Docs Home Pulumi IaC Pulumi ESC Pulumi Insights Pulumi Cloud Packages Tutorials
  1. Packages
  2. Zitadel
  3. API Docs
  4. OrgIdpAzureAd
zitadel v0.2.0 published on Monday, Mar 24, 2025 by pulumiverse
pulumiverse/pulumi-zitadel

zitadel.OrgIdpAzureAd

Explore with Pulumi AI

zitadel v0.2.0 published on Monday, Mar 24, 2025 by pulumiverse
pulumiverse/pulumi-zitadel

Resource representing an Azure AD IdP on the organization.

Example Usage

using System.Collections.Generic;
using System.Linq;
using Pulumi;
using Zitadel = Pulumiverse.Zitadel;

return await Deployment.RunAsync(() => 
{
    var @default = new Zitadel.OrgIdpAzureAd("default", new()
    {
        OrgId = defaultZitadelOrg.Id,
        Name = "Azure AD",
        ClientId = "9065bfc8-a08a...",
        ClientSecret = "H2n***",
        Scopes = new[]
        {
            "openid",
            "profile",
            "email",
            "User.Read",
        },
        TenantType = "AZURE_AD_TENANT_TYPE_ORGANISATIONS",
        EmailVerified = true,
        IsLinkingAllowed = false,
        IsCreationAllowed = true,
        IsAutoCreation = false,
        IsAutoUpdate = true,
    });

});
Copy
package main

import (
	"github.com/pulumi/pulumi/sdk/v3/go/pulumi"
	"github.com/pulumiverse/pulumi-zitadel/sdk/go/zitadel"
)

func main() {
	pulumi.Run(func(ctx *pulumi.Context) error {
		_, err := zitadel.NewOrgIdpAzureAd(ctx, "default", &zitadel.OrgIdpAzureAdArgs{
			OrgId:        pulumi.Any(defaultZitadelOrg.Id),
			Name:         pulumi.String("Azure AD"),
			ClientId:     pulumi.String("9065bfc8-a08a..."),
			ClientSecret: pulumi.String("H2n***"),
			Scopes: pulumi.StringArray{
				pulumi.String("openid"),
				pulumi.String("profile"),
				pulumi.String("email"),
				pulumi.String("User.Read"),
			},
			TenantType:        pulumi.String("AZURE_AD_TENANT_TYPE_ORGANISATIONS"),
			EmailVerified:     pulumi.Bool(true),
			IsLinkingAllowed:  pulumi.Bool(false),
			IsCreationAllowed: pulumi.Bool(true),
			IsAutoCreation:    pulumi.Bool(false),
			IsAutoUpdate:      pulumi.Bool(true),
		})
		if err != nil {
			return err
		}
		return nil
	})
}
Copy
package generated_program;

import com.pulumi.Context;
import com.pulumi.Pulumi;
import com.pulumi.core.Output;
import com.pulumi.zitadel.OrgIdpAzureAd;
import com.pulumi.zitadel.OrgIdpAzureAdArgs;
import java.util.List;
import java.util.ArrayList;
import java.util.Map;
import java.io.File;
import java.nio.file.Files;
import java.nio.file.Paths;

public class App {
    public static void main(String[] args) {
        Pulumi.run(App::stack);
    }

    public static void stack(Context ctx) {
        var default_ = new OrgIdpAzureAd("default", OrgIdpAzureAdArgs.builder()        
            .orgId(defaultZitadelOrg.id())
            .name("Azure AD")
            .clientId("9065bfc8-a08a...")
            .clientSecret("H2n***")
            .scopes(            
                "openid",
                "profile",
                "email",
                "User.Read")
            .tenantType("AZURE_AD_TENANT_TYPE_ORGANISATIONS")
            .emailVerified(true)
            .isLinkingAllowed(false)
            .isCreationAllowed(true)
            .isAutoCreation(false)
            .isAutoUpdate(true)
            .build());

