SSO

Settings → SSO & provisioning is where your organisation connects Microsoft Entra ID so staff sign in with their work email — see SSO end to end for the full setup walkthrough.

What it is

This card collects an Entra ID app registration’s Application (client) ID and Issuer, plus an optional Client secret, and is intended to enable sign-in for anyone in your directory once saved. It’s an Enterprise-plan feature.

Before you start

SSO requires the Enterprise plan and organisation-admin access to Settings, a level higher than most other Settings sections.

How to do it

1. In Microsoft Entra ID, create an app registration (Web platform). The screen shows you the exact redirect URI to register — copy it from there rather than from memory, because it is the domain sign-in is actually served from.
2. Open Settings → SSO & provisioning.
3. Enter your Email domain — the domain your staff’s work email addresses end in, without the @ (for example acme-housing.org.uk). This is how sign-in recognises which organisation someone belongs to, so it can be claimed by only one organisation.
4. Enter the Application (client) ID and Issuer from that app registration, and the Client secret if you want the auth-code flow rather than an implicit ID-token flow.
5. Click Enable SSO (or Update SSO if a connection already exists). The connection’s sign-in code is shown once it succeeds.

How it integrates

Once connected, joiners and leavers are meant to follow your own Entra ID directory rather than a separate invite list here — see SCIM provisioning for automating that directory sync itself, which runs alongside SSO in the same settings section. An admin can still revoke any individual user’s sessions directly from Members, regardless of how they signed in.

Common problems

• “That email domain is registered to another organisation.” A domain is the key sign-in uses to route someone to the right organisation, so only one organisation can hold it. If you believe the claim is yours, contact support rather than trying a variant of the domain — a near-miss domain will not match your users’ email addresses at sign-in.
• The whole section shows an upgrade notice instead of the form. SSO is an Enterprise-plan feature — every other Settings section is unaffected below that tier.
• A user still can’t sign in after a connection was configured. Confirm they’re assigned to the app registration in Entra ID, and that their email matches the domain the connection was set up for.