Skip to content

Entra ID Integration — Migration Checklist

We are rolling out Entra ID integration for the OSDU Data Platform. If you authenticate using the authorization code flow (delegated/user tokens), you need to update your token scope.

Available for all environments

Entra ID integration is now live for all environments — Development, Test, and Production. Update your token scope to https://energy.azure.com/.default

Client credentials flow

The new unified scope also works for the client credentials flow. Apps using client credentials should update their scope to https://energy.azure.com/.default

graph LR U[User]:::user -->|auth code flow| EID[Entra ID]:::identity EID -->|old scope| OLD["❌ {per-instance ID}/.default"]:::old EID -->|new scope| NEW["✅ https://energy.azure.com/.default"]:::new NEW --> ADME[ADME Platform]:::platform classDef user fill:#f3e5f5,stroke:#6a1b9a classDef identity fill:#fff3e0,stroke:#e65100 classDef old fill:#ffebee,stroke:#c62828 classDef new fill:#e8f5e9,stroke:#2e7d32 classDef platform fill:#e3f2fd,stroke:#1565c0

To understand why we are making this change and how Entra ID integration works, see Entra ID Integration.

What's changing

When obtaining a delegated token via the authorization code flow, the scope is changing from a per-instance resource ID to a unified scope:

Old scope New scope
Development 7daee810-3f78-40c4-84c2-7a199428de18/.default https://energy.azure.com/.default
Test 7daee810-3f78-40c4-84c2-7a199428de18/.default https://energy.azure.com/.default
Production 5a1178c2-5867-4a34-8fb8-216164e30b5f/.default https://energy.azure.com/.default

The new scope applies to all environments — Development, Test, and Production.

Checklist

1. Update your app registration API permission and request admin consent

If your team has its own app registration that uses user_impersonation on the old per-instance resource (dffa82c7-...), you must add the new API permission and get admin consent before changing your scope.

Without this, you will hit one of these errors:

  • No API permission added: AADSTS650057: Invalid resource — the client has requested access to a resource which is not listed in the requested permissions in the client's application registration.
  • API permission added but not admin consented: Entra ID will show an "Approval required" page saying the app requires your admin's approval.

Steps:

  1. Go to your app registration in the Azure Portal → API permissions
  2. Click Add a permission → APIs my organization uses → search for "Azure Data Manager for Energy"
  3. Select the one with client ID bd0c9d90-89ad-4bb3-97bc-d787b9f69cdc (not the old dffa82c7-...)
  4. Choose Delegated permissions → select access_as_user → Add permissions
  5. Request admin consent by emailing AADAppConsent@equinor.com with your app registration name and client ID
  6. Wait for admin consent to be granted before proceeding to the next steps
  7. Once granted, verify that the new scope works before removing the old API permission. Keep the old user_impersonation permission on dffa82c7-... as a fallback until you have confirmed everything works.
2. Update your CLI config files (if applicable)

Open each config file in ~/.osducli/ (or C:\Users\<YourUsername>\.osducli\ on Windows) and update the scopes line:

Before:

scopes = 7daee810-3f78-40c4-84c2-7a199428de18/.default openid

After:

scopes = https://energy.azure.com/.default openid

Repeat for config_dev, config_test.

For config_prod:

Before:

scopes = 5a1178c2-5867-4a34-8fb8-216164e30b5f/.default openid

After:

scopes = https://energy.azure.com/.default openid
3. Update your Python scripts (if applicable)

If you use the Python SDK with interactive authentication, update the resource_id:

Before:

resource_id = "7daee810-3f78-40c4-84c2-7a199428de18"
credential = OsduMsalInteractiveCredential(client_id, authority, resource_id)

After:

resource_id = "https://energy.azure.com"
credential = OsduMsalInteractiveCredential(client_id, authority, resource_id)

If you use MSAL directly with interactive flows, update the scopes:

Before:

scopes = ["7daee810-3f78-40c4-84c2-7a199428de18/.default"]

After:

scopes = ["https://energy.azure.com/.default"]
4. Update Postman and other tools (if applicable)

If you use your own Postman setup, Insomnia, or any other tool that obtains tokens using the authorization code flow (grant type authorization_code), update the scope there too:

  • Old scope: 7daee810-3f78-40c4-84c2-7a199428de18/.default (or the equivalent per-instance ID)
  • New scope: https://energy.azure.com/.default

This applies to any tool or workflow where you sign in as a user to get a token.

5. Verify your access

Run a quick health check to confirm everything works:

osdu status

Or via Python:

response = client.get(f"{server}/api/search/v2/health/readiness_check")
print(response.status_code)  # Should be 200

What stays the same

  • Applications and service principals — update to the new unified scope https://energy.azure.com/.default. This works for client credentials as well.
  • Server URLs — no change to base URLs or API paths
  • Data partition IDs — no change
  • Client IDs — no change

Need help?

If you run into issues after updating, contact the OSDU Platform Team:

Last update: 2026-06-03