Guides
Connect Microsoft SSO
Register your own app in Microsoft Entra, connect it to your organisation, and give access from Microsoft app roles.
How-to guide2 min read
Before you start
Your organisation uses its own app registration in Microsoft Entra. Bifröst Orbit keeps no Microsoft settings of its own, so nothing about your tenant is stored anywhere but your organisation's Sign-in settings.
1Register an app in Microsoft Entra
Follow Set up your Microsoft Entra app. It walks through the redirect URI, the client secret, the permissions to consent, app roles and who may sign in, with fixes for the errors you might meet.
2Enter your app in Orbit
On the Sign-in tab, fill in:
example.com. People with these addresses are sent to your Microsoft sign-in.| Field | Where to find it |
|---|---|
| Tenant ID | The Directory (tenant) ID on your app registration's Overview. |
| Client ID | The Application (client) ID on the same Overview. |
| Client secret | The secret's Value from your app's Certificates & secrets. It is stored encrypted and never shown again; only its last four characters are. |
| Work email domains | The domains your people's addresses use, such as example.com. People with these addresses are sent to your Microsoft sign-in. |
Choose Save changes. Each tenant, and each domain, can belong to only one organisation.
Client secrets expire. Before yours does, create a new one in Entra and paste it into Client secret; leaving the field blank keeps the saved one.
3Choose who gets in
Under Who gets in:
- Everyone in this tenant lets in everyone Microsoft lets sign in to the app, with the role and satellites under Everyone gets. Nobody needs adding by hand. Who Microsoft lets in is controlled in Entra, with user assignment on the app.
- Only people matching a rule lets in only people whose app role or group matches a rule below.
4Map roles
Role mapping lists the app roles from your Microsoft Entra app. For each, choose the role and satellites it gives. Rules can also match a group by its Group ID.
App roles come from Microsoft and cannot be deleted here. A role removed in Microsoft shows as No longer in Microsoft. Someone with several matching rules gets the highest role and every satellite those rules give.
What happens next
- People enter their work email on the main sign-in page and go straight to your Microsoft sign-in, or choose Sign in with Microsoft on your sign-in address. They join your organisation with the mapped access.
- Taking a role away in Microsoft takes the access away at their next sign-in.
- Add member can list people from your Microsoft directory. See Add and manage members.
Switching Microsoft SSO off keeps the connection but lets nobody in through it until it is on again.
Was this page helpful?