Microsoft Entra ID

Get your Subdomain

You'll need your subdomain to complete setup, it's used as part of the redirect URI.

Your subdomain is the subdomain of your Coalesce instance. For example, if you login at https://testapp.app.coalescesoftware.io/. Your subdomain is testapp. You can also check your subdomain by going to your organizations single sign-on settings.

If the Subdomain box in your settings is blank, you need to create a subdomain for your organization.

Configure Microsoft Entra ID

To use Microsoft Entra ID as your Single Sign-On provider, you'll want to create a new App Registration in Azure.

1. Go to the Overview panel in Azure Active Directory

2. Click the +Add dropdown

3. Select App Registration

   

4. On the registration page for this newly created integration, enter the following:

   1. Name - this is typically going to be Coalesce but any friendly name works
   2. Supported Account Types - choose which Account types to support, see the following screenshot.
   3. Make sure you choose Single Page Application (SPA).
   4. Redirect URI - The redirect URI should be formatted as follows - https://mySubdomain.<app_domain>/login/callback.
      1. Create a subdomain if one hasn’t already been defined for your organization. We recommend choosing a name specific to your organization. If the Subdomain box in your Single Sign-On Settings is blank, you need to create a subdomain for your organization.
   
   Supported Account Types

   Personal Microsoft accounts only is not a supported option for Coalesce Azure SSO.

5. Click Register to create the integration. You'll now be at a window with all your App Registration settings. Keep this browser tab open as you'll need to enter some information from it into Coalesce.

   

6. Open a new browser tab/window

7. Sign in to your Coalesce application using username and password

8. Go to Single-Sign on settings via User Menu > Org Settings > Single Sign-On.

9. Fill out the fields using the following table:

   Microsoft Permissions Requested

   When selecting Use Single-Sign On with Microsoft Entra ID, you may be prompted to grant Coalesce permission to:

   • Sign you in and read your profile
   • Maintain access to data you have given it access to
   • Microsoft Graph:

     • email

     • profile

     • User.Read

   These permissions can be pre-approved for future users by an admin in Microsoft Entra ID.

   1. Go to Manage >App Registrations> Your App Registration > API Permissions.
   2. Then select Add a permission > Microsoft Graph > Delegated Permissions and then select the desired permissions to pre-approve for the non-admin users.

   Field	Description
   Authority	The system being used for Single Sign On, choose Azure.
   Subdomain	This will be the same as mySubdomain. Not the entire redirect URI.
   Authorization Server Single tenant integrations.	https://login.microsoftonline.com/[tenantID]/
   Authorization Server multi-tenant and multi+personal integrations	https://login.microsoftonline.com/common/
   OIDC clientID	Refer to the Application (client) ID in the "Essentials" section on the overview page for your App Registration.

10. Once you've filled out the SSO settings in Coalesce, click Save.

11. Log out of Coalesce.

12. Go to your subdomain - https://mySubdomain.<app_domain> - and click on the Use Single Sign-On button to log in using SSO.