLogoutRedirectURI>
 </authentication>
</remoteAccess>
```

1. On the main Activate server, recycle the Activate app pool (or run IISRESET from Command Prompt).
2. On the Activate Anywhere server, recycle the Activate Anywhere app pool (or run IISRESET from Command Prompt).
3. Navigate to the Anywhere site “https\://\<*sitefqdn*>”, in this case *https\://activate/*
4. A global admin will have to accept Consent on behalf of the Organisation for the first time.



![](https://api.archbee.com/api/optimize/Lfto9rn2ELed8aLNOgwlJ/hGWooCGG9Y80qX62ZLim6_image.png)



5. After authenticating you will be redirected to Activate, you can see Wendy Evans has successfully signed in.&#x20;
6.

![](https://api.archbee.com/api/optimize/Lfto9rn2ELed8aLNOgwlJ/dOFpXocHRgxel3MVGEbz8_image.png)

# Troubleshooting

Sometimes the serverPrincipalName hasn't been registered against the Active directory server computer object. After logging in with Azure/Entra OAuth and after being redirected the user is challenged for Windows Authentication.&#x20;

Check **SetSPN&#x20;**&#x68;as been run for the server. &#x20;

If you need to adjust to URL for the Activate Main site, in V8 this setting is defined under&#x20;

appsettings.Json for anywhere. Typically this will be under path *%InstallDrive%:\Program Files\Activate\Anywhere\\%InstanceName%\appsettings.json*

**

![](https://api.archbee.com/api/optimize/Lfto9rn2ELed8aLNOgwlJ/56odO12yENqVXr-E9sXSa_image.png)

Adjusting the highlighted "Server" value will change where anywhere looks for the main site.&#x20;