diff --git a/contrib/chart/backstage/files/app-config.local.yaml.tpl b/contrib/chart/backstage/files/app-config.local.yaml.tpl
index 7fdfeb79a8..857e9ecafe 100644
--- a/contrib/chart/backstage/files/app-config.local.yaml.tpl
+++ b/contrib/chart/backstage/files/app-config.local.yaml.tpl
@@ -1,6 +1,7 @@
 backend:
   lighthouseHostname: {{ include "lighthouse.serviceName" . | quote }}
-  listen: {{ .Values.appConfig.backend.listen | quote }}
+  listen:
+      port: {{ .Values.appConfig.backend.listen.port | default 7000 }}
   cors:
     origin: {{ .Values.appConfig.backend.cors.origin | quote }}
   database:
@@ -35,38 +36,10 @@ catalog:
 sentry:
   organization: {{ .Values.appConfig.sentry.organization | quote }}
 
-auth:
-  providers:
-    github:
-      development:
-        clientId: {{ .Values.auth.github.clientId }}
-        appOrigin: {{ .Values.appConfig.auth.providers.github.development.appOrigin | quote }}
-    google:
-      development:
-        clientId: {{ .Values.auth.google.clientId }}
-        appOrigin: {{ .Values.appConfig.auth.providers.google.development.appOrigin | quote }}
-    gitlab:
-      development:
-        clientId: {{ .Values.auth.gitlab.clientId }}
-        appOrigin: {{ .Values.appConfig.auth.providers.gitlab.development.appOrigin | quote }}
-        audience: {{ .Values.auth.gitlab.baseUrl }}
-    okta:
-      development:
-        clientId: {{ .Values.auth.okta.clientId }}
-        audience: {{ .Values.auth.okta.audience }}
-        appOrigin: {{ .Values.appConfig.auth.providers.okta.development.appOrigin | quote }}
-    oauth2:
-      development:
-        clientId: {{ .Values.auth.oauth2.clientId }}
-        tokenUrl: {{ .Values.auth.oauth2.tokenUrl }}
-        appOrigin: {{ .Values.appConfig.auth.providers.oauth2.development.appOrigin | quote }}
-    auth0:
-      development:
-        clientId: {{ .Values.auth.auth0.clientId }}
-    microsoft:
-      development:
-        clientId: {{ .Values.auth.microsoft.clientId }}
-        tenantId: {{ .Values.auth.microsoft.tenantId }}
 
 lighthouse:
   baseUrl: {{ .Values.appConfig.lighthouse.baseUrl | quote }}
+
+scaffolder:
+  azure:
+    baseUrl: https://dev.azure.com/some-org
diff --git a/contrib/chart/backstage/files/create-backend-dbs.sql b/contrib/chart/backstage/files/create-backend-dbs.sql
index e8124dbd22..7902b15b6d 100644
--- a/contrib/chart/backstage/files/create-backend-dbs.sql
+++ b/contrib/chart/backstage/files/create-backend-dbs.sql
@@ -5,7 +5,10 @@
 create database {{ $backendDb }};
 grant all privileges on database {{ $backendDb }} to {{ $user }};
 
+create database backstage_plugin_auth;
+grant all privileges on database backstage_plugin_auth to {{ $user }};
+
 {{ if not (eq $backendDb $lighthouseDb) }}
 create database {{ $lighthouseDb }};
 grant all privileges on database {{ $lighthouseDb }} to {{ $user }};
-{{ end }}
\ No newline at end of file
+{{ end }}
diff --git a/contrib/chart/backstage/templates/backend-deployment.yaml b/contrib/chart/backstage/templates/backend-deployment.yaml
index 9c6e8da67c..c57764db8e 100644
--- a/contrib/chart/backstage/templates/backend-deployment.yaml
+++ b/contrib/chart/backstage/templates/backend-deployment.yaml
@@ -34,8 +34,12 @@ spec:
                 name: {{ include "backstage.fullname" . }}-backend
             - configMapRef:
                 name: {{ include "backstage.fullname" . }}-app-env
+            - configMapRef:
+                name: {{ include "backstage.fullname" . }}-auth
           env:
-            - name: APP_CONFIG_backend_postgresPassword
+            - name: NODE_ENV
+              value: {{ .Values.backend.nodeEnv | default "development" }}
+            - name: APP_CONFIG_backend_database_connection_password
               valueFrom:
                 secretKeyRef:
                   name: {{ include "backend.postgresql.passwordSecret" .}}
diff --git a/contrib/chart/backstage/templates/backend-secret.yaml b/contrib/chart/backstage/templates/backend-secret.yaml
index 3acb220d81..ab8fff00ec 100644
--- a/contrib/chart/backstage/templates/backend-secret.yaml
+++ b/contrib/chart/backstage/templates/backend-secret.yaml
@@ -17,4 +17,5 @@ stringData:
   CIRCLECI_AUTH_TOKEN: {{ .Values.auth.circleciAuthToken }}
   GITHUB_ACCESS_TOKEN: {{ .Values.auth.githubAccessToken }}
   GITLAB_ACCESS_TOKEN: {{ .Values.auth.gitlabAccessToken }}
+  AZURE_PRIVATE_TOKEN: {{ .Values.auth.azure.api.token }}
 {{- end }}
diff --git a/contrib/chart/backstage/templates/backstage-app-config.yaml b/contrib/chart/backstage/templates/backstage-app-config.yaml
index a75fc8108d..e419e5d14a 100644
--- a/contrib/chart/backstage/templates/backstage-app-config.yaml
+++ b/contrib/chart/backstage/templates/backstage-app-config.yaml
@@ -17,3 +17,10 @@ data:
   APP_CONFIG_techdocs_storageUrl: {{ .Values.appConfig.techdocs.storageUrl | quote | quote }}
   APP_CONFIG_techdocs_requestUrl: {{ .Values.appConfig.techdocs.requestUrl | quote | quote }}
   APP_CONFIG_lighthouse_baseUrl: {{ .Values.appConfig.lighthouse.baseUrl | quote | quote }}
+  APP_CONFIG_backend_database_connection_ssl_rejectUnauthorized: "false"
+  APP_CONFIG_auth_providers_github_development_appOrigin: {{ .Values.appConfig.auth.providers.github.development.appOrigin | quote | quote }}
+  APP_CONFIG_auth_providers_google_development_appOrigin: {{ .Values.appConfig.auth.providers.google.development.appOrigin | quote | quote }}
+  APP_CONFIG_auth_providers_gitlab_development_appOrigin: {{ .Values.appConfig.auth.providers.gitlab.development.appOrigin | quote | quote }}
+  APP_CONFIG_auth_providers_okta_development_appOrigin: {{ .Values.appConfig.auth.providers.okta.development.appOrigin | quote | quote }}
+  APP_CONFIG_auth_providers_oauth2_development_appOrigin: {{ .Values.appConfig.auth.providers.oauth2.development.appOrigin | quote | quote }}
+
diff --git a/contrib/chart/backstage/templates/backstage-auth-config.yaml b/contrib/chart/backstage/templates/backstage-auth-config.yaml
new file mode 100644
index 0000000000..7dcf8379aa
--- /dev/null
+++ b/contrib/chart/backstage/templates/backstage-auth-config.yaml
@@ -0,0 +1,21 @@
+apiVersion: v1
+kind: ConfigMap
+metadata:
+  name: {{ include "backstage.fullname" . }}-auth
+data:
+  AUTH_GOOGLE_CLIENT_ID: {{ .Values.auth.google.clientId }}
+  AUTH_GITHUB_CLIENT_ID: {{ .Values.auth.github.clientId }}
+  AUTH_GITLAB_CLIENT_ID: {{ .Values.auth.gitlab.clientId }}
+  # This should not be prefixed with AUTH_. This could be a typo in the Backstage app config.
+  # Regardless, it is not decided by me.
+  GITLAB_BASE_URL: {{ .Values.auth.gitlab.baseUrl }}
+  AUTH_OKTA_CLIENT_ID: {{ .Values.auth.okta.clientId }}
+  AUTH_OKTA_AUDIENCE: {{ .Values.auth.okta.audience }}
+  AUTH_OAUTH2_CLIENT_ID: {{ .Values.auth.oauth2.clientId }}
+  AUTH_OAUTH2_AUTH_URL: {{ .Values.auth.oauth2.authUrl }}
+  AUTH_OAUTH2_TOKEN_URL: {{ .Values.auth.oauth2.tokenUrl }}
+  AUTH_AUTH0_CLIENT_ID: {{ .Values.auth.auth0.clientId }}
+  AUTH_AUTH0_DOMAIN: {{ .Values.auth.auth0.domain }}
+  AUTH_MICROSOFT_CLIENT_ID: {{ .Values.auth.microsoft.clientId }}
+  AUTH_MICROSOFT_TENANT_ID: {{ .Values.auth.microsoft.tenantId }}
+
diff --git a/contrib/chart/backstage/templates/ingress.yaml b/contrib/chart/backstage/templates/ingress.yaml
index 6996bb5d8d..a4a3c0ff00 100644
--- a/contrib/chart/backstage/templates/ingress.yaml
+++ b/contrib/chart/backstage/templates/ingress.yaml
@@ -1,37 +1,21 @@
 apiVersion: networking.k8s.io/v1beta1
 kind: Ingress
 metadata:
-  name: {{ include "backstage.fullname" . }}-ingress-backend
+  name: {{ include "backstage.fullname" . }}-ingress
   {{- with .Values.ingress.annotations }}
   annotations:
-    nginx.ingress.kubernetes.io/rewrite-target: /$2
   {{- toYaml . | nindent 4 }}
   {{- end }}
 spec:
   rules:
   - http:
       paths:
-      - backend:
+      - path: /api
+        backend:
           serviceName: {{ include "backend.serviceName" . }}
           servicePort: 80
-        path: /api(/|$)(.*)
----
-# Having rewrite rules in an ingress with a '/' path results in an error when loading the
-# site "Unexpected token: <". That's why we need two ingress resources
-# See https://stackoverflow.com/questions/59931177/gke-install-nginx-ingress-with-static-ip-and-fanout
-apiVersion: networking.k8s.io/v1beta1
-kind: Ingress
-metadata:
-  name: {{ include "backstage.fullname" . }}-ingress-frontend
-  {{- with .Values.ingress.annotations }}
-  annotations:
-  {{- toYaml . | nindent 4 }}
-  {{- end }}
-spec:
-  rules:
-  - http:
-      paths:
-      - backend:
+      - path: /
+        backend:
           serviceName: {{ include "frontend.serviceName" . }}
           servicePort: 80
-        path: /
+
diff --git a/contrib/chart/backstage/values.yaml b/contrib/chart/backstage/values.yaml
index 64cf5e91be..9616efe58d 100644
--- a/contrib/chart/backstage/values.yaml
+++ b/contrib/chart/backstage/values.yaml
@@ -6,8 +6,8 @@ frontend:
   enabled: true
   replicaCount: 1
   image:
-    repository: roadiehq/backstage-k8s-demo-frontend
-    tag: latest
+    repository: martinaif/backstage-k8s-demo-frontend
+    tag: test1
     pullPolicy: IfNotPresent
   containerPort: 80
   resources:
@@ -18,10 +18,11 @@ frontend:
 
 backend:
   enabled: true
+  nodeEnv: development
   replicaCount: 1
   image:
-    repository: roadiehq/backstage-k8s-demo-backend
-    tag: latest
+    repository: martinaif/backstage-k8s-demo-backend
+    tag: test1
     pullPolicy: IfNotPresent
   containerPort: 7000
   resources:
@@ -81,20 +82,21 @@ appConfig:
     baseUrl: https://demo.example.com
     title: Backstage
   backend:
-    baseUrl: /api
-    listen: 0.0.0.0:7000
+    baseUrl: https://demo.example.com
+    listen:
+      port: 7000
     cors:
       origin: https://demo.example.com
     database:
       client: pg
       connection:
-        database: backend
+        database: backstage_plugin_catalog
         host:
         user:
         port:
         password:
         ssl:
-          rejectUnauthorized: false
+          rejectUnauthorized: true
           ca:
   sentry:
     organization: spotify
@@ -116,7 +118,7 @@ appConfig:
     providers:
       google:
         development:
-          appOrigin: 'http://localhost:3000/'
+          appOrigin: "http://localhost:3000/"
           secure: false
           clientId:
             $secret:
@@ -126,7 +128,7 @@ appConfig:
               env: AUTH_GOOGLE_CLIENT_SECRET
       github:
         development:
-          appOrigin: 'http://localhost:3000/'
+          appOrigin: "http://localhost:3000/"
           secure: false
           clientId:
             $secret:
@@ -139,7 +141,7 @@ appConfig:
               env: AUTH_GITHUB_ENTERPRISE_INSTANCE_URL
       gitlab:
         development:
-          appOrigin: 'http://localhost:3000/'
+          appOrigin: "http://localhost:3000/"
           secure: false
           clientId:
             $secret:
@@ -152,7 +154,7 @@ appConfig:
               env: GITLAB_BASE_URL
       okta:
         development:
-          appOrigin: 'http://localhost:3000/'
+          appOrigin: "http://localhost:3000/"
           secure: false
           clientId:
             $secret:
@@ -165,7 +167,7 @@ appConfig:
               env: AUTH_OKTA_AUDIENCE
       oauth2:
         development:
-          appOrigin: 'http://localhost:3000/'
+          appOrigin: "http://localhost:3000/"
           secure: false
           clientId:
             $secret:
@@ -230,6 +232,9 @@ auth:
     clientId: f
     clientSecret: f
     tenantId: f
+  azure:
+    api:
+      token: h
   sentryToken: e
   rollbarAccountToken: f
   # This is a 'Personal Access Token'