Skip to main content
INSIGHT ASSESSMENT Home

Single Sign-On (SSO) Setup Instructions - Azure entra id Identity Provider

Protocol: OPENID

This document explains how to configure Single Sign-On (SSO) so your users can access our web application using your Azure Entra ID credentials. Our SSO integration uses OPENID, with Entra ID as the Identity Provider (IdP) and our Azure tenant as the Service Provider (SP).

1. Important Notes (Read First)

Supported Login Flow (SP-Initiated Only)

SSO is SP-initiated. Users must start authentication from our application (for example, by opening our login page and selecting SSO).

IdP-initiated SSO (launching from the dashboard) is not supported.

If you want users to launch from dashboard, configure the application tile to open the following URL:

https://testing.insightassessment.com/ng/en/login?idp={idpName}
{idpName} will be provided by Insight Assessment

This ensures the correct SP-initiated flow is used.

No Automatic Account Creation

Our application does not support automatic user provisioning or account creation.

Before enabling SSO, you must provide us with a list of user email addresses that should be granted access. Only users explicitly approved in advance will be able to sign in.

User authorization is based on email address matching.

2. Azure Tenant Used for SSO

All SSO integrations are configured under a dedicated Azure tenant:

Tenant name: iaextertal

This tenant is used exclusively for SSO integrations.

3. ENTRA ID OPEN ID Application Configuration

Please create a new application registration in Microsoft Entra Admin Center

3.1 Application registration

3.1.1 Sign in to the Microsoft Entra Admin Center with an account that has sufficient administrative privileges.

3.1.2 Navigate to: Identity → Applications → App registrations → New registration

3.1.3 Configure the application as follows:

    • Name: Insight Assessment SSO
    • Supported account types: Accounts in this organizational directory only (Single tenant)
    • Redirect URI:
      • Platform: Web
      • URI: https://iaextertal.ciamlogin.com/49d19299-e218-4ea6-9f4f-f4e50b220c90/federation/oauth2

3.1.4 Select Register.

3.1.5 From the application’s Overview page, record the following values:

    • Application (Client) ID
    • Directory (Tenant) ID

These values will be required for federation configuration.

3.2 Create a client secret

3.2.1 Navigate to: Certificates & secrets → Client secrets → New client secret

3.2.2 Configure the secret:

    • Description: Insight Assessment Federation
    • Expiration: Recommended: 24 months

3.2.3 Select Add

3.2.4 Immediately copy and securely store the Secret Value (not the Secret ID). Microsoft only displays this value once.

Important

Please implement an internal process to rotate the client secret before its expiration date. Authentication requests will fail once the secret expires.

3.3 Configure API Permissions

3.3.1 Navigate to: API permissions → Add a permission → Microsoft Graph → Delegated permissions

3.3.2 Add the following delegated permissions:

    • openid
    • profile
    • email
    • offline_access
    • User.Read

3.3.3 Select Grant admin consent for your organization and confirm the request.

Granting admin consent ensures users are not prompted to approve permissions during sign-in.

4. Configure Email Claim (Required)

Insight Assessment uses the user’s email address as the unique identifier during authentication. The email claim must therefore be included in the ID token.

4.1 Add Email Claim to the ID Token

4.1.1 Navigate to: Token configuration → Add optional claim

4.1.2 Configure:

    • Token type: ID
    • Select email
    • Click Add

4.1.3 When prompted to enable the Microsoft Graph email permission, approve the request.

Verify User Email Attributes

Ensure that all users who will access Insight Assessment have a populated email attribute in Microsoft Entra ID:

Users → [User] → Properties → Contact Information → Email

Users without a valid email attribute will not be matched successfully and may be unable to sign in.

5. Provide Federation Details

Please provide the following information through a secure channel. Do not send client secrets via standard email.

Required Information

Location

Application (Client) ID

App Registration → Overview

Directory (Tenant) ID

App Registration → Overview

Client Secret Value

Certificates & Secrets

Client Secret Expiration Date

Certificates & Secrets

Primary Sign-in Domain (e.g. contoso.com)

Your organization’s login domain

 

7. Test User Accounts

To validate the integration before full rollout, please provide a small set of test users, for example:

  • 2–5 user email addresses
  • Standard user permissions
  • Real Entra ID accounts (not shared or admin-only accounts)

These test users will be enabled in our system and used to verify:

  • Successful authentication
  • Correct email claim mapping
  • Proper access enforcement

Once testing is completed, you may provide the full list of production users.

8. Testing and Validation

Once the above information has been received, the federation configuration will be completed on the Insight Assessment side, and a test authentication link will be provided for validation.

All testing must be performed using SP-initiated login from our application.

For assistance, contact support@insightassessment.com.