> ## Documentation Index
> Fetch the complete documentation index at: https://docs.base44.com/llms.txt
> Use this file to discover all available pages before exploring further.
# Setting up SSO for Microsoft Entra ID
> Let your team sign in to your Base44 enterprise workspace with their Microsoft Entra ID credentials.
Microsoft Entra ID (formerly Azure AD) lets your team sign in to your Base44 enterprise workspace with their existing company credentials. You create an Entra App registration for sign-in, then add its details to your workspace.
**Important:**
* Workspace single sign-on is available on enterprise workspaces only. If you do not see this option, contact your Base44 account team.
* To add and update members automatically, use [SCIM provisioning for Microsoft Entra ID](/Enterprise/Microsoft-Entra-SCIM).
***
## How it works
Base44 signs your team in through Microsoft Entra ID using OpenID Connect (OIDC). To do this, you need to register an app in Entra, then enter 3 of its values into your Base44 workspace under **Settings** > **Auth and security**:
* **Client ID:** The app's Application (client) ID from Entra.
* **Client Secret:** A secret you generate for the app.
* **Tenant ID:** Your Directory (tenant) ID, which controls who is allowed to sign in.
The steps below walk you through creating the app in Entra and finding each value. Base44 fills in the **Scope** and **Discovery URL** for you.
***
## Setting up single sign-on
Follow these steps to register the Entra app, create its secret, and connect it to your Base44 workspace.
**Before you begin,** make sure you have:
* Owner or admin access to your Base44 enterprise workspace.
* Admin access to the [Microsoft Entra admin center](https://entra.microsoft.com).
* Your **workspace ID**, the string of characters after `/workspace/` in your enterprise workspace URL.
### Step 1: Register the app
Create the Entra App registration that represents Base44 sign-in.
**To register the app:**
1. In the Microsoft Entra admin center, go to **App registrations**.
2. Click **New registration**.
3. Enter a name that identifies your workspace, for example your company name.
4. Under **Supported account types**, choose the option that matches your organization. If you are unsure, click **Help me choose**.
5. Under **Redirect URI**, select **Web** and enter your workspace callback URL, replacing `{{WORKSPACE_ID}}` with your workspace ID: `https://app.base44.com/api/workspaces/{{WORKSPACE_ID}}/auth/sso/callback`
6. Click **Register**.
After registering, open **API permissions** and confirm the app has **User.Read** and the **openid**, **email**, and **profile** permissions. These let Entra return the user's email at sign-in. New app registrations include `User.Read` by default, so you usually only need to confirm it is there.
### Step 2: Create a client secret
Generate the secret Base44 uses to authenticate with Entra.
**To create a client secret:**
1. In your app, go to **Certificates & secrets**.
2. Click **New client secret**, add a description that helps you recognize this workspace, then click **Add**.
3. Copy the secret from the **Value** column, not the **Secret ID**, and store it somewhere safe.
The client secret **Value** appears only once. Once you leave the page it is hidden, so copy it before navigating away. If you lose it, create a new secret.
### Step 3: Copy your IDs
Base44 needs two IDs from your app, both shown on its **Overview** page.
* **Application (client) ID:** This is your **Client ID** in Base44.
* **Directory (tenant) ID:** This is your **Tenant ID** in Base44.
### Step 4: Add your details in Base44
Add the SSO app credentials to your workspace.
**To configure SSO in Base44:**
1. Click your workspace name at the top left of your account.
2. Click **Settings**.
3. Click **Auth and security**.
4. Enable the toggle next to **Single Sign-On Configuration**.
5. In **Select SSO Provider**, choose **Microsoft Azure AD**.
6. Enter your **Client ID** and **Client Secret** from the SSO app.
7. In the **Tenant ID** field, enter a value based on which accounts you want to allow:
* Your **directory (tenant) ID** from Entra: Only users from your organization.
* `common`: Personal Microsoft accounts and work or school (Microsoft 365) accounts.
* `organizations`: Work and school accounts only (Microsoft 365).
8. Keep **Scope** as `openid email profile`.
9. The **Discovery URL** fills in automatically from your tenant ID. Confirm it looks correct before continuing.
10. Click **Enable SSO**.
To control which users see SSO on the login page and what role new members get, set up [verified domains and the default role](/Enterprise/SSO-for-enterprise-workspace#verified-domains) in the same **Auth and security** settings.
### Step 5: Give your team access
Your team can sign in once you assign them to the SSO app in Entra.
**To let users sign in:**
1. In the Microsoft Entra admin center, go to **Enterprise applications** and open your SSO app.
2. Click **Users and groups**, then **Add user/group**.
3. Select the users or groups that should be able to sign in, then click **Assign**.
To add and update members automatically instead of assigning them by hand, set up [SCIM provisioning for Microsoft Entra ID](/Enterprise/Microsoft-Entra-SCIM).
***
## FAQs
Select a question below to learn more about Entra SSO.
Yes. Base44 signs in over OIDC, so SSO uses an **App registration**, while SCIM provisioning uses a separate **Enterprise application**. Use the App registration's Client ID, Client Secret, and Tenant ID for SSO, and set up provisioning separately. See [SCIM provisioning for Microsoft Entra ID](/Enterprise/Microsoft-Entra-SCIM).
Confirm your app has the **openid**, **email**, and **profile** API permissions and that **Scope** in Base44 is `openid email profile`. These let Entra return the email address Base44 needs to create the member's account.
Yes. Workspace admins can disable SSO from **Auth and security** in your workspace settings at any time.