Sign in with Microsoft Entra ID
Connect your own Entra ID app registration to aethercert so your team signs in with their work account and is provisioned into your organization automatically.
With Entra ID single sign-on, your team signs in to aethercert with the Microsoft work account they already have. You register the application in your own tenant, so access, Conditional Access policies and MFA all stay under your control - aethercert never sees more than the identity your tenant hands it.
Whoever you allow into the application gets in, and is added to your aethercert organization the first time they sign in. There are no invitations to send. Revoking someone in Entra, or offboarding them, takes their aethercert sign-in with it.
Single sign-on is optional and additive: password sign-in keeps working for everyone, including for people who use Microsoft.
What you need
- Owner access to the aethercert organization.
- Permission to create an app registration in your Entra tenant - Application Administrator or Global Administrator.
- The email domain or domains your users sign in with, for example
contoso.com.
1. Register the application in Entra
Entra admin center > App registrations > New registration.
| Field | Value |
|---|---|
| Name | aethercert, or anything you like - your users see it on the consent screen. |
| Supported account types | Accounts in this organizational directory only. |
| Redirect URI | Platform Web, and the URI shown on the aethercert SSO settings page. |
Copy the redirect URI from Settings > Organization > Single sign-on rather than typing it. It has to match exactly, including scheme and trailing path.
After creating it, note the Application (client) ID and Directory (tenant) ID from the Overview page.
Client secret
Certificates & secrets > New client secret. Pick an expiry you will remember, and copy the Value immediately - Entra shows it once.
Email claim
Token configuration > Add optional claim > ID > email. Accept the prompt to turn
on the Microsoft Graph email permission if it appears.
aethercert identifies users by email address, so without this claim sign-in fails with "Microsoft did not return an email address for this account".
Who may use it
By default every user in your tenant can use the application. To restrict it:
Entra then refuses to issue a token for anyone unassigned, so they cannot sign in and are never created in your organization.
Conditional Access policies - MFA, compliant device, named locations - are scoped to this same application.
2. Connect it in aethercert
Settings > Organization > Single sign-on:
| Field | What it does |
|---|---|
| Directory (tenant) ID | Your Entra tenant. |
| Application (client) ID | The app registration you just created. |
| Client secret | The Value you copied. Stored encrypted; leave the field empty later to keep the existing one. |
| Email domains | Which addresses are routed to your tenant at the sign-in page, and which are accepted coming back. Guest accounts on other domains are rejected. |
| Role for new members | The role people get on first sign-in. Member unless you have a reason to hand out more - and note that Admin means the ability to configure deploy targets. |
| Create accounts on first sign-in | On by default. Off: only existing members can use Microsoft sign-in. |
| Trust our Conditional Access for two-factor | See below. |
| Single sign-on enabled | Turn off to suspend federated sign-in without deleting the configuration. |
Click Connect.
3. Sign in
Continue with Microsoft sends the browser to your tenant, where people pick their account - or are signed in silently with the machine's work account, if Windows already has one. On the first sign-in they are added to your organization with the role you chose; after that they land straight in it.
Because every organization brings its own app registration, aethercert has to know which tenant to send someone to before redirecting. Three things resolve that:
| The direct link | The SSO settings page shows a link like https://…/auth/sso?domain=contoso.com. Following it goes straight to your tenant with no aethercert sign-in page in between. Put it on your intranet, hand it out as a bookmark, or set it as the app registration's Home page URL. |
| Remembered | After anyone's first successful sign-in, that browser remembers the domain. Continue with Microsoft then goes straight through. |
| Asked once | On a browser that has never signed in and arrived at the sign-in page directly, aethercert asks for the email domain. That is the only time. |
Two-factor authentication
aethercert requires a second factor on every account. Trust our Conditional Access for two-factor, on by default, waives that for people who signed in through your tenant, on the basis that your own policies already decide how they authenticate.
Two things are worth knowing:
- The waiver applies to the Microsoft sign-in only. If someone with a password signs in that way instead, aethercert asks for a code from their authenticator app as usual.
- Turn the setting off if your tenant does not enforce MFA for this application. Federated users then enroll an authenticator app like everyone else.
Existing accounts
Someone who already has an aethercert account with the same email address keeps it. Microsoft sign-in links to that account rather than creating a second one, and adds them to your organization if they were not already a member. Their password keeps working.
Accounts created by Microsoft sign-in have no password at all - their way in is your tenant. If one of those users wants a password as a fallback, they can set one through Forgot your password?, and will be asked to enroll an authenticator app the first time they use it.
Removing the connection
Disconnect removes the tenant link and the domain claim. Current members keep their access and their password sign-in; what stops is Microsoft sign-in and the automatic provisioning of new people.
To cut off individuals instead, unassign them in Entra and remove them under Settings > Organization > Members.
Troubleshooting
| Message | Cause and fix |
|---|---|
| "Single sign-on isn't set up for contoso.com." | The domain is not on this connection's list, or it is claimed by another aethercert organization. A domain can only be used for single sign-on once. |
| "That app registration is already connected to another aethercert organization." | One app registration backs one organization. Create a second registration, or disconnect the other one. |
| AADSTS7000215 / "Invalid client secret provided." | The secret expired, or the Secret ID was pasted instead of the Value. Create a new secret and paste its Value. |
| AADSTS50011 / redirect URI mismatch | The redirect URI on the app registration does not match the one shown in aethercert. Copy it again - it must be identical. |
| "Microsoft did not return an email address for this account." | The email optional claim is not configured. See Email claim. |
| "… is not on this organization's list of allowed email domains." | The account signed in with an address on a domain you have not listed. Common for guest (B2B) accounts, which keep their home-tenant address. |
| An error from Microsoft before reaching aethercert | The user is not assigned to the application, or a Conditional Access policy blocked them. Both are decided in your tenant, not in aethercert. |