Single Sign-On (Microsoft Entra ID)
Let your team sign in with their Microsoft account — set up, test and manage single sign-on with Microsoft Entra ID yourself, including automatic accounts for new colleagues.
With single sign-on (SSO), your colleagues sign in to referencedeck.com with their Microsoft work account instead of a separate password. Company admins set it up themselves: connect an app registration from your Microsoft Entra ID (formerly Azure AD) tenant, test the sign-in, and activate it — no support ticket needed.
Who can set it up
- Permission: company admins — anyone with Edit company settings (Team & Permissions).
- Plan: single sign-on is included in the Enterprise plans. Companies that already used SSO before self-service keep access, whatever their plan.
- Where: sidebar → Company settings → Single Sign-On (
/my/company/settings/sso). Without the plan feature, the page explains how to get it via Plan, Billing & Vouchers.
Set up single sign-on
Register an app in Microsoft Entra ID
In the Microsoft Entra admin center, create an app registration for referencedeck.com (single tenant). Add the Redirect URI shown on the Single Sign-On page as a Web redirect URI — use the copy button to avoid typos. The app needs the delegated Microsoft Graph permission User.Read (sign in and read the user profile).
Create a client secret
Under Certificates & secrets, create a client secret and copy its value right away — Microsoft shows it only once. Note its expiry date.
Enter the app details
On the Single Sign-On page, enter the Directory (tenant) ID, the Application (client) ID, the client secret and, optionally, the date until which the secret is valid.
Test the sign-in
Click Test sign-in. You are redirected to Microsoft, sign in with your work account and come straight back. The test signs nobody in — it shows which Microsoft account answered and what a real sign-in would do (for example connect your existing account or create a new account). If Microsoft rejects the sign-in, the page shows Microsoft's error message (e.g. an invalid client secret).
Save and activate
After a successful test, switch on Single sign-on active and Save. Share the sign-in link shown on the page with your team — it starts the Microsoft sign-in directly. After a first Microsoft sign-in, the login page also shows Sign in with Microsoft.
Single sign-on can only be activated with credentials that have been tested successfully. The same applies when you change the tenant ID, the application ID or the secret of an active configuration — test first, then save. This prevents a typo from locking out your whole team.
The tenant ID must be the ID of your directory. Generic values such as common or organizations are rejected — they would let any Microsoft account in the world sign in.
How colleagues are matched
When someone signs in with Microsoft, referencedeck.com looks for their account in your team:
- Already connected — the Microsoft account was used before: the member is signed in.
- Same e-mail address — a team member with the same e-mail address is connected to the Microsoft account and receives a short notification e-mail about it.
- New colleague — if Unknown Microsoft users are created automatically is switched on, a new account is created in your team on the first sign-in.
For security reasons, an existing account is not connected automatically if it also belongs to another company, or if the e-mail address belongs to an account outside your team. These colleagues sign in with their e-mail address and password, or contact support.
Automatic accounts and default roles
Switch on Unknown Microsoft users are created automatically and choose the roles new colleagues receive on their first sign-in — the same roles you can assign in Team & Permissions. Company admin rights can't be granted automatically.
Members with roles occupy a user seat of your plan. When all seats are taken, new colleagues are still created — but without roles — and the company admins are notified, so you can free a seat or upgrade.
Client secret expiry
Microsoft client secrets expire (at most after 24 months). If you enter the valid until date, the page warns you 30 days ahead, and company admins receive reminder e-mails 30 and 7 days before the secret expires. To renew, create a new secret in Entra ID, click Replace secret, test the sign-in and save. The stored secret is never shown again — only its last four characters, so you can match it with the list in Entra ID.
Deactivate or remove
- Deactivate: switch off Single sign-on active and save. The configuration is kept; members sign in with their e-mail address and password. You can reactivate it later.
- Remove: Remove configuration deletes the SSO settings, the default roles and all connections to Microsoft accounts. Members who never set a password use Forgot password to get one.
If your company uses single sign-on from before self-service and your current plan doesn't include it, removing the configuration also removes your access to the Single Sign-On page — you can't set it up again yourself.
Transparency
Every change to the configuration — and every test — is recorded, and all company admins receive an e-mail when the configuration changes (who changed what and when; never the secret). If you didn't expect such a change, review the settings and contact support.