    }
}
Copy
import * as pulumi from "@pulumi/pulumi";
import * as zitadel from "@pulumiverse/zitadel";

const _default = new zitadel.OrgIdpAzureAd("default", {
    orgId: defaultZitadelOrg.id,
    name: "Azure AD",
    clientId: "9065bfc8-a08a...",
    clientSecret: "H2n***",
    scopes: [
        "openid",
        "profile",
        "email",
        "User.Read",
    ],
    tenantType: "AZURE_AD_TENANT_TYPE_ORGANISATIONS",
    emailVerified: true,
    isLinkingAllowed: false,
    isCreationAllowed: true,
    isAutoCreation: false,
    isAutoUpdate: true,
});
Copy
import pulumi
import pulumiverse_zitadel as zitadel

default = zitadel.OrgIdpAzureAd("default",
    org_id=default_zitadel_org["id"],
    name="Azure AD",
    client_id="9065bfc8-a08a...",
    client_secret="H2n***",
    scopes=[
        "openid",
        "profile",
        "email",
        "User.Read",
    ],
    tenant_type="AZURE_AD_TENANT_TYPE_ORGANISATIONS",
    email_verified=True,
    is_linking_allowed=False,
    is_creation_allowed=True,
    is_auto_creation=False,
    is_auto_update=True)
Copy
resources:
  default:
    type: zitadel:OrgIdpAzureAd
    properties:
      orgId: ${defaultZitadelOrg.id}
      name: Azure AD
      clientId: 9065bfc8-a08a...
      clientSecret: H2n***
      scopes:
        - openid
        - profile
        - email
        - User.Read
      tenantType: AZURE_AD_TENANT_TYPE_ORGANISATIONS
      emailVerified: true
      isLinkingAllowed: false
      isCreationAllowed: true
      isAutoCreation: false
      isAutoUpdate: true
Copy

Create OrgIdpAzureAd Resource

Resources are created with functions called constructors. To learn more about declaring and configuring resources, see Resources.

Constructor syntax

new OrgIdpAzureAd(name: string, args: OrgIdpAzureAdArgs, opts?: CustomResourceOptions);
@overload
def OrgIdpAzureAd(resource_name: str,
                  args: OrgIdpAzureAdArgs,
                  opts: Optional[ResourceOptions] = None)

@overload
def OrgIdpAzureAd(resource_name: str,
                  opts: Optional[ResourceOptions] = None,
                  client_id: Optional[str] = None,
                  client_secret: Optional[str] = None,
                  email_verified: Optional[bool] = None,
                  is_auto_creation: Optional[bool] = None,
                  is_auto_update: Optional[bool] = None,
                  is_creation_allowed: Optional[bool] = None,
                  is_linking_allowed: Optional[bool] = None,
                  name: Optional[str] = None,
                  org_id: Optional[str] = None,
                  scopes: Optional[Sequence[str]] = None,
                  tenant_id: Optional[str] = None,
                  tenant_type: Optional[str] = None)
func NewOrgIdpAzureAd(ctx *Context, name string, args OrgIdpAzureAdArgs, opts ...ResourceOption) (*OrgIdpAzureAd, error)
public OrgIdpAzureAd(string name, OrgIdpAzureAdArgs args, CustomResourceOptions? opts = null)
public OrgIdpAzureAd(String name, OrgIdpAzureAdArgs args)
public OrgIdpAzureAd(String name, OrgIdpAzureAdArgs args, CustomResourceOptions options)

type: zitadel:OrgIdpAzureAd
properties: # The arguments to resource properties.
options: # Bag of options to control resource's behavior.

Parameters

name This property is required. string
The unique name of the resource.
args This property is required. OrgIdpAzureAdArgs
The arguments to resource properties.
opts CustomResourceOptions
Bag of options to control resource's behavior.
resource_name This property is required. str
The unique name of the resource.
args This property is required. OrgIdpAzureAdArgs
The arguments to resource properties.
opts ResourceOptions
Bag of options to control resource's behavior.
ctx Context
Context object for the current deployment.
name This property is required. string
The unique name of the resource.
args This property is required. OrgIdpAzureAdArgs
The arguments to resource properties.
opts ResourceOption
Bag of options to control resource's behavior.
name This property is required. string
The unique name of the resource.
args This property is required. OrgIdpAzureAdArgs
The arguments to resource properties.
opts CustomResourceOptions
Bag of options to control resource's behavior.
name This property is required. String
The unique name of the resource.
args This property is required. OrgIdpAzureAdArgs
The arguments to resource properties.
options CustomResourceOptions
Bag of options to control resource's behavior.

