Setup guide
Setting up Zekt Gate in Microsoft Entra ID takes one approval from an administrator of your directory, and you do not build or expose an API. The administrator approves Zekt Gate once, on Microsoft’s own consent screen. Microsoft then adds a record of Zekt Gate to your directory. After that, your developer-portal team registers the application that calls it. This guide covers each step: which screen to use, what you should see there, and what the step commits you to.
You do not create or expose an API, and you do not register Zekt Gate yourself. Zekt Gate’s API already exists: Zekt publishes it once, in Zekt’s own directory. If you follow a guide for publishing an API of your own, every token will name your API instead of Zekt Gate’s, and Zekt Gate will refuse every call.
This is the ID of your application — the one that asks. It is not the record of Zekt Gate that consent created in your directory; those are two different objects and they are confused constantly. Until at least one application is registered, every call is refused.
Enrollment takes three people, and usually they are different people. Know who each one is before you begin. Most stalled enrollments stop at the moment someone discovers they need a colleague they had not warned.
For whoever owns the Zekt relationship. There is nothing to do in Azure at this door. It happens at Zekt, and it ends with a message written for your Entra administrator, which you send them.
Zekt Gate has no login of its own. Core authenticates you and tells Gate the answer.
What this commits you to: This identity is recorded as the person who enrolled, and it is the identity Zekt is re-asked about before anything is bound. Signing in with a different GitHub account means a different person, even at the same company.
Core confirms you may administer it. Membership alone is not authority.
What this commits you to: This choice decides which account carries the charge and which Zekt organisations your directory’s tokens will be able to reach. It is not editable afterwards: moving an enrollment to a different customer means enrolling again.
Core enables Gate as an add-on and remains the source of truth for billing.
What this commits you to: Charging starts when your administrator’s approval completes the connection in Door 2 — not when you accept here, and not at your first call. The charge is per connected directory, so a second directory is a second charge. Any free period is stated with the terms.
For the administrator of your Microsoft Entra directory. You do not need a Zekt account, and you will not be asked to create one. It takes about two minutes.
There is no DNS record to publish, no directory query to run and no support ticket to raise: the consent is the proof. Direction is what makes it safe — your directory gains permission to issue tokens naming Zekt Gate, and Gate gains no standing inside your directory. The screen lists two permissions: connecting the directory to Zekt Gate, and “Sign in and read user profile”, which Microsoft requires for any sign-in and which covers the person signing in and nobody else. No reading other users, no groups, no application permissions.
Where: Microsoft Entra admin centre (entra.microsoft.com) → Overview
In the Microsoft Entra admin centre it is shown as Tenant ID on the directory’s overview page. A domain name such as contoso.com is not the same thing. Your identity administrator can read it in seconds if you do not have access yourself.
What this commits you to: This is the directory whose sign-ins Zekt will trust for this account, and a directory serves at most one Zekt customer. If you name a different one later, the approval link you already sent stops working and your administrator has to be sent the new one.
The link goes to login.microsoftonline.com. That is Microsoft’s sign-in page, not a Zekt Gate form, and Zekt Gate never asks for your password.
What this commits you to: The request has a deadline set by Zekt; if it passes, the enrollment has to be started again from Door 1, so it is worth chasing. Approval creates a local record of Zekt Gate inside your directory which you own, can see, and can revoke at any time — revoking it stops Gate working immediately.
Use an account in the directory that the message names. So far this approval has been tested with a Global Administrator account. We have not yet tested whether a role with fewer rights can approve it, and this page will say so once we have.
About the second one: Microsoft Graph User.Read. Microsoft requires it for any sign-in and puts it on every consent screen. It covers the profile of the person signing in, and basic company information — never another user. Zekt Gate is granted it because the sign-in cannot complete otherwise, and never calls Microsoft Graph at all.
You should see: Two permissions requested for Zekt Gate, and no others: “Connect this directory to Zekt Gate” and “Sign in and read user profile”. If Microsoft’s screen shows you a third line, stop and tell us. This page is meant to match it exactly.
Microsoft shows whether the publisher of Zekt Gate is verified. Zekt’s publisher verification is in progress. Until it completes, the screen says the publisher is unverified, and some directories refuse approval for unverified publishers. Whether yours allows it is decided by your own consent settings. Zekt does not ask you to weaken them.
