Skip to content

Commit 580a198

Browse files
thilak009claude
thilak009
and
claude
committed
Document Microsoft Entra ID single sign-on
Add a guide for registering an app in the customer's Entra ID tenant and sending its credentials to base14, and link it from the SCIM provisioning guide. Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com>
1 parent c43c466 commit 580a198

2 files changed

Lines changed: 181 additions & 1 deletion

File tree

‎docs/operate/provision-users-entra-scim.md‎

Lines changed: 4 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -31,7 +31,8 @@ This integration provisions **users only**.
3131
- **Groups are not provisioned.** Entra ID groups do not become Scout Console
3232
roles, teams, or organizations.
3333
- **Sign-in is configured separately.** Provisioning creates and maintains
34-
accounts. It does not configure single sign-on.
34+
accounts. It does not configure single sign-on. See
35+
[Entra ID Single Sign-On](./sso-entra-id.md).
3536

3637
:::
3738

@@ -258,5 +259,7 @@ If provisioning still fails after working through the steps above,
258259

259260
## Related Guides
260261

262+
- [Entra ID Single Sign-On](./sso-entra-id.md) - Let provisioned users sign
263+
in with their Microsoft accounts
261264
- [User Management and Access Control](./user-management.md) - Assign roles
262265
and manage users in Scout Console

