From febb0d88b30c84008bc9cd206dd916703ddde52f Mon Sep 17 00:00:00 2001
From: Wouter van Elten <wouter+github@vanelten.org>
Date: Thu, 14 Aug 2025 10:21:37 +0200
Subject: [PATCH] For Entra ID email is not a valid scope. Also removed the (
 and ) as this is not valid for .env

---
 Enabling-SSO-support-using-OpenId-Connect.md | 8 ++++----
 1 file changed, 4 insertions(+), 4 deletions(-)

diff --git a/Enabling-SSO-support-using-OpenId-Connect.md b/Enabling-SSO-support-using-OpenId-Connect.md
index 003e91b..bc50712 100644
--- a/Enabling-SSO-support-using-OpenId-Connect.md
+++ b/Enabling-SSO-support-using-OpenId-Connect.md
@@ -199,10 +199,10 @@ Only the v2 endpoint is compliant with the OpenID spec, see <https://github.com/
 
 Your configuration should look like this:
 
-* `SSO_AUTHORITY=https://login.microsoftonline.com/${Directory (tenant) ID}/v2.0`
-* `SSO_SCOPES="email profile offline_access"`
-* `SSO_CLIENT_ID=${Application (client) ID}`
-* `SSO_CLIENT_SECRET=${Secret Value}`
+* `SSO_AUTHORITY=https://login.microsoftonline.com/${Directory_ID}/v2.0` #tenant
+* `SSO_SCOPES=openid profile offline_access User.Read`
+* `SSO_CLIENT_ID=${Application_ID}` #client
+* `SSO_CLIENT_SECRET=${Secret_Value}`
 
 ## Rauthy