Microsoft Entra single sign-on setup

Create an application registration

In the Microsoft Entra admin centre, open App registrations and select New registration. Choose a clear name such as “SharpFleet SSO”. Select Accounts in this organisational directory only (single tenant).

Add the web redirect URI

Under Authentication, add a Web platform and enter this redirect URI exactly. It must match the SharpFleet environment being configured.

For Dev testing, use the redirect URI shown on the Dev guide. Do not use a Dev URI in the Production app registration.

Create a client secret

Open Certificates & secrets, create a new client secret with an expiry period that meets your organisation’s policy, and copy the secret value immediately. Microsoft only displays the value once.

Record the identifiers

From the app registration’s Overview, copy the Directory (tenant) ID and Application (client) ID. Provide those two IDs and the client secret value securely to the SharpFleet Company Administrator.

Apply Microsoft access controls

SharpFleet uses OpenID Connect identity scopes only: openid profile email. No Microsoft Graph application permissions are required for SSO.

For the strongest control, open the Enterprise application, set Assignment required? to Yes, then assign only the intended users or an approved Entra security group. Microsoft will then block unassigned users before SharpFleet is reached.

Configure and verify in SharpFleet

A SharpFleet Company Administrator opens Integrations → Microsoft single sign-on → Set up, enters the tenant ID, client ID and secret, then selects Verify and enable. The administrator signs in with their Microsoft account to confirm the connection.

The email address used for verification must match an existing SharpFleet Company Administrator account.

Test with an existing user

Use Sign in with Microsoft from the SharpFleet login page. Enter an existing SharpFleet user’s email address, then complete the Microsoft sign-in. The Microsoft email must match that SharpFleet account.