Constructor example

The following reference example uses placeholder values for all input properties.

var orgIdpAzureAdResource = new Zitadel.OrgIdpAzureAd("orgIdpAzureAdResource", new()
{
    ClientId = "string",
    ClientSecret = "string",
    EmailVerified = false,
    IsAutoCreation = false,
    IsAutoUpdate = false,
    IsCreationAllowed = false,
    IsLinkingAllowed = false,
    Name = "string",
    OrgId = "string",
    Scopes = new[]
    {
        "string",
    },
    TenantId = "string",
    TenantType = "string",
});
Copy
example, err := zitadel.NewOrgIdpAzureAd(ctx, "orgIdpAzureAdResource", &zitadel.OrgIdpAzureAdArgs{
	ClientId:          pulumi.String("string"),
	ClientSecret:      pulumi.String("string"),
	EmailVerified:     pulumi.Bool(false),
	IsAutoCreation:    pulumi.Bool(false),
	IsAutoUpdate:      pulumi.Bool(false),
	IsCreationAllowed: pulumi.Bool(false),
	IsLinkingAllowed:  pulumi.Bool(false),
	Name:              pulumi.String("string"),
	OrgId:             pulumi.String("string"),
	Scopes: pulumi.StringArray{
		pulumi.String("string"),
	},
	TenantId:   pulumi.String("string"),
	TenantType: pulumi.String("string"),
})
Copy
var orgIdpAzureAdResource = new OrgIdpAzureAd("orgIdpAzureAdResource", OrgIdpAzureAdArgs.builder()
    .clientId("string")
    .clientSecret("string")
    .emailVerified(false)
    .isAutoCreation(false)
    .isAutoUpdate(false)
    .isCreationAllowed(false)
    .isLinkingAllowed(false)
    .name("string")
    .orgId("string")
    .scopes("string")
    .tenantId("string")
    .tenantType("string")
    .build());
Copy
org_idp_azure_ad_resource = zitadel.OrgIdpAzureAd("orgIdpAzureAdResource",
    client_id="string",
    client_secret="string",
    email_verified=False,
    is_auto_creation=False,
    is_auto_update=False,
    is_creation_allowed=False,
    is_linking_allowed=False,
    name="string",
    org_id="string",
    scopes=["string"],
    tenant_id="string",
    tenant_type="string")
Copy
const orgIdpAzureAdResource = new zitadel.OrgIdpAzureAd("orgIdpAzureAdResource", {
    clientId: "string",
    clientSecret: "string",
    emailVerified: false,
    isAutoCreation: false,
    isAutoUpdate: false,
    isCreationAllowed: false,
    isLinkingAllowed: false,
    name: "string",
    orgId: "string",
    scopes: ["string"],
    tenantId: "string",
    tenantType: "string",
});
Copy
type: zitadel:OrgIdpAzureAd
properties:
    clientId: string
    clientSecret: string
    emailVerified: false
    isAutoCreation: false
    isAutoUpdate: false
    isCreationAllowed: false
    isLinkingAllowed: false
    name: string
    orgId: string
    scopes:
        - string
    tenantId: string
    tenantType: string
Copy

OrgIdpAzureAd Resource Properties

To learn more about resource properties and how to use them, see Inputs and Outputs in the Architecture and Concepts docs.

Inputs

In Python, inputs that are objects can be passed either as argument classes or as dictionary literals.

The OrgIdpAzureAd resource accepts the following input properties:

