How Microsoft Entra ID single sign-on works and how to register the app in Entra.

How it works

Your site delegates sign-in to Microsoft Entra ID using OpenID Connect. When a visitor opens a gated app, they are redirected to Microsoft, sign in with their work or school account (subject to your organization's own multi-factor and Conditional Access policies), and are redirected back to your site.

Sign-in is scoped to your Entra directory (tenant): BehindGate uses the tenant-specific issuer https://login.microsoftonline.com/<tenant-id>/v2.0, so only accounts in your organization that are assigned to the app can get in. The multi-tenant "common" endpoint is deliberately not used, so a stray account from another tenant can never sign in. You can tighten access further in Entra, for example by requiring app assignment or a security group.

Before you start

You configure Microsoft SSO with three values: your Directory (tenant) ID, an application Client ID, and a Client secret.

You also need your site's redirect URI, because Microsoft must know where to send visitors back. Do not assemble it by hand. The dashboard shows the exact URI with a Copy button on the Sign-in details step of the New site wizard and under Edit sign-in. Copy it from there. The callback path is always exactly /__auth/callback, so the URI looks like this:

https://marketing.sites.behindgate.com/__auth/callback

As the dashboard notes:

Register this exact URL with your provider as an allowed redirect URI. It has to match character for character.

Register the app in Microsoft Entra

1. Open the Microsoft Entra admin center and go to Identity → Applications → App registrations → New registration.
2. Give the app a name. Under Supported account types, choose Accounts in this organizational directory only so only your tenant can sign in.
3. Under Redirect URI, choose the Web platform and paste the redirect URI you copied from the dashboard. It must match exactly, including https and no trailing slash.
4. Select Register. On the app's Overview page, copy the Application (client) ID and the Directory (tenant) ID.
5. Go to Certificates & secrets → Client secrets → New client secret. Add a description and expiry, then Add, and copy the secret Value (not the ID). It is shown only once.

Enter the details in BehindGate

1. In the dashboard, choose Microsoft Entra ID as the sign-in method (in the New site wizard, or later under Edit sign-in).
2. Enter the Directory (tenant) ID, the Client ID, and the Client secret from the steps above. The directory ID scopes sign-in to your organization.
3. Save. The secret is stored encrypted and is never shown again; to change it, re-enter a new value.

Open your live site to test the round trip to Microsoft and back.

Rotating the secret

Entra client secrets expire. Before one lapses, create a new secret in Certificates & secrets, enter it under Edit sign-in, and delete the old one in Entra. Because BehindGate never displays the stored secret, editing any Microsoft setting requires typing the secret again. Leave the secret blank to keep the current one, or enter a new one to replace it.