Admincontrol Single Sign-on (SSO) with Microsoft Entra ID

Overview

In this article, you’ll find a step-by-step guide on how to set up Microsoft Entra ID Single Sign-On (SSO) towards Admincontrol for your tenant/company.

Microsoft Entra ID, formerly known as Azure Active Directory (Azure AD), is a cloud-based identity and access management service that allows seamless integration of applications through SSO, enhancing security and user experience.

The setup takes places in the Entra ID portal, and also the Admincontrol AD Integration setup page.

Entra ID portal

An Enterprise application is created and properties are collected/created here and also in the belonging App registrations application.

Admincontrol AD Integration setup page

Here you will insert credentials, get the redirect URI and at the end activate the SSO.

Please follow this step by step guide to activate Entra ID SSO:

1 Log in to Entra ID portal

Log into your Entra ID admin account, as "Cloud Application Administrator" or higher.

2 Go to Enterprise applications

Search for Enterprise applications in the top bar and select it under services

3 Click "New application"

On the Enterprise applications page, click "New application"

4 Click "Create your own application"

On the following page, clik "Create your own application"

5 Name it "Admincontrol"

6 Select third option, non-gallery

Enter Admincontrol, select the last option "Integrate any other application you don't find in the gallery (Non-gallery)" and click "Create"

7 Click "Create"

8 Go to "App Registrations"

Go to "App Registrations" by searching for it in the top bar as shown in the screenshot below.

9 Click "All applications"

Its the first of the 3 tabs on the App registrations page

10 Click "Admincontrol"

Locate the App registration named "Admincontrol" and click it.

11 Collect Application (client) ID

Copy the value into a temporary document, reference it as "OIDC client ID"

12 Click "Add a certificate or a secret"

On the same page, click the link shown below

13 Click "New client secret"

Locate the button and click it

14 Enter description and expiry length

Write "Admincontrol" in description and select 730 days as expires length.

IMPORTANT: Please set a timely alert to ensure the renewal and update of this secret, as it will expire in two years. You can configure the alert using a method that suits your needs. Currently, Microsoft does not support a built-in alert method in the Entra ID portal. Instructions for updating the secret are provided in a separate section on this page.

15 Click "Add"

16 Collect secret

Copy by clicking the copy-button after Value and paste it into a temporary document, reference it as "OIDC Client Secret"

NOTE: After you navigate away from this page the secret will not be visible ever again. If you need it for anything else at some point later, please store it in a secure tool/location. Alternatively a new secret can be created and used.

17 Go to Overview in the Admincontrol App registration

Locate the "Overview" as shown below and click it.

18 Collect tenant id and save it as OIDC Issuer Url

In your temporary document, you will now be storing a third value, reference it as OIDC Issuer Url.

Copy the value of "Directory (tenant) ID" into https://login.microsoftonline.com/[tenant-id]/v2.0 and compose a url.

The output will be like this.

https://login.microsoftonline.com/00000000-0000-0000-0000-000000000000/v2.0

Store it in your temporary document, reference it as "OIDC Issuer Url".

19 Click "Api Permissions"

20 Click "Add a permission"

In the middle of the page, click the "Add a permission" button

21 Click "Microsoft Graph"

In the following modal, click the top API suggestion, "Microsoft Graph"

22 Click "Delegated permissions"

In the following view, click "Delegated permissions"

23 Select "openid" and "profile"

A new section of the view appears, here you need to go down to the "OpenId permissions" section and check "openid" and "profile".

24 Click "Add permissions"

Below the checked boxed, you will find the "Add permissions" button, click it.

25 Click "Grant admin consent for Admincontrol"

In the middle of the page, locate this button and click it.

26 Go to Enterprise applications

Search for "Enterprise applications" in the top search bar in Entra ID portal, and select it

27 Click on the "Admincontrol" Enterprise application

Search for "Admincontrol" and click on the application found.

28 Go to "Users and groups"

Expand the "Manage" area and click on "Users and groups".

29 Add users and groups

Here you need to add all users/groups that should have access to Admincontrol login.

To minimize maintenance its recommended to add groups, not single users, but you are free to do anything that makes sense for your company's usage here.

IMPORTANT: Any user in your tenant that needs access to Admincontrol needs to be here. If a user is not included by user or group the login to Admincontrol will be denied. (This only applies to the registered domain(s), other users that might be in the portal with different username domains will log in like before without Entra ID)

Adding users is a broader area and if you need directions please take a look at the Microsoft documentation: https://learn.microsoft.com/en-us/entra/identity/enterprise-apps/assign-user-or-group-access-portal?pivots=portal

30 Enable Microsoft Entra multifactor authentication

Create a Conditional Access policy and enable Microsoft Entra multifactor authentication for all users of the Admincontrol Enterprise Application. This is a requirement in order to use Entra ID SSO with Admincontrol.

Please follow the documentation from Microsoft: https://learn.microsoft.com/en-us/entra/identity/authentication/howto-mfa-getstarted#plan-conditional-access-policies

31 Contact Admincontrol, acquire AD Integration

Reach out to your Admincontrol contact to enable AD Integration for for your domain(s).

32 Go to Admincontrol AD Integration setup page

Navigate to https://login.admincontrol.net/settings/adintegration

33 Log in to Admincontrol AD Integration setup page

You will log in with the username provided by Admincontrol at the point of the acquirement of the AD Integration. After login you will see this page:

NOTE: Please note that this page has a short session duration. You will be automatically logged out after 15 minutes of inactivity.

