Microsoft Entra Single Sign-On Setup Guide

This guide explains how to connect ProVisit to your Microsoft Entra tenant using your own Azure App Registration.

ProVisit uses a Bring Your Own App model. This means your organisation owns the Microsoft Entra application, client secret, tenant configuration, and access policies.

Before you start

You will need:

  • A Microsoft Entra tenant.

  • Permission to create or manage App Registrations in Microsoft Entra.

  • ProVisit admin access with permission to edit settings.

  • The ProVisit Entra connector enabled for your tenant.

  • Your organisation's trusted email domain, for example example.com.

Contact ProVisit support if the Entra integration or SSO options are not visible in your ProVisit settings.

What ProVisit Requires

ProVisit requires the following values from Microsoft Entra:

  • Tenant ID

  • Application Client ID

  • Client Secret

  • Redirect URI

ProVisit also requires one trusted SSO email domain. Internal users with this domain will be directed to Microsoft Entra when SSO enforcement is enabled.

You will also need to send your Tenant ID to ProVisit via help@provisit.co.uk

Create the App Registration in Microsoft Entra

  • Sign in to the Microsoft Azure portal.

  • Go to Microsoft Entra ID

  • Open App Registrations

  • Select New registration

  • Enter a name, for example:

    • ProVisit SSO

  • For supported account types, select the option appropriate for your organisation. In most cases this should be: Accounts in this organisational directory only

  • Add the Redirect URI:

      https://your-provisit-domain.com/auth/entra/callback

    Replace https://your-provisit-domain.com with your ProVisit site URL.

  • Save the app registration.

Copy the Required IDs

After the app registration has been created:

  • Open the app registration.

  • Copy the Application (client) ID

  • Copy the Directory (tenant) ID

You will enter both values in ProVisit.

Create a Client Secret

  • In the app registration, open Certificates & secrets.

  • Select New client secret

  • Enter a description, for example: ProVisit SSO secret

  • Choose an expiry period that matches your organisation's policy.

  • Select Add.

  • Copy the secret Value immediately.

    The secret value is only shown once. If you leave the page without copying it, you must create a new secret.

API Permissions

The app registration must be able to read the signed-in user's basic profile from Microsoft Graph.

Required delegated permission:

Microsoft Graph > User.Read

Depending on your organisation's Microsoft Entra policies, an administrator may need to grant consent.

Configure ProVisit

  • Sign in to ProVisit as an admin.

  • Go to Settings

  • Open Integrations

  • Open Microsoft Entra ID

  • Enter the following values:

    • Tenant ID

    • Client ID

    • Client Secret

    • Secret Expiry (optional)

  • If required, enable

    Enforce SSO for internal users

  • Enter the trusted SSO domain, for example:

    example.com

  • Select save & validate

ProVisit validates the Microsoft Entra credentials before saving them. If validation fails, check the tenant ID, client ID, client secret, and API permissions.

Important Behaviour

When SSO enforcement is enabled:

  • Internal users with the trusted domain are directed to Microsoft Entra from the login page.

  • Entra-linked users cannot fall back to password login.

  • Users must exist in ProVisit and be linked to their Microsoft Entra object ID.

  • Users must be active and accepted in ProVisit.

  • Users must have application access, including a role and location access.

  • Microsoft Entra guest users are not permitted for SSO. The Entra user must be a Member.

ProVisit does not authenticate users by email alone. The Microsoft Entra object ID, tenant ID, token audience, nonce, state, and trusted domain are all validated during login.

Redirect URI

The Redirect URI must exactly match your ProVisit site:

https://your-provisit-domain.com/auth/entra/callback

Common issues include:

  • Using http instead of https.

  • Using the wrong subdomain.

  • Adding or removing a trailing slash.

Secret Rotation

To rotate the Microsoft Entra client secret:

  • Create a new client secret in Microsoft Entra.

  • Copy the new secret value.

  • In ProVisit, open the Microsoft Entra integration settings.

  • Select Update Credentials

  • Enter the new client secret.

  • Save and validate the settings.

Do not delete the old secret until the new secret has been saved and validated in ProVisit.

Troubleshooting

Credentials do not validate

Check:

  • Tenant ID is correct.

  • Client ID is correct.

  • Client secret value was copied, not the secret ID.

  • Client secret has not expired.

  • The app registration has Microsoft Graph User.Read delegated permission.

  • Admin consent has been granted if required by your organisation.

Users are still asked for a password

Check:

  • SSO enforcement is enabled.

  • The user's email domain matches the trusted SSO domain.

  • The user is an internal ProVisit user.

  • The Entra integration is active and validated.

User cannot sign in with SSO

Check:

  • The user exists in ProVisit.

  • The user is active and accepted.

  • The user has been linked to their Microsoft Entra account.

  • The user has a role.

  • The user has location access.

  • The Microsoft Entra user is a Member, not a Guest.

  • The user's email in Microsoft Entra matches the email in ProVisit.

Guest users cannot sign in

This is expected. ProVisit only permits Microsoft Entra users with userType set to Member.

Guest users should be managed through a supported non-SSO workflow unless your organisation has agreed a different configuration with ProVisit.