Book a Demo
Skip to main content
How can we help?
← Back to LocoDELEGATIONS Help
Print

Configure Microsoft Entra ID single sign-on

Posted
Updated
ByAdrian Sole

Use this checklist to prepare a Microsoft Entra ID application for LocoDELEGATIONS. Complete the work with a council IT administrator and coordinate the final connection with LocoSOFT.

Downloadable setup guide: Use the screenshot-led PDF alongside the checklist below.

Download the Microsoft Entra ID Setup Guide

1. Register the application

  1. In the Microsoft Entra admin centre, create a new app registration.
  2. Use a recognisable name such as LocoDELEGATIONS.
  3. Select accounts in this organisational directory only.
  4. Add the council-specific LocoDELEGATIONS address followed by /signin-oidc as a Web redirect URI.
  5. Record the Directory (tenant) ID and Application (client) ID.

2. Configure authentication

  • Add the council-specific LocoDELEGATIONS address followed by /signout-oidc as the front-channel logout URL.
  • Enable the ID-token setting required for the LocoDELEGATIONS sign-in flow.

3. Include security-group claims

In the app registration manifest, ensure the group-membership claim is configured as:

"groupMembershipClaims": "SecurityGroup"

This allows LocoDELEGATIONS to check the user’s Microsoft Entra security-group memberships at sign-in.

4. Create the application credential

Create a client secret using an expiry period that complies with the council’s security policy. Record the secret value securely when it is created; Microsoft Entra will not display the complete value again.

5. Configure Microsoft Graph permissions

For the current security-group-based LocoDELEGATIONS configuration, add these Microsoft Graph application permissions:

  • User.Read.All
  • GroupMember.Read.All

Grant administrator consent for both permissions.

6. Record the enterprise application identifier

Open the corresponding enterprise application and record its Object ID.

7. Coordinate the connection

Contact LocoSOFT to arrange secure transfer of the required tenant, application, enterprise-application and group Object IDs, together with the client secret. Do not send the client secret through ordinary email unless a secure method has been expressly agreed.

Table of Contents