Setting up SSO with Microsoft Entra ID

Microsoft Entra ID (formerly Azure AD) is one of three identity providers iShared.app supports for single sign-on, alongside Okta and Google Workspace. This guide covers connecting Entra ID via OIDC and turning on SCIM so group assignment in Entra automatically manages accounts in your iShared.app organization.

You'll need Admin or Primary Owner access to your iShared.app organization, and permission to register applications in your Entra ID tenant (Application Administrator or Global Administrator).

Entra ID supports both OIDC and SAML 2.0 in iShared.app. This guide uses OIDC, since it's the simpler of the two to set up in Entra's app registration flow — if your organization standardizes on SAML instead, the same general steps apply with a SAML app registration and the SAML fields on the Settings card.

Step 1: Register an app in Entra ID

1. In the Entra admin center, go to Identity → Applications → App registrations and click New registration.
2. Give it a name (e.g. "iShared.app").
3. Under Supported account types, choose the option matching your organization (typically "Accounts in this organizational directory only").
4. Leave Redirect URI blank for now — you'll add it in Step 3.
5. Click Register.

Step 2: Get your issuer, client ID, and client secret

On the app's Overview page, note the Application (client) ID.

Your issuer URL is https://login.microsoftonline.com/<tenant-id>/v2.0, where <tenant-id> is your Directory (tenant) ID, also shown on the Overview page.

To create a client secret: go to Certificates & secrets → Client secrets → New client secret, give it a description and expiry, and click Add. Copy the secret value immediately — Entra only shows it once.

Step 3: Set the redirect URI

1. In iShared.app, go to Settings → Single sign-on.
2. Set Provider to Microsoft Entra ID and Protocol to OIDC.
3. The card shows the redirect URI in the form <API base>/auth/sso/oidc/callback — copy it.
4. Back in Entra, go to your app's Authentication page, click Add a platform → Web, and paste that URL into Redirect URIs. Save.

Step 4: Complete the connection in iShared.app

Back in Settings → Single sign-on, fill in:

• Issuer URL: https://login.microsoftonline.com/{tenant}/v2.0, with your actual tenant ID.
• Client ID: the Application (client) ID from Step 2.
• Client secret: the secret value from Step 2.

Check Enabled, then click Save.

As with the other providers, OIDC alone confirms identity — it doesn't create iShared.app accounts. Members need an existing invite or membership, or SCIM needs to be turned on, before their first sign-in will succeed.

Step 5: Turn on SCIM provisioning (recommended)

SCIM lets Entra ID push account creation, updates, and deactivation to iShared.app automatically, based on group membership.

1. In Settings → Single sign-on, scroll to SCIM provisioning and choose Microsoft Entra ID as the provider.
2. Click Generate token and copy the value — it's shown only once.
3. Note the SCIM base URL, in the form <API base>/scim/v2.
4. In the Entra admin center, go to your app's Provisioning page and set Provisioning Mode to Automatic.
5. Under Admin Credentials, set Tenant URL to the SCIM base URL and Secret Token to the token you generated. Click Test Connection.
6. Once the test succeeds, save, then assign the users or groups you want provisioned under the app's Users and groups page.
7. Turn Provisioning Status to On. Entra runs an initial sync and then checks for changes roughly every 40 minutes.

Accounts created via SCIM authenticate through SSO only — there's no password to manage or leak. Removing someone from the assigned group deactivates their iShared.app seat on the next sync, so licenses don't linger after someone leaves.

Requiring SSO org-wide

After confirming SSO works for a few accounts, return to Settings → Single sign-on and check Require SSO. This blocks password login for everyone except the primary owner, who retains password access as a fallback if your Entra tenant is ever unreachable. Enable this only once you've verified sign-in works, to avoid locking out anyone not yet provisioned.

Troubleshooting

Redirect URI mismatch error from Microsoft: the URI registered in Entra's Authentication page must match the one shown on the Settings card exactly, including the /auth/sso/oidc/callback path.

Sign-in succeeds but the user lands on an error page: this usually means the account isn't provisioned yet. Either invite the person from Team directly, or confirm SCIM provisioning has run for their group.

For Okta, see the Okta SSO guide. For Google Workspace, which uses just-in-time provisioning instead of SCIM, see the Google Workspace SSO guide.