ClientId This property is required. string
client id generated by the identity provider
ClientSecret This property is required. string
client secret generated by the identity provider
EmailVerified This property is required. bool
automatically mark emails as verified
IsAutoCreation This property is required. bool
enable if a new account in ZITADEL should be created automatically on login with an external account
IsAutoUpdate This property is required. bool
enable if a the ZITADEL account fields should be updated automatically on each login
IsCreationAllowed This property is required. bool
enable if users should be able to create a new account in ZITADEL when using an external account
IsLinkingAllowed This property is required. bool
enable if users should be able to link an existing ZITADEL user with an external account
Name string
Name of the IDP
OrgId Changes to this property will trigger replacement. string
ID of the organization
Scopes List<string>
the scopes requested by ZITADEL during the request on the identity provider
TenantId string
if tenantid is not set, the tenanttype is used
TenantType string
the azure ad tenant type
ClientId This property is required. string
client id generated by the identity provider
ClientSecret This property is required. string
client secret generated by the identity provider
EmailVerified This property is required. bool
automatically mark emails as verified
IsAutoCreation This property is required. bool
enable if a new account in ZITADEL should be created automatically on login with an external account
IsAutoUpdate This property is required. bool
enable if a the ZITADEL account fields should be updated automatically on each login
IsCreationAllowed This property is required. bool
enable if users should be able to create a new account in ZITADEL when using an external account
IsLinkingAllowed This property is required. bool
enable if users should be able to link an existing ZITADEL user with an external account
Name string
Name of the IDP
OrgId Changes to this property will trigger replacement. string
ID of the organization
Scopes []string
the scopes requested by ZITADEL during the request on the identity provider
TenantId string
if tenantid is not set, the tenanttype is used
TenantType string
the azure ad tenant type
clientId This property is required. String
client id generated by the identity provider
clientSecret This property is required. String
client secret generated by the identity provider
emailVerified This property is required. Boolean
automatically mark emails as verified
isAutoCreation This property is required. Boolean
enable if a new account in ZITADEL should be created automatically on login with an external account
isAutoUpdate This property is required. Boolean
enable if a the ZITADEL account fields should be updated automatically on each login
isCreationAllowed This property is required. Boolean
enable if users should be able to create a new account in ZITADEL when using an external account
isLinkingAllowed This property is required. Boolean
enable if users should be able to link an existing ZITADEL user with an external account
name String
Name of the IDP
orgId Changes to this property will trigger replacement. String
ID of the organization
scopes List<String>
the scopes requested by ZITADEL during the request on the identity provider
tenantId String
if tenantid is not set, the tenanttype is used
tenantType String
the azure ad tenant type
clientId This property is required. string
client id generated by the identity provider
clientSecret This property is required. string
client secret generated by the identity provider
emailVerified This property is required. boolean
automatically mark emails as verified
isAutoCreation This property is required. boolean
enable if a new account in ZITADEL should be created automatically on login with an external account
isAutoUpdate This property is required. boolean
enable if a the ZITADEL account fields should be updated automatically on each login
isCreationAllowed This property is required. boolean
enable if users should be able to create a new account in ZITADEL when using an external account
isLinkingAllowed This property is required. boolean
enable if users should be able to link an existing ZITADEL user with an external account
name string
Name of the IDP
orgId Changes to this property will trigger replacement. string
ID of the organization
scopes string[]
the scopes requested by ZITADEL during the request on the identity provider
tenantId string
if tenantid is not set, the tenanttype is used
tenantType string
the azure ad tenant type
client_id This property is required. str
client id generated by the identity provider
client_secret This property is required. str
client secret generated by the identity provider
email_verified This property is required. bool
automatically mark emails as verified
is_auto_creation This property is required. bool
enable if a new account in ZITADEL should be created automatically on login with an external account
is_auto_update This property is required. bool
enable if a the ZITADEL account fields should be updated automatically on each login
is_creation_allowed This property is required. bool
enable if users should be able to create a new account in ZITADEL when using an external account
is_linking_allowed This property is required. bool
enable if users should be able to link an existing ZITADEL user with an external account
name str
Name of the IDP
org_id Changes to this property will trigger replacement. str
ID of the organization
scopes Sequence[str]
the scopes requested by ZITADEL during the request on the identity provider
tenant_id str
if tenantid is not set, the tenanttype is used
tenant_type str
the azure ad tenant type
clientId This property is required. String
client id generated by the identity provider
clientSecret This property is required. String
client secret generated by the identity provider
emailVerified This property is required. Boolean
automatically mark emails as verified
isAutoCreation This property is required. Boolean
enable if a new account in ZITADEL should be created automatically on login with an external account
isAutoUpdate This property is required. Boolean
enable if a the ZITADEL account fields should be updated automatically on each login
isCreationAllowed This property is required. Boolean
enable if users should be able to create a new account in ZITADEL when using an external account
isLinkingAllowed This property is required. Boolean
enable if users should be able to link an existing ZITADEL user with an external account
name String
Name of the IDP
orgId Changes to this property will trigger replacement. String
ID of the organization
scopes List<String>
the scopes requested by ZITADEL during the request on the identity provider
tenantId String
if tenantid is not set, the tenanttype is used
tenantType String
the azure ad tenant type

Outputs

All input properties are implicitly available as output properties. Additionally, the OrgIdpAzureAd resource produces the following output properties:

Id string
The provider-assigned unique ID for this managed resource.
Id string
The provider-assigned unique ID for this managed resource.
id String
The provider-assigned unique ID for this managed resource.
id string
The provider-assigned unique ID for this managed resource.
id str
The provider-assigned unique ID for this managed resource.
id String
The provider-assigned unique ID for this managed resource.

