Skip to main content
Microsoft Entra ID (formerly Azure AD) lets your team sign in to your Base44 enterprise workspace with their existing company credentials. You create an Entra App registration for sign-in, then add its details to your workspace.
Important:
  • Workspace single sign-on is available on enterprise workspaces only. If you do not see this option, contact your Base44 account team.
  • To add and update members automatically, use SCIM provisioning for Microsoft Entra ID.

​
How it works

Base44 signs your team in through Microsoft Entra ID using OpenID Connect (OIDC). To do this, you need to register an app in Entra, then enter 3 of its values into your Base44 workspace under Settings > Auth and security:
  • Client ID: The app’s Application (client) ID from Entra.
  • Client Secret: A secret you generate for the app.
  • Tenant ID: Your Directory (tenant) ID, which controls who is allowed to sign in.
The steps below walk you through creating the app in Entra and finding each value. Base44 fills in the Scope and Discovery URL for you.
Base44 Auth and security settings showing the Single Sign-On Configuration form

The SSO configuration form in Base44's Auth and security settings

​
Setting up single sign-on

Follow these steps to register the Entra app, create its secret, and connect it to your Base44 workspace.
Before you begin, make sure you have:
  • Owner or admin access to your Base44 enterprise workspace.
  • Admin access to the Microsoft Entra admin center.
  • Your workspace ID, the string of characters after /workspace/ in your enterprise workspace URL.

​
Step 1: Register the app

Create the Entra App registration that represents Base44 sign-in. To register the app:
  1. In the Microsoft Entra admin center, go to App registrations.
  2. Click New registration.
  3. Enter a name that identifies your workspace, for example your company name.
  4. Under Supported account types, choose the option that matches your organization. If you are unsure, click Help me choose.
  5. Under Redirect URI, select Web and enter your workspace callback URL, replacing {{WORKSPACE_ID}} with your workspace ID: https://app.base44.com/api/workspaces/{{WORKSPACE_ID}}/auth/sso/callback
  6. Click Register.
The New registration form in the Microsoft Entra admin center

Registering a new app in Microsoft Entra

After registering, open API permissions and confirm the app has User.Read and the openid, email, and profile permissions. These let Entra return the user’s email at sign-in. New app registrations include User.Read by default, so you usually only need to confirm it is there.

​
Step 2: Create a client secret

Generate the secret Base44 uses to authenticate with Entra. To create a client secret:
  1. In your app, go to Certificates & secrets.
  2. Click New client secret, add a description that helps you recognize this workspace, then click Add.
  3. Copy the secret from the Value column, not the Secret ID, and store it somewhere safe.
The New client secret dialog in Microsoft Entra

Creating a client secret in Entra

The client secret Value appears only once. Once you leave the page it is hidden, so copy it before navigating away. If you lose it, create a new secret.

​
Step 3: Copy your IDs

Base44 needs two IDs from your app, both shown on its Overview page.
  • Application (client) ID: This is your Client ID in Base44.
  • Directory (tenant) ID: This is your Tenant ID in Base44.
The app Overview page in Microsoft Entra showing the Application (client) ID and Directory (tenant) ID

Copying your Client ID and Tenant ID from Microsoft Entra

​
Step 4: Add your details in Base44

Add the SSO app credentials to your workspace. To configure SSO in Base44:
  1. Click your workspace name at the top left of your account.
  2. Click Settings.
  3. Click Auth and security.
  4. Enable the toggle next to Single Sign-On Configuration.
  5. In Select SSO Provider, choose Microsoft Azure AD.
  6. Enter your Client ID and Client Secret from the SSO app.
  7. In the Tenant ID field, enter a value based on which accounts you want to allow:
    • Your directory (tenant) ID from Entra: Only users from your organization.
    • common: Personal Microsoft accounts and work or school (Microsoft 365) accounts.
    • organizations: Work and school accounts only (Microsoft 365).
  8. Keep Scope as openid email profile.
  9. The Discovery URL fills in automatically from your tenant ID. Confirm it looks correct before continuing.
  10. Click Enable SSO.
To control which users see SSO on the login page and what role new members get, set up verified domains and the default role in the same Auth and security settings.

​
Step 5: Give your team access

Your team can sign in once you assign them to the SSO app in Entra. To let users sign in:
  1. In the Microsoft Entra admin center, go to Enterprise applications and open your SSO app.
  2. Click Users and groups, then Add user/group.
  3. Select the users or groups that should be able to sign in, then click Assign.
To add and update members automatically instead of assigning them by hand, set up SCIM provisioning for Microsoft Entra ID.

​
FAQs

Select a question below to learn more about Entra SSO.
Yes. Base44 signs in over OIDC, so SSO uses an App registration, while SCIM provisioning uses a separate Enterprise application. Use the App registration’s Client ID, Client Secret, and Tenant ID for SSO, and set up provisioning separately. See SCIM provisioning for Microsoft Entra ID.
Confirm your app has the openid, email, and profile API permissions and that Scope in Base44 is openid email profile. These let Entra return the email address Base44 needs to create the member’s account.
Yes. Workspace admins can disable SSO from Auth and security in your workspace settings at any time.