With Microsoft Entra ID your team signs in to 1-CP using their familiar company login. The integration can run at two levels: authentication only, or authentication plus profile data. The base setup is identical in both cases.
Responsibility is shared. 1-CP provides the integration details, your Entra ID administrator creates the app registration and remains its owner.
Redirect URI (production): https://proxy.1-cp.com/api/auth/ext/MICROSOFT/callback
Redirect URI (staging): https://proxy.1-cp.io/api/auth/ext/MICROSOFT/callback
Platform: Web, single tenant, authorization code flow with a client secret
The redirect URI is case-sensitive and must be entered exactly as shown. If it differs, sign-in fails with error AADSTS50011.
In the Microsoft Entra admin center, create a new registration under App registrations, for example named 1-CP SSO.
Under Supported account types, select Accounts in this organizational directory only.
Add the Web platform and enter the redirect URI provided by 1-CP.
Create a client secret under Certificates & secrets. Copy the Value immediately, it is shown only once.
Under API permissions, add the permissions for the level you want (see below).
Your team signs in via SSO, 1-CP synchronizes no profile data and does not access any other data in your tenant.
Delegated permissions (Microsoft Graph, OpenID): openid, profile, email. These are the standard OIDC sign-in permissions, nothing beyond that.
Important: 1-CP identifies users by email address. Per Microsoft, the email claim is only included in the token if an address is associated with the account. Make sure the mail attribute is populated for the accounts in scope.
On top of sign-in, 1-CP takes master data from your directory into the user profile. This saves manual maintenance in 1-CP and keeps names and contact details current.
Additional delegated permission: User.Read, so 1-CP can read the user profile via Microsoft Graph.
Prerequisite: The attributes you want transferred must be populated in Entra ID. For first name, last name and email address these are mail, givenName and surname. If one of them is missing, the corresponding field in the 1-CP profile stays empty.
Which fields are transferred in your specific setup is agreed during onboarding. If you want to pass additional attributes or are unsure whether a field is supported, reach out via the help widget. We will raise a ticket and clarify it for you.
clientId – the Application (client) ID from the app registration overview
tenantId – the Directory (tenant) ID of your Entra tenant
clientSecret – the secret Value, not the Secret ID
The client secret is a sensitive credential. Please do not send it by email, use an agreed secure channel instead.
Separate production and staging. Microsoft recommends keeping non-production URIs out of the production app. With two app registrations, a leaked staging secret never affects production and both environments can be retired independently.
Restrict access. Under Enterprise applications, Properties, set Assignment required to Yes and assign only the groups that should use 1-CP.
Watch the secret expiry. The secret is yours, and so is rotation. Set a reminder ahead of the expiry date, otherwise sign-in breaks without warning.
Start with level 1. Get sign-in working cleanly first, then extend to profile data if needed. This narrows down potential sources of error.
Grant admin consent. It is not technically required for openid, profile and email, but it prevents every user from seeing an individual consent prompt.
Stuck somewhere, or have a requirement not covered here? Reach out via the help widget, we will raise a ticket and support the setup.
