TechAnek

Try for Free

How to Integrate VMware vSphere 7 SSO with Microsoft Entra ID (Azure AD)

As IT infrastructure evolves to support hybrid and cloud-native environments, integrating identity providers becomes increasingly important. In this blog post, we’ll walk through how to integrate VMware vSphere 7 Single Sign-On (SSO) with Microsoft Entra ID (formerly Azure Active Directory) using Microsoft Entra Domain Services (LDAP).

This guide is tailored for VMware administrators, cloud architects, and security professionals aiming to enhance access control and authentication within their vSphere environment by leveraging Entra ID.

Why Integrate vSphere 7 with Microsoft Entra ID?

VMware vSphere 7 comes with a built-in SSO feature that simplifies access across vSphere components. While it traditionally supports Active Directory and other local identity sources, vSphere 7 also introduces support for OpenID Connect (OIDC), paving the way for integration with modern identity providers like Microsoft Entra ID.

Microsoft Entra ID, Microsoft’s cloud-based IAM platform, enables secure and seamless access to a wide range of services. It supports protocols such as OIDC and OAuth 2.0, making it an ideal choice for federated authentication.

However, direct integration between vSphere 7 and Entra ID isn’t natively supported—you’ll need to bridge the gap using either AD FS or Microsoft Entra Domain Services.

Federated Identity Options in vSphere 7

Here’s what vSphere 7 supports out of the box:

vSphere VersionSupported Identity Providers
7.0 and laterAD FS, AD over LDAP, OpenLDAP
8.0 Update 1Adds support for Okta
8.0 Update 2Adds Microsoft Entra ID support natively
8.0 Update 3Adds PingFederate

For vSphere 7, you have three main integration routes:

  1. Active Directory Federation Services (AD FS)
    Use this if you’re running a hybrid environment (on-prem AD + Entra ID). AD FS acts as a SAML IdP and can federate with Entra ID. It’s more complex to configure but offers features like MFA and claims-based access.

  2. Active Directory over LDAP (using Microsoft Entra Domain Services)
    Best suited for cloud-first setups with no on-prem infrastructure. It allows vSphere to authenticate via LDAPS to Entra-hosted AD DS.

  3. OpenLDAP
    Recommended for open-source or Linux-heavy environments. Not natively integrated with Entra ID and requires manual management.

Our Scenario:

We’re working with a cloud-only Microsoft Entra ID setup—no on-prem AD. That makes Microsoft Entra Domain Services (LDAP) the best fit for us.

Architecture Overview

By enabling Microsoft Entra Domain Services, we expose Azure-hosted directory services over LDAP/LDAPS, allowing vCenter to authenticate users without an on-prem AD.

Note: Microsoft Entra Domain Services provides a managed domain with support for Kerberos, NTLM, and LDAP/LDAPS without requiring domain controller VMs.

Prerequisites

  1. Before diving into setup, ensure the following:

    • vCenter Server 7.0 is up and running.

    • A Microsoft Entra ID (Azure AD) tenant exists.

    • Microsoft Entra Domain Services is provisioned.

    • LDAPS is enabled.

    • Port TCP 636 (LDAPS) is open between vCenter and Entra DS.

Step-by-Step Integration Guide

1. Provision Microsoft Entra Domain Services

  1. In the Azure portal:

    • Search for “Microsoft Entra Domain Services”.

    • Click Create, and fill in:

      • DNS domain name (e.g., litmusds.local)

      • Region, subscription, resource group, and SKU tier

      • Choose a Virtual Network vCenter can reach

    Provisioning typically takes 60–90 minutes.

    💡 Pricing Snapshot (Central US):

    TierAuth LoadObject LimitCost (Monthly)
    Standard0–3K25K~$109.50
    Enterprise3–10K100K~$292.00
    Premium10–70K500K~$1,168.00

2. Enable Secure LDAPS

  1. From the Azure portal:

    • Go to your Entra Domain Service.

    • Click Secure LDAP under settings.

    • Toggle Enable Secure LDAP.

    • Upload a .PFX certificate.

    • (Optional) Enable internet access if vCenter is outside Azure.

    🔐 Creating a Secure LDAPS Certificate

    Option 1 – Self-signed certificate (Quick & Free):

    openssl req -x509 -newkey rsa:2048 -keyout ldap.key -out ldap.crt -days 365 -nodes -subj "/CN=yourdomain.com"
    openssl pkcs12 -export -out ldap.pfx -inkey ldap.key -in ldap.crt -passout pass:YourStrongPassword

    Option 2 – Let’s Encrypt (Wildcard certificate):

    Use certbot, generate a DNS-challenge wildcard cert, and convert it to .pfx using:

    openssl pkcs12 -export \
    -out ldap-cert.pfx \
    -inkey privkey.pem \
    -in fullchain.pem \
    -password pass:YourStrongPassword

3. Allow Port 636 in Azure NSG

  1. To allow vCenter access over LDAPS:

    • Open the NSG tied to Entra DS’s subnet.

    • Add an inbound rule:

      • Port: 636

      • Protocol: TCP

      • Source: vCenter IP/Subnet

      • Action: Allow

4. Configure LDAPS Identity Source in vCenter

In vSphere Client:

  • Go to: Menu > Administration > Single Sign-On > Configuration

  • Under Identity Sources, click Add

  • Choose: LDAP over SSL (LDAPS)

🔧 Sample configuration:

FieldValue
Base DN for UsersDC=yourdomain,DC=com
Domain Nameyourdomain.com
Bind Usernameldapbind@yourdomain.com
Primary Server URLldaps://<entra-ip>:636
CertificateUpload fullchain.pem (if needed)

✅ Click Test Connection and then OK to save.

5. Assign Roles to Entra Users

  1. Now, assign roles so users can access vSphere:

    • Go to: Menu > Administration > Access Control > Global Permissions

    • Click Add

    • Select your LDAP domain

    • Search for a user/group

    • Assign a role (e.g., Administrator)

    • Enable “Propagate to children”

    💡 Tip: Assign permissions to groups instead of individuals to simplify management.

6. Test the Integration

  1. Try logging in to vCenter using a user from Entra Domain Services:

    • Format: user@yourdomain.com

    • If authentication works and permissions apply correctly—success! 🎉

Troubleshooting Tips

  • Ensure port 636 is open and reachable.
  • Verify the certificate is valid and trusted.
  • Double-check Base DN and LDAP URLs.
  • Use the vCenter logs for error tracing (vpxd or sso logs).

Conclusion

  • Integrating VMware vSphere 7 SSO with Microsoft Entra ID via Entra Domain Services (LDAP) provides a secure and scalable solution for centralized access control—especially in cloud-only or hybrid environments.

    While native support improves in vSphere 8.x, this guide ensures you can still achieve smooth federation in vSphere 7 with confidence.

Leave a Reply

Your email address will not be published. Required fields are marked *