VD Studio

Appearance

Identity Providers ​

What's on this screen ​

The Identity Providers panel lets a Vibedata Owner or User Access Administrator register the OAuth/OIDC applications that serve this deployment. Each provider can sign users in to Studio, serve Domain and Secret Store delegation, or both — an Allow sign-in setting on the provider decides which. The panel supports registering new Microsoft Entra ID and Generic OIDC providers. A Google Workspace or GitHub sign-in provider configured before this panel existed keeps working and appears in this list; it is not something you can register fresh from this screen.

How to add a provider ​

  1. Open Org Settings and select Identity Providers.
  2. Click Register Identity Provider.
  3. Choose Microsoft Entra ID or Generic OIDC from Provider type.
  4. Fill in Display name.
  5. Copy the read-only Callback URL into the provider's application registration.
  6. Fill in Tenant ID for Microsoft Entra ID or Issuer URL for Generic OIDC.
  7. Fill in Client ID.
  8. Fill in Client secret.
  9. Leave Allow sign-in selected so the provider can sign users in to Studio, or clear it to register a delegation-only provider that only serves Domains and never signs anyone in.
  10. Select Automatically approve new users when users who first sign in through this provider (when sign-in is allowed) should enter Studio without manual approval.
  11. Click Save. Studio returns to the provider list and shows the saved provider as Pending test.
  12. Find the saved provider row and click Test. A successful connection test activates the provider automatically.

For Microsoft Entra ID, configure the Entra app registration to include the optional ID-token claim email_verified when users need same-email linking across multiple Studio providers. Without that claim, Entra sign-in can still work for its own provider account, but Studio will not use the Entra email claim to link into an existing user from another provider.

How to configure automatic approval ​

  1. Open Identity Providers and click Register Identity Provider, or click the edit action on an existing provider.
  2. Select Automatically approve new users when users who first sign in through that provider should enter Studio without manual approval.
  3. Click Save.

Automatically approve new users is clear by default. It approves only accounts Studio records after you enable the setting; existing Pending approval users still require Approve under Org Settings → Users. Automatic approval does not grant platform roles or Domain memberships, and it has no effect on a provider with Allow sign-in cleared.

How to edit an active provider ​

  1. Open Identity Providers and click the edit action on the provider row.
  2. Change the provider values. Leave Client secret blank to keep the saved secret. Toggle Allow sign-in to change whether the provider may sign users in to Studio.
  3. Click Save. The existing active configuration keeps serving sign-ins and delegation while the replacement shows Active · changes pending test.
  4. Click Test on the provider row. A successful test activates the replacement automatically. A failed or canceled test leaves the existing active configuration unchanged.

How to archive a provider ​

  1. Open Identity Providers.
  2. Find the provider row.
  3. Click the archive action. Studio asks you to confirm, and names any Domain that still references the provider — remove it from those Domains first.

Archiving clears the client secret; non-secret fields (client ID, tenant or issuer boundary, name) are retained. An archived provider's only action is Unarchive, which reopens the same registration fields with an empty, required secret and runs the same save-then-test path as a normal edit.

What you'll see ​

  • No Identity Providers registered. — no provider rows exist.
  • Loading Identity Providers… — Studio is loading provider rows.
  • Unable to load Identity Providers. — the provider list failed to load; use Retry.
  • A provider with this name already exists for this kind. — choose a different display name; the callback URL is derived from provider type + display name and must stay unique.
  • Pending test — a new saved provider is pending its first Test and is not yet available for sign-in or delegation.
  • Active · changes pending test — an active provider has saved replacement values; sign-in and delegation continue on the existing active values until the replacement passes Test.
  • Test in progress / Active · replacement test in progress — a test is running for this provider.
  • Test failed · … / Active · replacement test failed · … — Test failed with a specific reason; the saved candidate remains available to edit or retry, and any existing active values stay live.
  • Archived — the provider is archived; its only action is Unarchive.

Quick reference ​

ControlWhat it does
Provider typeSelects Microsoft Entra ID or Generic OIDC for a new registration.
Display nameSets the label shown for the provider row.
Tenant IDIdentifies a Microsoft Entra tenant.
Issuer URLIdentifies a Generic OIDC issuer.
Client IDStores the OAuth client id.
Client secretStores the encrypted OAuth secret.
Allow sign-inLets this provider sign users in to Studio; clear it for a delegation-only provider. Defaults on.
Automatically approve new usersApproves new accounts from this provider after their first sign-in.
SavePersists a pending candidate and returns to the provider list.
TestTests the saved candidate and activates it automatically on success.
Archive / UnarchiveArchives the provider row, or reopens an archived row for re-registration.