docs: correct Entra OIDC values in SSO setup

content/manuals/security/authentication/single-sign-on/connect.md

@@ -117,15 +117,34 @@ hours. Docker automatically checks for the record during this time.
 
 1. From [app.docker.com](https://app.docker.com), choose your organization.
 1. Select **Identity & auth**, then **SSO and SCIM**.
-1. Select **Create Connection**. Name the connection, then choose **SAML 2.0**.
-1. Keep this window open. You need to copy and paste these values in your IdP
-   window:
-   - **Entity ID**
-   - **ACS URL**
-   - **Connection ID**
+1. Select **Create Connection** and name the connection.
 
-You will return here to finish connecting after creating an SSO connection in
-your IdP.
+The dialog offers two connection types. Select the type that matches the
+identity provider tab you use in the next step.
+
+{{< tabs >}}
+{{< tab name="SAML 2.0" >}}
+
+Use this type for the Okta SAML and Entra ID SAML 2.0 tabs.
+
+1. Select **SAML 2.0**.
+1. Copy **Entity ID**, **ACS URL**, and **Connection ID**. For SAML
+   configuration, paste these values into your identity provider.
+
+{{< /tab >}}
+{{< tab name="Azure AD (OIDC)" >}}
+
+Use this type for the Azure OpenID Connect (OIDC) tab.
+
+1. Select **Azure AD (OIDC)**.
+1. Copy **Redirect URI**. For Azure AD configuration, paste the Redirect
+   URI, also called the **Reply URL**, into your identity provider.
+
+{{< /tab >}}
+{{< /tabs >}}
+
+Keep this window open. You will return here to finish connecting after
+creating an SSO connection in your IdP.
 
 ### Step 4: Create an SSO connection in your IdP
 
@@ -192,13 +211,25 @@ permissions.
 1. Name the application "Docker".
 1. Set account types and paste the **Redirect URI** from Docker.
 1. Select **Register**.
-1. Copy the **Client ID**.
+1. On the app registration **Overview** page, copy **Application (client)
+   ID**. This value is the Docker **Client ID**.
 
 #### Create client secrets
 
 1. In your app, go to **Certificates & secrets**.
 1. Select **New client secret**, describe and configure duration, then **Add**.
-1. Copy the **value** of the new secret.
+1. Copy the secret **Value**, not the **Secret ID**. The **Value** is the
+   Docker **Client Secret**.
+
+   **Value** is the secret string Entra generated. Docker uses it when someone
+   signs in with this connection. Entra shows the **Value** on this screen
+   only. If you leave the page or refresh it, the column is blank. Create a
+   new secret and copy its **Value** before you leave.
+
+   **Secret ID** is the identifier for that row. It stays visible so you can
+   tell two secrets apart, see which secret is about to expire, or delete a
+   specific one. Entra does not accept the **Secret ID** as the **Client
+   Secret**.
 
 #### Set API permissions
 
@@ -251,8 +282,8 @@ Complete the integration by pasting your IdP values into Docker.
 
 1. Return to Docker Home.
 1. Paste the following values:
-   - **Client ID**
-   - **Client Secret**
+   - **Client ID**: the **Application (client) ID** you copied
+   - **Client Secret**: the secret **Value** you copied
    - **Azure AD Domain**
 1. Optional. Select a default team, if required by your org.
 1. Review and select **Create connection**.

content/manuals/security/authentication/single-sign-on/troubleshoot-sso.md

@@ -7,7 +7,7 @@ description: >-
 weight: 40
 keywords: sso troubleshooting, single sign-on errors, authentication issues,
   identity provider problems, JIT provisioning, SCIM errors, domain
-  verification
+  verification, AADSTS700016
 tags: [Troubleshooting]
 toc_max: 2
 aliases:
@@ -297,3 +297,43 @@ In your IdP, ensure the Name ID attribute format is correct:
 1. Verify that the Name ID attribute format in your IdP is set to
    `EmailAddress`.
 1. Adjust your IdP settings to return the correct Name ID format.
+
+## Application was not found in the directory
+
+### Error message
+
+During Azure AD (OIDC) sign-in, Microsoft Entra can return:
+
+```text
+AADSTS700016: Application with identifier '{identifier}' was not found in the directory '{directory}'.
+```
+
+### Causes
+
+The **Client ID** on the Docker SSO connection is not the **Application
+(client) ID** from the app registration **Overview** page. Pasting the
+**Secret ID** into **Client ID** makes Entra search for an application that
+does not exist.
+
+Entra also returns this error when the sign-in request goes to a directory
+that does not contain the app registration.
+
+### Solutions
+
+Replace the application identifier in Docker:
+
+1. In the [Microsoft Entra admin center](https://entra.microsoft.com/), open
+   the app registration.
+1. On the **Overview** page, copy **Application (client) ID**.
+1. Sign in to [Docker Home](https://app.docker.com/) and select your
+   organization.
+1. Select **Identity & auth**, then **SSO and SCIM**.
+1. In the SSO connections table, select the **Action** menu, then **Edit
+   connection**.
+1. Paste **Application (client) ID** into **Client ID**. The **Secret ID**
+   and the secret **Value** are not application identifiers.
+
+If the directory named in the error is not the tenant where you registered
+the app, update **Azure AD Domain** on the Docker connection so sign-in uses
+that tenant. For the connection steps, see
+[Set up single sign-on](/manuals/security/authentication/single-sign-on/connect.md).