Look up Existing OrgIdpAzureAd Resource

Get an existing OrgIdpAzureAd resource’s state with the given name, ID, and optional extra properties used to qualify the lookup.

public static get(name: string, id: Input<ID>, state?: OrgIdpAzureAdState, opts?: CustomResourceOptions): OrgIdpAzureAd
@staticmethod
def get(resource_name: str,
        id: str,
        opts: Optional[ResourceOptions] = None,
        client_id: Optional[str] = None,
        client_secret: Optional[str] = None,
        email_verified: Optional[bool] = None,
        is_auto_creation: Optional[bool] = None,
        is_auto_update: Optional[bool] = None,
        is_creation_allowed: Optional[bool] = None,
        is_linking_allowed: Optional[bool] = None,
        name: Optional[str] = None,
        org_id: Optional[str] = None,
        scopes: Optional[Sequence[str]] = None,
        tenant_id: Optional[str] = None,
        tenant_type: Optional[str] = None) -> OrgIdpAzureAd
func GetOrgIdpAzureAd(ctx *Context, name string, id IDInput, state *OrgIdpAzureAdState, opts ...ResourceOption) (*OrgIdpAzureAd, error)
public static OrgIdpAzureAd Get(string name, Input<string> id, OrgIdpAzureAdState? state, CustomResourceOptions? opts = null)
public static OrgIdpAzureAd get(String name, Output<String> id, OrgIdpAzureAdState state, CustomResourceOptions options)
resources:  _:    type: zitadel:OrgIdpAzureAd    get:      id: ${id}
name This property is required.
The unique name of the resulting resource.
id This property is required.
The unique provider ID of the resource to lookup.
state
Any extra arguments used during the lookup.
opts
A bag of options that control this resource's behavior.
resource_name This property is required.
The unique name of the resulting resource.
id This property is required.
The unique provider ID of the resource to lookup.
name This property is required.
The unique name of the resulting resource.
id This property is required.
The unique provider ID of the resource to lookup.
state
Any extra arguments used during the lookup.
opts
A bag of options that control this resource's behavior.
name This property is required.
The unique name of the resulting resource.
id This property is required.
The unique provider ID of the resource to lookup.
state
Any extra arguments used during the lookup.
opts
A bag of options that control this resource's behavior.
name This property is required.
The unique name of the resulting resource.
id This property is required.
The unique provider ID of the resource to lookup.
state
Any extra arguments used during the lookup.
opts
A bag of options that control this resource's behavior.
The following state arguments are supported:
ClientId string
client id generated by the identity provider
ClientSecret string
client secret generated by the identity provider
EmailVerified bool
automatically mark emails as verified
IsAutoCreation bool
enable if a new account in ZITADEL should be created automatically on login with an external account
IsAutoUpdate bool
enable if a the ZITADEL account fields should be updated automatically on each login
IsCreationAllowed bool
enable if users should be able to create a new account in ZITADEL when using an external account
IsLinkingAllowed bool
enable if users should be able to link an existing ZITADEL user with an external account
Name string
Name of the IDP
OrgId Changes to this property will trigger replacement. string
ID of the organization
Scopes List<string>
the scopes requested by ZITADEL during the request on the identity provider
TenantId string
if tenantid is not set, the tenanttype is used
TenantType string
the azure ad tenant type
ClientId string
client id generated by the identity provider
ClientSecret string
client secret generated by the identity provider
EmailVerified bool
automatically mark emails as verified
IsAutoCreation bool
enable if a new account in ZITADEL should be created automatically on login with an external account
IsAutoUpdate bool
enable if a the ZITADEL account fields should be updated automatically on each login
IsCreationAllowed bool
enable if users should be able to create a new account in ZITADEL when using an external account
IsLinkingAllowed bool
enable if users should be able to link an existing ZITADEL user with an external account
Name string
Name of the IDP
OrgId Changes to this property will trigger replacement. string
ID of the organization
Scopes []string
the scopes requested by ZITADEL during the request on the identity provider
TenantId string
