Skip to main content

​
Microsoft Entra ID Single Sign-On

Single Sign-On (SSO) allows your organization members to sign in to NeuralTrust using their corporate Microsoft credentials instead of a separate password. Using a different identity provider? For Google Workspace, see Google Workspace SSO — it has a dedicated provider with directory group sync. For Okta, see Okta SSO. For Auth0 or another OIDC-compliant provider, see Generic OIDC SSO.
SSO Configuration and SCIM are Enterprise plan features. The Free plan hides both screens in Platform Settings. Plans & Billing lists them under Enterprise.

​
Benefits

  • Simplified access: One less password for users to remember
  • Centralized control: Manage access through your IT department
  • Automatic provisioning: Combine with SCIM for seamless user management
  • Verified-domain sign-in: Saving Microsoft Entra ID sends members on a verified domain through Microsoft for this organization, with Enforce SSO off or on
  • Enforce SSO: Turning on Enforce SSO also sends addresses on the verified domains that have no active membership in any organization to Microsoft at the email step. Guests outside the verified domains sign in as before.

​
Prerequisites

Before you begin, ensure you have:
  • Microsoft Entra ID (Azure AD) tenant
  • Global Administrator or Application Administrator role in Azure
  • Owner or Admin role in NeuralTrust

​
Part 1: Configure Azure Portal

​
Step 1: Create an App Registration

  1. Go to Azure Portal
  2. Navigate to Microsoft Entra ID → App registrations
  3. Click + New registration
  4. Enter the following:
    • Name: NeuralTrust SSO
    • Supported account types: Accounts in this organizational directory only
    • Redirect URI: Leave empty for now
  5. Click Register

​
Step 2: Copy Your Credentials

  1. On the app’s Overview page, copy:
    • Application (client) ID
    • Directory (tenant) ID
  2. Save both values securely — you’ll need them later

​
Step 3: Create a Client Secret

  1. Go to Certificates & secrets
  2. Click + New client secret
  3. Enter a description: NeuralTrust SSO
  4. Select expiration: 24 months (recommended)
  5. Click Add
Copy the Value immediately after creating the secret. It’s only shown once and cannot be retrieved later. Do not copy the Secret ID — you need the Value field.

​
Step 4: Configure Redirect URI

  1. Go to Authentication
  2. Click + Add a platform
  3. Select Web
  4. Enter Redirect URI:
  5. Click Configure

​
Step 5: Add API Permissions (Optional)

Only required if you plan to use the Manual User Sync feature.
  1. Go to API permissions
  2. Click + Add a permission
  3. Select Microsoft Graph → Application permissions
  4. Add these permissions:
    • User.Read.All
    • GroupMember.Read.All
    • Group.Read.All
  5. Click Grant admin consent for [Your Organization]
  6. Verify all permissions show ✓ Granted

​
Part 2: Configure NeuralTrust

​
Step 1: Open SSO Settings

  1. Log in to NeuralTrust as Owner or Admin
  2. Open the sidebar gear → Platform settings → SSO Configuration
  3. Select the Microsoft Entra ID tab
Only one identity provider can be active at a time. If Generic OIDC or Google Workspace is already configured, remove it before setting up Microsoft Entra ID.

​
Step 2: Enter Your Azure Credentials

  1. Paste your Tenant ID
  2. Paste your Client ID
  3. Paste your Client Secret

​
Step 3: Test the Connection

  1. Click Test Connection
  2. You should see “Connection successful”
  3. Click Save

​
Part 3: Verify Your Email Domain

Domain verification prevents unauthorized users from claiming your company’s domain and ensures only legitimate employees can use SSO.

​
Step 1: Add Your Domain

  1. Open Platform settings → SSO Configuration → Domains
  2. Click Add Domain
  3. Enter your company domain (e.g., yourcompany.com)
  4. Click Add

​
Step 2: Get the Verification Token

You’ll receive a verification token like:
Copy this token for the next step.

​
Step 3: Add DNS TXT Record

  1. Log in to your DNS provider (GoDaddy, Cloudflare, Route53, etc.)
  2. Add a new TXT record with:
  1. Save the record

​
Step 4: Verify

  1. Back in NeuralTrust, click Verify
  2. If verification fails, wait up to 48 hours for DNS propagation
  3. Once verified, status changes to ✓ Verified
DNS changes can take up to 48 hours to propagate globally. If verification fails immediately, try again later.

