Setting Up Single Sign-On
This guide walks you through connecting Adcyma to your Microsoft Entra ID tenant for Single Sign-On (SSO). Once set up, users log in with their Microsoft credentials and Adcyma picks up your Entra ID security policies like MFA and conditional access automatically.
Recommended
SSO is the recommended way to sign in to Adcyma. Magic Links stay available as a fallback but are disabled while SSO is on.
Prerequisites
- An active Microsoft Entra ID tenant (Microsoft 365 or standalone)
- Application Administrator role in Entra ID to create app registrations and grant admin consent
- Administrator access in Adcyma to configure identity provider settings
Step 1: Create an App Registration
If you have not done this yet, follow the App Registration setup guide to create the application in Entra ID and generate a client secret. You will need the Tenant ID, Application (Client) ID, and Client Secret entered in Adcyma's Identity Provider settings.
Step 2: Add the Redirect URI
- In the Azure Portal, open Entra ID → App registrations and select the app registration you use for Adcyma
- Go to Authentication → Add a platform → Web (or edit the existing Web platform)
- Add the redirect URI shown in Adcyma under Administration → Settings → Identity Provider → Single Sign-On. It has this shape and ends with
/api/auth/callback/microsoft-entra-id:
https://portal.adcyma.com/api/auth/callback/microsoft-entra-id
Use the copy button on the Identity Provider page to get the exact value for your environment.
Step 3: Configure API Permissions
In your app registration, navigate to API permissions and add the following Delegated permissions under Microsoft Graph. These are used for the sign-in flow only.
| Permission | Type | Purpose |
|---|---|---|
openid | Delegated | Issue an ID token for the signed-in user |
profile | Delegated | Read the user's basic profile information |
email | Delegated | Read the user's email address |
User.Read | Delegated | Read the signed-in user's profile |
After adding all four permissions, click Grant admin consent for [your organization] and confirm.
All four are required for SSO to work, regardless of what other permissions are already configured. They cover the sign-in flow only. The application permissions Adcyma needs to manage users and groups (like User.ReadWrite.All) are set up separately in the App Registration guide.
Step 4: Test and Enable SSO
- In Adcyma, open Administration → Settings → Identity Provider and scroll to the Single Sign-On section
- Click Test connection. The Save button stays disabled until a test succeeds, so a broken configuration can't lock your organization out.
- Toggle SSO on and click Save
- Notify your users. From this point, all logins go through Entra ID and Magic Links are disabled.
To verify it is working, open a private browser window and navigate to your Adcyma login page. After entering an email address on your domain, you should be redirected to the Microsoft login prompt instead of receiving a Magic Link.
Disabling SSO
To revert to Magic Links:
- Open Administration → Settings → Identity Provider
- Toggle SSO off and save
- Magic Links become available immediately
Disabling SSO is useful as a temporary fallback if users lose Entra ID access. You can re-enable it at any time without re-entering credentials.
Troubleshooting
Users are redirected to Microsoft but get an error Check that the Tenant ID and Client ID are correct, the redirect URI matches exactly, and admin consent has been granted for all four delegated permissions.
Sign-in completes on Microsoft but fails to land in Adcyma The user's email address in Entra ID must match an account in Adcyma. Managed users get Access Center accounts automatically through sync; platform accounts are managed under Settings → User Permissions. If the addresses differ, contact support.