34 Paste in your OIDC Client ID

The OIDC Client ID is located in your temporary document, collected in step 11, referenced as "OIDC Client ID". Paste it into the first text input field, with the matching name.

35 Paste in your OIDC Client Secret

The OIDC Client Secret is located in your temporary document, collected in step 16, referenced as "OIDC Client Secret". Paste it into the second text input field, with the matching name.

36 Paste in your OIDC Issuer Url

The OIDC Issuer Url is located in your temporary document, collected in step 18, referenced as "OIDC Issuer Url". Paste it into the third and last text input field, with the matching name.

37 Click "Save"

Values will be saved, but SSO is still not enabled.

38 Collect the "Redirect URI"

Click the copy button you see below and paste it into your temporary document. Reference it as "Redirect URI".

39 Go to Entra ID portal

40 Go to "App Registrations"

Go to "App Registrations" by searching for it in the top bar as shown in the screenshot below.

41 Click "All applications"

Its the first of the 3 tabs on the App registrations page.

42 Click "Admincontrol"

Locate the App registration named "Admincontrol" and click it.

43 Click "Authentication" in the "Manage" section

In the Admincontrol App registration left menu, expand "Manage" and click Authentication

44 Click "Add a platform"

Click the button as specified in the screenshot below

45 Select "Web"

In the modal, select "Web" as shown below.

46 Paste in your Redirect URI and press Configure

The Redirect URI is located in your temporary document, collected in step 38, referenced as "Redirect URI". Paste it into the text input field for Redirect URI.

47 Go to Admincontrol AD Integration setup page

Navigate to https://login.admincontrol.net/settings/adintegration

48 Log in to Admincontrol AD Integration setup page

You will log in with the username provided by Admincontrol at the point of the acquirement of the AD Integration. After login you will see this page:

49 Enable SSO

Toggle the Enable SSO ON by pressing the toggle as shown below. This is how it looks after pressed.

You are DONE, all Admincontrol logins on our domains are now done with your Entra ID tenant.

Login - changes affected after completed setup

After the setup is done, your end users will be redirected to your tenant for login, this is based on the domain of the username.

After successful Entra ID login, the user will be logged into their matching Admincontrol user.

How to update expired app registration oidc client secret

This needs to be done before the current OIDC client secret expires. Once you have created a new secret in the Entra ID portal, you can set it to be used. Multiple secrets can coexist, so there is no need to wait for the exact expiration date. Please follow the steps to complete the change to the new OIDC client secret.

1 Go to Entra ID portal

2 Go to "App Registrations"

Go to "App Registrations" by searching for it in the top bar as shown in the screenshot below.

3 Click "All applications"

Its the first of the 3 tabs on the App registrations page.

4 Click "Admincontrol"

Locate the App registration named "Admincontrol" and click it.

5 Expand "Manage" and click "Certificates & secrets"

Click "Certificates & secrets" in the left menu, under the "Manage" section.

6 Click "New client secret"

In the "Client secrets" tab, click "New client secret

7 Enter description and expiry length

Write "Admincontrol" in description and select 730 days as expires length.

8 Click "Add"

9 Collect secret

Copy by clicking the copy-button after Value and paste it into a temporary document, reference it as "OIDC Client Secret"

10 Go to Admincontrol AD Integration setup page

Navigate to https://login.admincontrol.net/settings/adintegration

11 Log in to Admincontrol AD Integration setup page

You will log in with the username provided by Admincontrol at the point of the acquirement of the AD Integration. After login you will see this page:

12 Click "Set new OIDC Secret"

Locate the button "Set new OIDC Secret" and click it.

13 Paste in your new "OIDC Client Secret"

The OIDC Client Secret is located in your temporary document, collected in step 9, referenced as "OIDC Client Secret". Paste it into the text input field as shown below.

14 Press Save

The following confirmation is displayed.

We are now using the new secret.

Good to know

User provisioning is currently not supported, meaning Admincontrol will not be aware of the user's status in Entra ID, except during the login process itself. Consequently, users might appear active within the solution even if their AD account is deactivated or removed.

Offboarding is still supported for authentication, as new logins will be blocked by AD. However, if the user needs to be shown as inactive for admins in the Admincontrol portal, the admin must also deactivate the user there.

Electronic ID logins will not be possible for end users if their account belongs to a domain requiring Entra ID login. This is because Admincontrol cannot determine the current status of the AD user, and we need to prevent any potential backdoor access for offboarded AD users.

Onboarding with an Entra ID user is supported, but an invite is required, and the signup forms needs to be submitted before the user start logging in with Entra ID.

Error situations

User is told that electronic id login is not allowed - This is correct, login must be done with Entra ID

Errors like this on Entra ID login: "The user account does not exist in the tenant Admincontrol and does not have access to the application xxx in this tenant. The account must be added as an external user in the tenant first. Please use a different account." Normally this is solved by one of the two following solutions:
- If user should have access to any Admincontrol portal with this user, the user needs to exist both in the tenant and in the userlist of the Admincontrol Enterprise application.
- It could be that this user is registered with a different username in Admincontrol, and if this is the case the user needs to do a login with that username instead

No Admincontrol user is found. Two possible fixes:
- Get an invite to a portal for this user
- Log in with a different user
Entra ID login is not working for any reason, and users are blocked to log in - Turn off SSO in settings on Admincontrol setup page, or contact support to disable it.