# Single sign-on with Microsoft Entra ID

Your people sign in to Shonin with their Microsoft Entra ID account. You register the app in your own tenant, like you do for AWS IAM Identity Center: only people of your tenant can use it.

## Set up

1. In the Microsoft Entra admin center, open **App registrations** and choose **New registration**. Name it Shonin, choose **Accounts in this organizational directory only**, and add a **Web** redirect URI with the address Shonin shows in **Org settings** (`https://<your Shonin org>.app.shonin.ai/sso/microsoft/callback`).
2. In **API permissions**, add the Microsoft Graph **application** permission `User.Read.All`, then choose **Grant admin consent**. Shonin uses it to read the address of each person who signs in, and who is deleted or blocked from signing in.
3. In **Certificates & secrets**, create a client secret and copy its **Value**: Microsoft shows it once. A client secret lasts at most 24 months: before it expires, create a new one and enter it in Shonin.
4. In Shonin, open **Org settings** (top of the page, next to your name) and choose **Microsoft Entra ID** as the provider. Enter the **Directory (tenant) ID** and the **Application (client) ID** from the **Overview** of the app, the client secret and the domains of your people (every domain their addresses use), and choose **Save**. Shonin reads your directory at once: **Directory** shows when, and **People** shows who could not sign in with Microsoft.
5. Turn on the switch next to **Single sign-on: Microsoft Entra ID**. Shonin lists who will not be able to sign in; choose **Turn on**, and sign in with Microsoft once, with your own account of the tenant, to check the app works.

## What changes for your people

- They sign in with **Sign in with Microsoft**, and confirm with their second factor.
- Only people you invited sign in, with their user principal name: that is the address Microsoft signs them in as. Shonin refuses to invite another address of the same person, and says which one to invite. Invitations go only to addresses of your domains, unless you select **People outside these domains sign in with a password** in **Password sign-in**.
- Guests of your tenant and groups cannot sign in with Microsoft.
- Passwords are removed from the addresses of your domains. Primary admins keep theirs, to sign in if Microsoft is unavailable (**Sign in with a password**).
- People deleted in Microsoft Entra ID are deleted in Shonin, with their access. People blocked from signing in are turned off. Shonin reads the directory every 5 minutes. A primary admin is never changed automatically: the other primary admins get an email to confirm.

## When the directory cannot be read

**Directory** shows when Shonin last read your directory, and the reason when it cannot: the client secret expired or is wrong (enter a new one in **Org settings**), or the app no longer has `User.Read.All` with admin consent. Shonin emails the primary admins. Until it can read again, people deleted or blocked in Microsoft Entra ID keep their access in Shonin.

If Microsoft is only unavailable, Shonin tries again in 5 minutes. **Read now** reads the directory at once, for example after you fix something in Microsoft Entra ID.

## Turn it off

In **Org settings**, turn off the switch next to **Single sign-on: Microsoft Entra ID**. People without a password get a link to choose one. With single sign-on off you can also switch to Google Workspace.