Single sign-on (SSO) — Settings

"Settings" → "Administration" → "Single sign-on (SSO)" connects your organization to Microsoft Entra ID, so members can sign in with their work Microsoft account. Microsoft Entra ID is the only provider on this screen. It also holds the switch that makes Microsoft sign-in compulsory.

Who can change it

Only an administrator can open this screen and change anything on it.

Before you start

You need an app registration in your Microsoft Entra directory. Three things matter there:

Paste the Redirect URI shown on this screen into the app registration, as a Web platform redirect. It is the same address for every Flowtly organization.
Enable the email optional claim on the app registration. Without it the first sign-in often fails in a confusing way.
Create a client secret and keep its value, which is shown only once in Entra.

The controls on this screen

The screen opens in setup mode while nothing has been entered. After a configuration is saved it shows a summary instead, and Edit configuration brings the setup form back.

Microsoft Entra ID: the heading of the connection. Under it the screen says either that members can sign in with their work Microsoft account (before setup) or the word "Directory:" followed by your directory ID.

The status label at the top right shows where the connection stands:

Status	Meaning
Not configured	Nothing has been entered yet.
Pending first sign-in	A configuration is saved, but nobody has signed in through Microsoft with it yet.
Active	A sign-in through Microsoft has succeeded. The screen then shows Last verified with the date.
Connection error	The connection is marked as failed. The screen shows the error text, or "The last sign-in attempt failed." when there is none.

Redirect URI: the address to paste into your Entra app registration. It is read-only. The copy button next to it (Copy redirect URI) puts it on the clipboard and briefly shows Copied!.

The form fields:

Directory (tenant) ID: your Entra directory ID. Required.
Application (client) ID: the ID of the app registration. Required.
Client secret: the secret value generated in Entra. The field never shows a saved secret. Once one is on file, leave the field blank to keep it, or enter a new value to replace it.
Verified domains: the email domains whose members may sign in with Microsoft, separated by commas, for example acme.com, acme.eu. Entries are lower-cased and duplicates are dropped.
Add existing users to this organization: a switch, off by default. See below.
Save configuration: stores the configuration. It stays unavailable until both IDs are filled in. A Success message confirms it.
Cancel: leaves the form without saving. It appears only once a configuration exists.

In the summary view you see the Application (client) ID and, once the connection is Active, the Verified domains as chips. Edit configuration reopens the form.

Test sign-in appears while the status is pending, and Retry test sign-in appears when it shows a connection error. It opens a Microsoft sign-in window for your own account, using your company email address. When the window closes, the page reloads the status from the server. If your email is not on a verified domain, or the configuration is not saved, a message says the test could not run. If the browser blocks the window, a message asks you to allow pop-ups.

Require SSO for this organization: a switch, off by default. It stays unavailable until the status is Active. Turning it on opens a confirmation, Require Microsoft sign-in for your organization's name, with Cancel and Require Microsoft sign-in. Turning it off takes effect straight away and needs no confirmation.

Help & Docs: a side panel with three hints (Follow the setup order, Review security impact, Get help if stuck). Contact support opens an email to Flowtly support. The panel switches between Compact and Expand.

How signing in works

A person signs in only if their email address is on one of the Verified domains.
A person with a Flowtly account who is already a member of the organization signs in as usual.
A person with a Flowtly account who is not yet a member is added to the organization only when Add existing users to this organization is on. People with no Flowtly account cannot sign in this way: invite them first. A person you have already invited is let in whether the switch is on or off.
Changing the tenant ID, the client ID or the client secret on a saved configuration sets the status back to Pending first sign-in, until the next successful sign-in. Editing only the verified domains or the switch does not.

What requiring SSO does

Once Require SSO for this organization is on, password sign-in is refused for members whose email is on a verified domain, and they must continue with Microsoft. A member whose email is on another domain keeps their usual sign-in. Someone who belongs to several organizations is refused a password only because of an organization that requires SSO and whose verified domains include their email.

A member who has never signed in through Microsoft is locked out of password sign-in the moment you confirm. Check that everyone can sign in through Microsoft before you turn it on, and use Test sign-in first. Turning the switch off is always possible and restores password sign-in.

Example use cases

An administrator connects the company's Microsoft directory, signs in once through Test sign-in, and the status turns Active.
An administrator adds a second domain to Verified domains after a merger.
An administrator turns on Add existing users to this organization so colleagues who already have a Flowtly account join without an individual invitation.
An administrator pastes a new value into Client secret before the old one expires in Entra, then tests the sign-in again.
After confirming everyone can sign in through Microsoft, an administrator turns on Require SSO for this organization.