Connect Microsoft Entra ID as your identity provider

This connects autociso to your Entra ID app registration, so your conditional-access policies apply and disabling an account in Entra stops that person signing in to autociso.

Requires the Growth or Scale plan, and the Owner role in autociso.

Before you start

You need permission to create an app registration in your Entra tenant (Application Administrator or Global Administrator).

You will need your Directory (tenant) ID, which you can read from Microsoft Entra admin center → Overview.

1. Register the application in Entra ID

1. Open the Microsoft Entra admin center.
2. Go to Identity → Applications → App registrations → New registration.
3. Name it something recognisable, for example autociso.
4. Supported account types: Accounts in this organizational directory only unless you have a specific reason to widen it.
5. Under Redirect URI, choose platform Web and enter exactly: https://auth.autociso.io/idps/callback
6. Select Register.
7. From the Overview page copy the Application (client) ID and the Directory (tenant) ID.

2. Create a client secret

1. In the app registration, go to Certificates & secrets → Client secrets → New client secret.
2. Give it a description and an expiry that matches your rotation policy.
3. Copy the Value immediately — Entra shows it only once.

Set yourself a reminder before the expiry date. When the secret expires, sign-in stops working; you fix it by editing the connection in autociso with a fresh secret.

3. Check the permissions

Under API permissions, the default User.Read delegated permission is enough. autociso reads the signed-in user’s identity and nothing else.

4. Create the connection in autociso

1. Go to Organization → Sign-In Policy.
2. In the Single Sign-On section choose Microsoft Entra ID.
3. Enter:
   • Client ID — the Application (client) ID from step 1
   • Client secret — the Value from step 2
   • Directory (tenant) ID — from step 1
4. Name the connection, for example Acme Entra ID.
5. Decide on Create accounts automatically on first sign-in. Off is safer for a first rollout; on means anyone in your directory who reaches autociso gets an account at the role you choose.
6. Select Save, then Test connection.

On success the status becomes Active.

5. Offer it to your team

1. In Allowed Providers, select your new connection, keeping Email / Password selected for now.
2. Select Save.
3. Sign out and sign in through your organization’s sign-in link — the copyable link on the same page — to confirm it works end to end.

Once you and at least one other Owner have signed in successfully, you can deselect Email / Password to make Entra the only way in.

Troubleshooting

“AADSTS50011: redirect URI mismatch” — the redirect URI in the app registration is not exactly https://auth.autociso.io/idps/callback. Check for a trailing slash or http.

Sign-in worked yesterday and fails today — check whether the client secret expired. Edit the connection in autociso and paste a new one; leaving the field blank keeps the old (expired) secret.

People outside a conditional-access group cannot sign in — that is your Entra policy working as configured, and autociso reports it as a failed sign-in rather than a configuration error.