How to Set Up Single Sign-On (SSO) for Microsoft

Single Sign-On (SSO) allows users to log in once and gain access to multiple applications without needing to authenticate again. Setting up SSO for Microsoft improves security and user experience, especially in business environments. This guide covers how to configure SSO for Microsoft Entra ID (formerly Azure AD).

Prerequisites

• A Microsoft Entra ID (Azure AD) tenant

• A domain that is verified in Microsoft Entra ID

• Administrator access to Microsoft Entra Admin Console

Setting Up SSO for Microsoft (Entra ID)

1. Go to the Microsoft Entra ID (formerly Azure AD).

2. Navigate to App registrations and click New registration.

3. Set up the following:

• • Name: Your app name

  • Supported account types: Choose Accounts in this organizational directory only (or others if needed).

  • Redirect URI: Set to [Localization HUB URL]/[callback path], where [callback path] is, for example, signin-oidc  with type 'Web'.

Click Register.

4. Go to the Authentication tab and ensure ID tokens are enabled.

5. Go to Overview and note down:

• • Application (client) ID

  • Directory (tenant) ID

6. Go to Certificates & secrets. Click New client secret and copy the generated secret.

7. Add API Permissions

• • Go to API Permissions.

  • Click  Add a permission.

  • Choose Microsoft Graph.

  • Select Delegated permissions.

  • Search for and check User.Read.

  • Click Add permissions.

Localization Hub Configuration

To enable SSO for Microsoft in Localization Hub, modify web.config with the following parameters:

<add key="MicrosoftSSOEnabled" value="true" /> <!-- Set to 'true' to enable Microsoft SSO, 'false' to disable it -->
<add key="MicrosoftSSOClientID" value="[Application (client) ID]" /> <!-- Take this from the previous step -->
<add key="MicrosoftSSOTenantID" value="[Directory (tenant) ID]" /> <!-- Take this from the previous step -->
<add key="MicrosoftCallbackPath" value="[callback path]" /> <!-- Take this from the previous step -->

As a result, an SSO button should appear in the Login View: