# Connect Microsoft SSO

> Register your own app in Microsoft Entra, connect it to your organisation, and give access from Microsoft app roles.

Source: https://docs.bifrostorbit.com/orbit/admins/connect-microsoft-sso/

## Before you start

Your organisation uses its own app registration in Microsoft Entra. Bifröst Orbit keeps no Microsoft settings of its own, so nothing about your tenant is stored anywhere but your organisation's Sign-in settings.

## 1. Register an app in Microsoft Entra

Follow [Set up your Microsoft Entra app](https://docs.bifrostorbit.com/orbit/admins/set-up-entra-app/). It walks through the redirect URI, the client secret, the permissions to consent, app roles and who may sign in, with fixes for the errors you might meet.

## 2. Enter your app in Orbit

On the **Sign-in** tab, fill in:

| Field | Where to find it |
| --- | --- |
| **Tenant ID** | The Directory (tenant) ID on your app registration's Overview. |
| **Client ID** | The Application (client) ID on the same Overview. |
| **Client secret** | The secret's **Value** from your app's Certificates & secrets. It is stored encrypted and never shown again; only its last four characters are. |
| **Work email domains** | The domains your people's addresses use, such as `example.com`. People with these addresses are sent to your Microsoft sign-in. |

Choose **Save changes**. Each tenant, and each domain, can belong to only one organisation.

Client secrets expire. Before yours does, create a new one in Entra and paste it into **Client secret**; leaving the field blank keeps the saved one.

## 3. Choose who gets in

Under **Who gets in**:

- **Everyone in this tenant** lets in everyone Microsoft lets sign in to the app, with the role and satellites under **Everyone gets**. Nobody needs adding by hand. Who Microsoft lets in is controlled in Entra, with user assignment on the app.
- **Only people matching a rule** lets in only people whose app role or group matches a rule below.

## 4. Map roles

**Role mapping** lists the app roles from your Microsoft Entra app. For each, choose the role and satellites it gives. Rules can also match a group by its **Group ID**.

App roles come from Microsoft and cannot be deleted here. A role removed in Microsoft shows as **No longer in Microsoft**. Someone with several matching rules gets the highest role and every satellite those rules give.

## What happens next

- People enter their work email on the main sign-in page and go straight to your Microsoft sign-in, or choose **Sign in with Microsoft** on your sign-in address. They join your organisation with the mapped access.
- Taking a role away in Microsoft takes the access away at their next sign-in.
- **Add member** can list people from your Microsoft directory. See [Add and manage members](https://docs.bifrostorbit.com/orbit/admins/manage-members/).

Switching Microsoft SSO off keeps the connection but lets nobody in through it until it is on again.