Enterprise SSO

Set up Microsoft Entra sign-in for your team

A setup guide for your IT team. Questions? support@plainfra.com

On the Enterprise plan, your team signs in to plainfra with Microsoft Entra. You nominate one security group in your directory, and anyone in that group who clicks "Continue with Microsoft" on the plainfra sign-in page joins your organisation automatically, up to the seats your plan includes. Each person gets their own private session history, and everyone gets read-only access to the AWS accounts you have connected. There is no per-user invite to send and no password for plainfra to hold.

What plainfra receives

  • The person's name, email, and Entra user ID, taken from the sign-in token
  • Whether they are a member of the one group you nominate, carried inside that same token
  • Nothing more: plainfra requests only basic sign-in scopes (openid, email, profile)

What plainfra does not receive

  • No passwords or credentials: sign-in stays with Microsoft
  • No directory read: plainfra never queries your users, groups, or org structure
  • No write access to Entra or any other app in your tenant

What your IT team needs

Two identifiers from your Entra tenant, and one place to enter them. Gather these, hand them to your plainfra account owner, and setup is done.

  • Your tenant ID. In the Microsoft Entra admin centre, open Overview. The tenant ID is a GUID shown on that page, in the form 00000000-0000-0000-0000-000000000000. Copy it exactly.
  • A security group object ID or an app role. Pick one of these two ways to say who is allowed in:
    • Security group object ID. In the Entra admin centre, open Groups, select the group whose members should get plainfra access, and copy its Object ID (a GUID). Use the object ID, not the display name: the display name can change and is never used for gating.
    • App role (for large directories). If your people belong to hundreds of groups, the sign-in token omits the group list, so the object ID will not be present to check. In that case, assign the plainfra app role value plainfra.user to the group instead, under Enterprise applications. plainfra reads the role from the token in place of the group. This is the right choice for tenants with very many group memberships per user.
  • Where the owner enters them. Your plainfra account owner opens the plainfra console, goes to Account, and finds the Team access section. They paste in the tenant ID and either the group object ID or the app role value. That is the whole configuration.

How your team signs in

Once Team access is set, tell your people to go to the plainfra sign-in page and click Continue with Microsoft. They sign in with their normal work account.

On a person's first sign-in, Microsoft shows a consent screen for the basic profile scopes. The publisher named on that screen is TRIONT PTY LTD, a verified publisher. The person approves once, and every later sign-in goes straight through.

Admin consent is not required by default: each person consents to the basic profile scopes themselves at first sign-in. If, and only if, your tenant policy blocks users from self-consenting, Microsoft shows a "Need admin approval" prompt instead. A tenant admin then approves plainfra once for the whole directory, using the standard admin approval flow, and after that your people sign in normally.

How access is controlled

Membership of the group you nominated is the single control. You manage who can use plainfra entirely from Entra:

  • Add someone to the group and they can sign in.
  • Remove someone from the group and they can no longer sign in. plainfra also revokes their existing sign-in the next time they try to authenticate, so an open session does not outlive their group membership.

Seats are capped by your plan. Enterprise includes 20 people. Members join on a first-come basis up to that number, so once your included seats are full, the next person is not admitted until a seat frees up.

Troubleshooting

The problems below cover almost every sign-in failure we see during rollout.

  • "Sign-in failed at the identity provider." The person's directory profile has no email address. This is common for cloud-only Entra accounts created by script or in the admin centre without a Mail property, and plainfra rejects sign-ins that arrive without a verified email. An Entra admin sets the Email field on the user's profile (Entra admin centre → Users → select the user → Properties → Contact information), waits a minute or two for the directory to propagate, and the person retries.
  • "Your team's plainfra seats are all in use." Your plan's included seats are full. The next person is admitted when a seat frees up, or the account owner can add seats from the Account page.
  • "Your Microsoft account isn't in the access group." The person is not a member of the nominated security group, or the configured value is the group's display name rather than its Object ID. Confirm the Object ID on the group's overview page in the Entra admin centre. Group membership changes take effect on the person's next sign-in attempt.
  • "Sign-in link expired." Sign-in links are single-use and expire after ten minutes. Going back or refreshing mid-flow invalidates them. Start again from the sign-in page.
  • Nothing happens, or the wrong account signs in. The browser had a cached Microsoft session for a different account. Sign out of Microsoft in that browser, or use a private window, and click Continue with Microsoft again to get the account picker.
Start Free Trial Interactive Demo