Single sign-on with Microsoft Entra ID

This guide follows Microsoft's documented v2.0 endpoints and the console's Microsoft Entra ID preset. It has not yet been verified end to end against a live Entra ID tenant, unlike the Okta guide; use the console's Test sign-in, which shows exactly what Entra sends before anything is saved, and tell us what you find.

Terms used here: the host is your Linux server running ShakerScan Enterprise at its public address, https://scanner.example.com in the examples.

Step 1: register the application

1. In the Entra admin center open Identity → Applications → App registrations and choose New registration.
2. Name it ShakerScan Enterprise. Supported account types: Accounts in this organizational directory only (single tenant).
3. Redirect URI: platform Web, value exactly https://scanner.example.com/_enterprise/oidc/callback. Register.
4. On Overview note the Application (client) ID and the Directory (tenant) ID.
5. Under Certificates & secrets create a client secret and copy its value (not its id).

Step 2: put groups and the sign-in time into the ID token

1. Under Token configuration choose Add groups claim, tick Security groups, and for the ID token keep Group ID. Entra sends group object ids (GUIDs), not names, so the role mapping in step 3 uses those ids.
2. Still under Token configuration, choose Add optional claim, token type ID, and add auth_time. ShakerScan needs it to confirm that a person really signed in again when they re-authenticate for a decision; without it every re-authentication is refused.
3. A person in more than 200 groups receives no groups claim at all (Entra's overage rule). If that applies, assign the application to the relevant groups (Enterprise applications → the app → Properties, assignment required) and emit Groups assigned to the application instead.

Step 3: configure ShakerScan in the console

Sign in to the console as an administrator, open Settings → Single sign-on, and choose Microsoft Entra ID as the identity provider. The preset fills the scopes (openid profile email), the groups claim (groups) and client authentication (client_secret_post).

• Issuer URL: https://login.microsoftonline.com/<directory-tenant-id>/v2.0. The common and organizations addresses are not a single issuer and are refused.
• Client ID and client secret from step 1.
• Who may sign in: one row per group object id (for example 5b1f…-… → Administrator).

Choose Test sign-in. You go to Entra and back, and the console shows the subject, the groups Entra sent and the role the person would get. Save and turn on only when that is right.

Requiring single sign-on

Once single sign-on works, Settings → Who may sign in locally can require it for everyone, keeping one local break-glass administrator (with a passkey or an authenticator app) for when Entra is unavailable. See the security overview for the rules.

Troubleshooting