Single Sign-On (SSO)
Last updated March 25, 2026
Single Sign-On (SSO) Setup With Microsoft Entra
1. Introduction
This document explains how to configure Single Sign-On (SSO) so your users can access the FMS Cloud platform using your Microsoft Entra ID credentials. Our SSO integration uses OpenID Connect (OIDC), with Entra ID as the Identity Provider (IdP).
2. Notice
FMS Cloud does not support automatic user provisioning or account creation. Before enabling SSO, you must provide us with your users information via file upload through our platform or integration with your data source.
3. Prerequisites
Before you continue, please make sure that:
- You have admin rights in FMS Cloud.
- You have access to Azure portal.
4. Application Registration
4.1 Create a new application registration in Microsoft Azure.
4.1.1 Log in to portal.azure.com.
4.1.2 In the Azure portal main menu, select Microsoft Entra ID.
4.1.3 On the left sidebar, under Manage, select App registrations.
4.1.4 Click New registration.
4.1.5 On the Register an application view, enter a display name (i.e. FMS Cloud SSO).
4.1.6 On Supported account types, select one of the options.
4.1.7 Click Register.
4.1.8 From the application’s Overview page, record the Application (Client) ID and Directory (Tenant) ID values. These will be required later in the setup process.
4.2 Create a client secret for the app registration
4.2.1 Navigate to: Certificates & secrets → Client secrets → New client secret.
4.2.2 Enter a description and set the expiration (i.e. 24 months).
4.2.3 Click Add.
4.2.4 Immediately copy and securely store the Secret Value (not the Secret ID). Microsoft only displays this value once.
Important: Implement an internal process to reset the client secret before its expiration date. Authentication requests will fail once the secret expires.
4.3 Configure API permissions
4.3.1 Navigate to: API permissions → Add a permission → Microsoft Graph → Delegated permissions.
4.3.2 Add the following delegated permissions: email, openid, profile, User.Read.
4.3.3 Select Grant admin consent for your organization and confirm the request.
Granting admin consent ensures users are not prompted to approve permissions during sign-in.
4.4 Configure email claim
FMS Cloud uses the user’s email address as the unique identifier during authentication. The email claim must therefore be included in the ID token.
4.4.1 Navigate to: Token configuration → Add optional claim.
4.4.2 Set Token type to ID, then select email.
4.4.3 Click Add.
When prompted to enable the Microsoft Graph email permission, approve the request.
4.5 Configure Redirect URI
4.5.1 While keeping the app registration window open on your browser, open a new tab and access your FMS Cloud instance. If you don’t know the URL of your specific FMS Cloud instance, contact [email protected].
4.5.2 From the FMS Cloud dashboard on the left navigation pane, click Users then navigate to More → Settings.
4.5.3 Under the Single Sign-On section, click the Configure SSO button. This will display a form where you should see an Entra Redirect URI field. Record the value on that field.
4.5.4 Go back to the app registration browser tab, then navigate to Authentication (Preview) → Redirect URI Configuration → Add Redirect URI.
4.5.5 Select Web and paste the value you copied from the previous step to the Redirect URI field.
4.5.6 Select Configure button.
5. Provide app registration details
Go back to your FMS Cloud browser tab and on the SSO section, fill in the form with the following information to the appropriate fields.
- Directory (Tenant) ID → Entra Tenant ID
- Application (Client) ID → Entra Client ID
- Client Secret Value → Entra Client Secret
Click Save when done.
6. Testing and validation
Once the above information has been submitted, please contact [email protected] to receive a test authentication link for validation.