​
Part 4: Configure Role Mapping (Optional)

Role mapping allows you to automatically assign NeuralTrust roles based on Azure AD group membership. This is useful for organizations that want to manage access permissions through their existing Azure AD groups.

​
Prerequisites for Role Mapping

Before configuring role mapping, ensure:
  • SSO is configured and tested
  • API permissions are granted (see Step 5 in Part 1)
  • You have created security groups in Azure AD

​
Step 1: Create Security Groups in Azure AD

  1. Go to Azure Portal → Groups
  2. Click + New group
  3. Create groups for your organization structure (e.g., “NeuralTrust Admins”, “NeuralTrust Members”)
  4. Set Group type to Security
  5. Click Create

​
Step 2: Add Users to Groups

  1. Go to Azure Portal → Users
  2. Select a user
  3. Go to Groups → + Add memberships
  4. Select the appropriate group(s)
  5. Click Select

​
Step 3: Verify API Permissions

Ensure your app registration has these Application permissions (not Delegated):
  1. Go to Azure Portal → App registrations
  2. Select your NeuralTrust SSO app
  3. Go to API permissions
  4. Verify all three permissions show ✓ Granted. If they do not, click Grant admin consent for [Your Organization] and confirm.

​
Step 4: Map groups to roles in Role Provisioning

Group-to-role mapping lives in one place — the Role Provisioning section — for every provider. See Role Provisioning for the full guide. In short:
  1. Log in as Owner or Admin → Platform settings → Role Provisioning
  2. Turn on User provisioning & role mapping
  3. Set a Default Access role for users who match no group
  4. Choose an Enforcement mode — At sign-up only, At sign-up and login, or Automatically via SCIM
  5. Under Role Mapping, add a row per Azure AD group and pick its platform role:
A user in several mapped groups gets the highest-privilege role among them — not the first match. Do not map IdP groups to Owner; transfer ownership in Users & groups instead.

​
Part 5: Enforce SSO (optional)

Saving the Microsoft Entra ID connection (Part 2) takes effect immediately, including while Enforce SSO is off. Members whose email is on a verified domain sign in to this organization through Microsoft. Password sign-in and magic link are not available for this organization for those members. A member who is not in the IdP is still sent to Microsoft, and that is the only way into this organization. Sign-in to their other organizations is unchanged. Membership in those organizations decides. Break the Glass accounts are unaffected. They sign in with password only (they skip SSO and magic link). Turning on Enforce SSO also sends addresses on the verified domains that have no active membership in any organization to Microsoft at the email step. Guests outside the verified domains sign in as before.
  1. Open Platform settings → SSO Configuration
  2. Toggle Enforce SSO to ON
Prerequisites for the toggle: Add at least one break-the-glass account under Users & groups and verify an Email Domain first (Part 3).
Before you save the connection, make sure members on verified domains can sign in with Microsoft. Keep at least one Owner on the Break the Glass list, and make sure that account belongs to this organization only. The Owner’s email domain should match a verified domain of this organization exactly — a subdomain or a parent domain does not count. This connection does not change sign-in to other organizations.

​
User Experience

Once SSO is configured, users will see a Sign in with Microsoft button on the login page. After clicking it:
  1. Users are redirected to Microsoft’s login page
  2. They enter their corporate credentials
  3. They’re automatically signed in to NeuralTrust
Every user’s email domain must be Verified (Part 3). A domain still Pending blocks sign-in with “Domain not verified”. The Trust Identity Provider setting does not bypass this. For new users on a verified domain, accounts are created on first login when User provisioning is on.

​
Troubleshooting

​
Security Best Practices

  1. Rotate client secrets before they expire (24 months recommended)
  2. Keep an Owner on the Break the Glass list for this organization only, with an email domain that matches a verified domain exactly (a subdomain or a parent domain does not count), before you depend on the IdP
  3. Verify all email domains your organization uses, including each subdomain your members use. A subdomain of a verified domain needs its own verification and is treated as outside it
  4. Combine with SCIM for automatic user lifecycle management
  5. Monitor audit logs for suspicious login patterns

​
Next Steps