if tenantid is not set, the tenanttype is used
TenantType string
the azure ad tenant type
clientId String
client id generated by the identity provider
clientSecret String
client secret generated by the identity provider
emailVerified Boolean
automatically mark emails as verified
isAutoCreation Boolean
enable if a new account in ZITADEL should be created automatically on login with an external account
isAutoUpdate Boolean
enable if a the ZITADEL account fields should be updated automatically on each login
isCreationAllowed Boolean
enable if users should be able to create a new account in ZITADEL when using an external account
isLinkingAllowed Boolean
enable if users should be able to link an existing ZITADEL user with an external account
name String
Name of the IDP
orgId Changes to this property will trigger replacement. String
ID of the organization
scopes List<String>
the scopes requested by ZITADEL during the request on the identity provider
tenantId String
if tenantid is not set, the tenanttype is used
tenantType String
the azure ad tenant type
clientId string
client id generated by the identity provider
clientSecret string
client secret generated by the identity provider
emailVerified boolean
automatically mark emails as verified
isAutoCreation boolean
enable if a new account in ZITADEL should be created automatically on login with an external account
isAutoUpdate boolean
enable if a the ZITADEL account fields should be updated automatically on each login
isCreationAllowed boolean
enable if users should be able to create a new account in ZITADEL when using an external account
isLinkingAllowed boolean
enable if users should be able to link an existing ZITADEL user with an external account
name string
Name of the IDP
orgId Changes to this property will trigger replacement. string
ID of the organization
scopes string[]
the scopes requested by ZITADEL during the request on the identity provider
tenantId string
if tenantid is not set, the tenanttype is used
tenantType string
the azure ad tenant type
client_id str
client id generated by the identity provider
client_secret str
client secret generated by the identity provider
email_verified bool
automatically mark emails as verified
is_auto_creation bool
enable if a new account in ZITADEL should be created automatically on login with an external account
is_auto_update bool
enable if a the ZITADEL account fields should be updated automatically on each login
is_creation_allowed bool
enable if users should be able to create a new account in ZITADEL when using an external account
is_linking_allowed bool
enable if users should be able to link an existing ZITADEL user with an external account
name str
Name of the IDP
org_id Changes to this property will trigger replacement. str
ID of the organization
scopes Sequence[str]
the scopes requested by ZITADEL during the request on the identity provider
tenant_id str
if tenantid is not set, the tenanttype is used
tenant_type str
the azure ad tenant type
clientId String
client id generated by the identity provider
clientSecret String
client secret generated by the identity provider
emailVerified Boolean
automatically mark emails as verified
isAutoCreation Boolean
enable if a new account in ZITADEL should be created automatically on login with an external account
isAutoUpdate Boolean
enable if a the ZITADEL account fields should be updated automatically on each login
isCreationAllowed Boolean
enable if users should be able to create a new account in ZITADEL when using an external account
isLinkingAllowed Boolean
enable if users should be able to link an existing ZITADEL user with an external account
name String
Name of the IDP
orgId Changes to this property will trigger replacement. String
ID of the organization
scopes List<String>
the scopes requested by ZITADEL during the request on the identity provider
tenantId String
if tenantid is not set, the tenanttype is used
tenantType String
the azure ad tenant type

Import

bash The resource can be imported using the ID format <id[:org_id][:client_secret]>, e.g.

 $ pulumi import zitadel:index/orgIdpAzureAd:OrgIdpAzureAd imported '123456789012345678:123456789012345678:12345678-1234-1234-1234-123456789012'
Copy

To learn more about importing existing cloud resources, see Importing resources.

Package Details

Repository
zitadel pulumiverse/pulumi-zitadel
License
Apache-2.0
Notes
This Pulumi package is based on the zitadel Terraform Provider.
zitadel v0.2.0 published on Monday, Mar 24, 2025 by pulumiverse
pulumiverse/pulumi-zitadel