Your administrator is returned here automatically after approving. Closing the tab at that point is common and costs nothing — the enrollment is resumable and the same link still works.
You should see: Zekt Gate’s own page, headed “Directory connected”.
What this commits you to: This is the moment the connection exists, and the moment the recurring charge for this directory starts. Everything before it can be abandoned at no cost.
Where: Microsoft Entra admin centre → Enterprise applications → Zekt-Gate
This is the record of Zekt Gate that your approval created, and it is yours. If it does not appear in the list, search for Zekt-Gate and clear the application-type filter. Its permissions page shows the two permissions you approved, and nothing else.
You should see: Zekt-Gate in the list of enterprise applications, with the two permissions above.
Where: Microsoft Entra admin centre → Enterprise applications → Zekt-Gate → Permissions → Admin consent
Revoke each permission listed under admin consent. That withdraws your approval and leaves the Zekt-Gate record in your directory, which is what you want: do not delete the application, because keeping it is what lets this directory be connected again. Removing the consent in your tenant stops Gate from being usable immediately. If your organisation stops using Zekt Gate, do this once Zekt has confirmed the disconnection.
For your developer-portal team, after Door 2 is done. You sign in to Zekt with the account that connected the directory, and then sign in to the directory itself.
Where: Microsoft Entra admin centre → Enterprise applications → Zekt-Gate → Users and groups → Add user/group
Choose the person, then the role Zekt Gate Administrator. Without it, a person who signs in to your directory at Zekt Gate can see its configuration and remove applications, but cannot add an application or resume trust. Assigning individual people works on every Microsoft Entra ID edition; assigning a group needs Entra ID P1 or P2. This is the only change you make on the Zekt-Gate record.
You should see: After the person signs in to your directory at Zekt Gate, the directory screen shows “Zekt Gate role: Administrator”.
Where: Microsoft Entra admin centre → App registrations → New registration
This is the application that will call Zekt Gate, such as your developer portal. Most customers already have it registered. It is a separate record from Zekt-Gate under Enterprise applications, which Door 2 created and which you leave as it is.
Where: Microsoft Entra admin centre → App registrations → Your application → Overview
In the Microsoft Entra admin centre under App registrations, on your own application’s overview page. For most customers the first one is their developer portal.
What this commits you to: This is the ID of your application — the one that asks. It is not the record of Zekt Gate that consent created in your directory; those are two different objects and they are confused constantly. Until at least one application is registered, every call is refused.
Where: Microsoft Entra admin centre → App registrations → Your application → API permissions → Add a permission → APIs my organization uses → Zekt Gate → Application permissions
Tick Gate.Caller, add it, then choose Grant admin consent. Zekt Gate appears under “APIs my organization uses” only after Door 2, because Door 2 is what created its record in your directory. Granting the permission is not enough on its own: the application must also be on the list in Zekt Gate, which is the next step.
You should see: Gate.Caller in the application’s permissions, of type Application, with admin consent granted.
Where: www.zekt-gate.dev/app → Your directory → Sign in to this directory → Applications
Paste the ID and give the application a name you will recognise. The list belongs to your Zekt account and covers every directory it has connected. Today your application can call Zekt Gate only to check that it is recognised; nothing is served to it yet.
You should see: Your application in the list, marked “Not yet seen calling”. That changes after it first calls Zekt Gate.
Where: www.zekt-gate.dev/app → Your directory → Applications → Remove
Removing it takes effect on the next request. If it is the last application on the list, no application can call Zekt Gate until you add one.
When approval does not complete, Zekt Gate shows one of these screens, worded exactly as below. Each one says what happened and what to do next.
Nothing was approved and nothing has changed. This happens if the approval was declined, or if the account you signed in with is not a Global Administrator of the directory. You can follow the link again when you are ready.
The link you followed has expired or has been replaced. Ask the person who sent it to you for a new one — nothing has been changed.
The approval step timed out, which happens if the page sat open for a while. Follow the link from your email again — nothing has been changed.
This Microsoft Entra directory is already connected to a Zekt account. A directory can serve only one. Ask the person who sent you this link to contact Zekt — nothing has been changed and nothing has been charged.
The enrollment this link belongs to is no longer active, so nothing has been connected. Ask your Zekt account owner to start a new one.
Zekt Gate could not confirm the approval with Microsoft, so nothing has been connected and nothing has been charged. Ask the person who sent you the link to start again.
Last updated 2026-09-24
