Installation > Authenticating PTC Modeler using Microsoft Entra ID > Using Microsoft Entra ID Authentication for PTC Modeler
Using Microsoft Entra ID Authentication for PTC Modeler
This section explains how to configure Microsoft Entra ID (formerly Azure Active Directory) authentication for PTC Modeler products. It describes the supported sign-in flows, the required Microsoft Entra app registrations and permissions, and the product settings to enable Entra ID sign-in.
Overview
PTC Modeler products support the following authentication modes:
• Windows authentication (Kerberos / NTLM for domain or local accounts)
• Microsoft Entra ID authentication (cloud identity using OAuth 2.0 through MSAL)
When you use Microsoft Entra ID authentication, the products use the following sign-in methods:
• Desktop applications (PTC Modeler, Model Explorer): Use the Windows Account Manager (WAM) method for single sign-on when available, with a backup method of device code flow if required.
• Model Manager (Web): Uses device code flow. The server returns a code and a verification URL; the user signs in using a browser and the client waits until sign-in completes.
• Web Interface (Web): Uses authorization code flow with PKCE.
• SQL Server database: Connections use access tokens obtained from Entra ID instead of Windows credentials.
• Identity resolution groups (for example, adding users and groups as Modeler logins): Uses the Microsoft Graph API with signed-in Entra identity.
To use Entra ID authentication, create one or more application registrations in the Azure portal and then specify the application (client) ID and directory (tenant) ID in each product that uses Entra ID.
PTC recommends that you create separate application registrations for the following clients (depending on your deployment):
Usage
Suggested client name
Registration type
Authentication flow
PTC Modeler and Model Explorer
ptc-modeler-desktop
Public client
WAM+device code
Model Manager (web)
ptc-modeler-model-manager
Public client
Device code
Web Interface and OSLC Provider (web)
ptc-modeler-web-interface
Public client
Authorization code + PKCE
Impact on products
Product
Entra ID usage
User experience
PTC Modeler
Optional; select Microsoft Entra IDat sign-in. ODBC and SQL connections use Entra tokens (through WAM or device codes)
On first use, you may be prompted for the client ID and tenant ID. After you sign in, subsequent sign-ins typically use WAM or cachsed tokens.
Model Explorer
Similar to PTC Modeler when connecting to a repository that uses Entra ID. Login Management can resolve Entra users and groups using Microsoft Graph.
You may prompted to sign-in when opening repostories or when managing logins.
Model Manager (web)
The sign-in page offers Windoes and Microsoft Entra ID options. The user enters a UPN (for example, [email protected]). The server uses device code flow or a cacched token.
The user may need to enter a device code in a browser and sign in to Microsoft. If a token is cached, sign-in can complete without showing a device code.
Web Interface (web)
The sign-in page offers local sign-in (Web Interface local accounts and / or LDAP) and Sign in with your organization
The user completes the Entra sign-in (with an account picker, if applicable). A time-limited, browser session cookie is created. Users can sign out of the Web Interface and optionally sign out of their Entra session.
All of these products can coexist; some users use Windows authentication, others use Entra ID, depending on how they log in and how the server is configured.
Was this helpful?