---
title: "Upsert Azure AD SSO configuration"
method: PUT
path: "/api/v1/org/sso/azuread"
tags: ["Organizations"]
---

# Upsert Azure AD SSO configuration

`PUT /api/v1/org/sso/azuread`

Creates or updates the current organization's Azure AD SSO configuration.
Omit `oauth2ClientSecret` to preserve the previously stored secret on
updates.

## Request body

- UpsertAzureAdSsoConfig — Make all properties in T optional
  - `oauth2TenantId` string, required
  - `oauth2ClientSecret` string — When omitted on update, the stored secret is preserved. Required on create.
  - `oauth2ClientId` string, required
  - `enabled` boolean — When false the method is hidden from precheck even if discovery would match.
  - `overrideEmailDomains` boolean — When true, the method's own `emailDomains` list governs discovery. When false, the org's `allowed_email_domains` is used instead.
  - `emailDomains` string[] — Strict whitelist (only consulted when `overrideEmailDomains` is true).
  - `allowPassword` boolean — Controls whether email+password sign-in is shown alongside this method when it matches a user. When multiple matching SSO methods disagree, lenient rule applies (ANY method that allows → show password).

## Response `200`

Ok

- ApiUpsertAzureAdSsoConfigResponse
  - `results` AzureAdSsoConfigSummary, required — Per-row flags shared by every SSO method configured at the org level. Stored as plain columns alongside the encrypted provider-specific config.
    - `oauth2ClientId` string, required
    - `oauth2TenantId` string, required
    - `allowPassword` boolean, required — Controls whether email+password sign-in is shown alongside this method when it matches a user. When multiple matching SSO methods disagree, lenient rule applies (ANY method that allows → show password).
    - `emailDomains` string[], required — Strict whitelist (only consulted when `overrideEmailDomains` is true).
    - `overrideEmailDomains` boolean, required — When true, the method's own `emailDomains` list governs discovery. When false, the org's `allowed_email_domains` is used instead.
    - `enabled` boolean, required — When false the method is hidden from precheck even if discovery would match.
    - `hasClientSecret` boolean, required
  - `status` 'ok', required

## Other responses

- `default` — Error

---

[API](https://skmtc.net/lightdash/apis/lightdash-api.md) · [All operations](https://skmtc.net/lightdash/apis/lightdash-api/llms.txt) · [OpenAPI document](https://skmtc-service-staging.skmtc.workers.dev/v1/apis/lightdash/lightdash-api/versions/40c933755c9a/schema)