‎docs/operate/sso-entra-id.md‎

Lines changed: 177 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,177 @@
1+
---
2+
title: Sign In with Microsoft Entra ID
3+
sidebar_label: Entra ID Single Sign-On
4+
description: >-
5+
Let your users sign in to Scout Console with their Microsoft Entra ID
6+
accounts by registering an application in your own Entra ID tenant.
7+
keywords:
8+
- single sign-on
9+
- sso
10+
- microsoft entra id
11+
- azure ad sso
12+
- entra id app registration
13+
- scout console
14+
- identity management
15+
sidebar_position: 2.5
16+
---
17+
18+
## Overview
19+
20+
Connect your Microsoft Entra ID tenant to Scout Console so that your users sign
21+
in with their existing Microsoft work accounts.
22+
23+
You register an application in **your own** Entra ID tenant and send base14
24+
its credentials. base14 then enables Microsoft sign-in for your organization.
25+
Sign-in is limited to users of your tenant.
26+
27+
:::info What single sign-on does and doesn't do
28+
29+
- **Sign-in only.** Single sign-on authenticates users who already have a Scout
30+
Console account. It does not create accounts.
31+
- **Accounts come first.** Invite users in Scout Console, or provision them
32+
automatically with
33+
[Entra ID Provisioning](./provision-users-entra-scim.md).
34+
- **Roles are not synced.** Roles are managed in Scout Console. See
35+
[User Management](./user-management.md#changing-user-roles).
36+
37+
:::
38+
39+
## Prerequisites
40+
41+
- **The Application Administrator or Cloud Application Administrator role**
42+
in your Entra ID tenant.
43+
- **Your organization's redirect URI from base14.** Contact base14 Support to
44+
request it.
45+
- **Matching email addresses.** Each user's email address in Entra ID must
46+
match the email address on their Scout Console account.
47+
48+
Single sign-on works on every Entra ID tier, including the free tier.
49+
50+
## Step 1: Register the Application
51+
52+
1. Sign in to the [Microsoft Entra admin center](https://entra.microsoft.com).
53+
2. Go to **Identity** → **Applications** → **App registrations**.
54+
3. Select **New registration**.
55+
4. Enter a name, for example `base14 Scout SSO`.
56+
5. Under **Supported account types**, select
57+
**Accounts in this organizational directory only (Single tenant)**.
58+
6. Under **Redirect URI**, select the **Web** platform and paste the redirect
59+
URI that base14 provided.
60+
7. Select **Register**.
61+
62+
:::warning Use the Web platform
63+
64+
The redirect URI must be registered under the **Web** platform, not
65+
**Single-page application** or **Public client**. The URI must match the
66+
value base14 provided exactly.
67+
68+
:::
69+
70+
## Step 2: Create a Client Secret
71+
72+
1. In your new application, select **Certificates & secrets**.
73+
2. On the **Client secrets** tab, select **New client secret**.
74+
3. Enter a description and choose an expiry.
75+
4. Select **Add**.
76+
5. Copy the secret's **Value** immediately. Entra ID shows it only once.
77+
78+
:::note
79+
80+
Copy the **Value** column, not the **Secret ID**. The Secret ID is not the
81+
secret.
82+
83+
:::
84+
85+
## Step 3: Confirm API Permissions
86+
87+
1. Select **API permissions**.
88+
2. Confirm that **Microsoft Graph** → **User.Read** (Delegated) is listed. New
89+
registrations include it by default.
90+
3. If it is missing, select **Add a permission** → **Microsoft Graph** →
91+
**Delegated permissions**, add `User.Read`, and select **Add permissions**.
92+
93+
## Step 4: Send the Details to base14
94+
95+
Collect these values:
96+
97+
| Value | Where to find it |
98+
| --- | --- |
99+
| Application (client) ID | **Overview** → **Application (client) ID** |
100+
| Directory (tenant) ID | **Overview** → **Directory (tenant) ID** |
101+
| Client secret | The value you copied in [Step 2](#step-2-create-a-client-secret) |
102+
103+
Send them to base14 Support through a secure channel. Never send the client
104+
secret in plain email. base14 enables single sign-on for your organization and
105+
confirms when it is ready.
106+
107+
## Step 5: Test Sign-In
108+
109+
1. Open Scout Console in a private browser window.
110+
2. On the sign-in page, select **Microsoft**.
111+
3. Sign in with an Entra ID account whose email matches an existing Scout
112+
Console user.
113+
4. Confirm that you land in Scout Console as that user.
114+
115+
## Rotating the Client Secret
116+
117+
Entra ID client secrets expire. When a secret expires, Microsoft sign-in stops
118+
working for your organization.
119+
120+
Before the expiry date:
121+
122+
1. Create a new client secret as described in
123+
[Step 2](#step-2-create-a-client-secret).
124+
2. Send the new value to base14 Support.
125+
3. After base14 confirms the update, delete the old secret in Entra ID.
126+
127+
Set a reminder for the expiry date when you create each secret.
128+
129+
## Troubleshooting
130+
131+
### "AADSTS50011: The redirect URI ... does not match"
132+
133+
The redirect URI in your application does not exactly match the one Scout
134+
Console sends. Return to **Authentication** in your application and confirm
135+
the **Web** redirect URI matches the value base14 provided, character for
136+
character.
137+
138+
### "AADSTS7000215: Invalid client secret provided"
139+
140+
The client secret base14 has on file is wrong or has expired. Common causes:
141+
142+
- The **Secret ID** was sent instead of the **Value**.
143+
- The secret was truncated when copied.
144+
- The secret has passed its expiry date.
145+
146+
Create a new secret and send it to base14 Support.
147+
148+
### "AADSTS50020: User account ... does not exist in tenant"
149+
150+
The user is signing in with an account from a different Entra ID tenant.
151+
Sign-in is restricted to your tenant. The user must sign in with their account
152+
in your directory.
153+
154+
### Sign-in succeeds at Microsoft but Scout Console shows an error
155+
156+
No Scout Console account matches the user's email address. Single sign-on
157+
does not create accounts. Invite the user in Scout Console, or provision them
158+
with [Entra ID Provisioning](./provision-users-entra-scim.md). Then confirm that
159+
the email address on their Scout Console account matches their email in Entra
160+
ID.
161+
162+
## Getting Help
163+
164+
If sign-in still fails after working through the steps above,
165+
[contact the base14 team](mailto:support@base14.io) with:
166+
167+
- The full error text, including any `AADSTS` code.
168+
- The email address of an affected user.
169+
- The **Application (client) ID** of your app registration. Do not include the
170+
client secret.
171+
172+
## Related Guides
173+
174+
- [Entra ID Provisioning](./provision-users-entra-scim.md) - Create and
175+
disable Scout Console users automatically from Entra ID
176+
- [User Management and Access Control](./user-management.md) - Assign roles
177+
and manage users in Scout Console

0 commit comments

Comments
 (0)