# Connect Microsoft Entra ID as your identity provider
URL: https://docs.autociso.io/product/sso/microsoft-entra-id/
Description: Register an app in Microsoft Entra ID and connect it to AutoCISO so your team signs in with their Microsoft work accounts.

This connects AutoCISO to **your** Entra ID app registration, so your
conditional-access policies apply and disabling an account in Entra stops that
person signing in to AutoCISO.

Requires [The Growth plan or higher](https://docs.autociso.io/getting-started/plans-and-features/) and the [**Owner** role](https://docs.autociso.io/getting-started/roles-and-permissions/) in AutoCISO. The sign-in settings used here are explained in [Single Sign-On](https://docs.autociso.io/product/sso/overview/).

## Before you start

You need permission to create an app registration in your Entra tenant
(Application Administrator or Global Administrator).

You will need your **Directory (tenant) ID**, which you can read from
**Microsoft Entra admin center → Overview**.

Prefer SAML? Entra also works as a [SAML 2.0 provider](https://docs.autociso.io/product/sso/saml/), but OIDC is shorter to set up.

Corporate Entra connections trust the email address supplied by your configured tenant, so users do not need a separate email verification code. Your tenant administrators control which accounts, including guests, may sign in. Keep invitations and directory email addresses aligned. Any configured multifactor authentication requirements still apply.

## 1. Register the application in Entra ID

1. Open the [Microsoft Entra admin center](https://entra.microsoft.com/).
2. Go to **Identity → Applications → App registrations → New registration**.
3. Name it something recognisable, for example `AutoCISO`.
4. Supported account types: **Accounts in this organizational directory only**
   unless you have a specific reason to widen it.
5. Under **Redirect URI**, choose platform **Web** and enter exactly:
   `https://auth.autociso.io/ui/login/login/externalidp/callback`
6. Select **Register**.
7. From the **Overview** page copy the **Application (client) ID** and the
   **Directory (tenant) ID**.

## 2. Create a client secret

1. In the app registration, go to **Certificates & secrets → Client secrets →
   New client secret**.
2. Give it a description and an expiry that matches your rotation policy.
3. Copy the **Value** immediately — Entra shows it only once.

Set yourself a reminder before the expiry date. When the secret expires, sign-in
stops working; you fix it by editing the connection in AutoCISO with a fresh
secret.

## 3. Check the permissions

Under **API permissions**, the default `User.Read` delegated permission is
enough. AutoCISO reads the signed-in user's identity and nothing else.

## 4. Create the connection in AutoCISO

1. Go to **user menu → [Organization Settings](https://docs.autociso.io/console/settings/organization/) → Sign-In Policy**.
2. In the **Single Sign-On** section choose **Microsoft Entra ID**.
3. Enter:
   - **Client ID** — the Application (client) ID from step 1
   - **Client secret** — the Value from step 2
   - **Directory (tenant) ID** — from step 1
4. Name the connection, for example `Acme Entra ID`.
5. Decide on **Create accounts automatically on first sign-in**. Off is safer
   for a first rollout; on means anyone in your directory who reaches AutoCISO
   gets an account at the role you choose.
6. Select **Save**, then **Test connection**.

On success the status becomes **Active**.

## 5. Offer it to your team

1. In **Allowed Providers**, select your new connection, keeping
   **Email / Password** selected for now.
2. Select **Save**.
3. Sign out and sign in through your organization's sign-in link — the copyable
   link on the same page — to confirm it works end to end.

Once you and at least one other Owner have signed in successfully, you can
deselect **Email / Password** to make Entra the only way in. If you lock yourself out, see [Single Sign-On](https://docs.autociso.io/product/sso/overview/#if-you-lock-yourself-out).

## Troubleshooting

**"AADSTS50011: redirect URI mismatch"** — the redirect URI in the app
registration is not exactly `https://auth.autociso.io/ui/login/login/externalidp/callback`. Check for
a trailing slash or `http`.

**Sign-in worked yesterday and fails today** — check whether the client secret
expired. Edit the connection in AutoCISO and paste a new one; leaving the field
blank keeps the old (expired) secret.

**People outside a conditional-access group cannot sign in** — that is your
Entra policy working as configured, and AutoCISO reports it as a failed sign-in
rather than a configuration error.