Connect Microsoft Entra ID to Kanroo

Configure SSO using an existing Microsoft Entra ID workforce tenant. The basic flow was manually tested with Entra ID Free in September 2026. Tenant creation is outside this guide. See SSO help for personal Settings, account linking, and multiple organizations.

Before you start

• SSO must be available: any hosted plan or self-hosted Enterprise.
• Sign in to Kanroo personally by email as the organization owner.
• Have Entra permissions to register applications, assign users, and grant admin consent.
• Keep the owner’s and members’ Kanroo mailboxes accessible for initial email verification.
• Kanroo’s server and the browser must reach Microsoft over HTTPS. Self-hosted operators must configure the OIDC encryption keyring before storing a client secret.

1. Register the application

Copy the Redirect URL from Kanroo’s Settings → SSO. In Entra, open Entra ID → App registrations → New registration:

Setting	Value
Name	Kanroo
Supported account types	Accounts in this organizational directory only / Single tenant
Redirect URI platform	Web
Redirect URI	The exact Callback URL copied from Kanroo

Register the application. On Overview, copy Application (client) ID and Directory (tenant) ID. See Microsoft’s registration guide.

Open Certificates & secrets → Client secrets → New client secret. Choose a description and an expiration, then add it. Copy Value, not Secret ID, before leaving the page. Keep it private and replace the secret in Kanroo before it expires.

Kanroo currently uses client-secret authentication. Microsoft recommends certificate or federated credentials for production; those methods are not currently supported by Kanroo’s OIDC settings. See Microsoft’s credential guidance.

2. Assign users and include their email

Under Entra ID → Enterprise applications → Kanroo → Properties, set Assignment required? → Yes and save. Under Users and groups → Add user/group, assign the owner and intended members individually. An Entra administrative role is not needed to use Kanroo. See Microsoft’s assignment guidance.

For each user, set Users → user → Properties → Contact information → Email to their accessible Kanroo email address. Their Microsoft sign-in name can remain name@your-tenant.onmicrosoft.com; that name and the email address serve different purposes.

Return to App registrations → Kanroo:

1. Under Token configuration → Add optional claim, choose token type ID, select email, and add it. Accept adding the email permission if prompted.
2. Under API permissions, add Microsoft Graph Delegated permissions openid and email if missing. The default User.Read permission is not needed for Kanroo sign-in.
3. Select Grant admin consent for … and confirm. Admin consent is required when assignment is mandatory; users cannot grant consent themselves in that configuration.

See optional claims and assignment and consent.

3. Connect the organization

(enlarge)

In Kanroo’s Settings → SSO, check that the Redirect URL (box 1) is the one you registered, then enter these values in the provider fields (box 2):

Field	Value
Issuer URL	https://login.microsoftonline.com/<tenant-id>/v2.0
Client ID	Application (client) ID
Client Secret	The secret’s Value

Replace <tenant-id> with the Directory (tenant) ID UUID. Use this tenant-specific issuer, not common, organizations, or a /.well-known/… URL. See Microsoft’s issuer validation guidance.

Choose Save draft (box 3), then select Test and connect. Sign in with the owner’s assigned Microsoft user, complete any required password change or MFA enrollment, then enter the Kanroo email code. The provider should show Connected. Keep Require SSO off until member access works.

Microsoft can automatically reuse an existing Microsoft account. Use the intended account for this connection. If the wrong account keeps being selected, see choosing a different account.

4. Check member access and require SSO

Invite members in Kanroo, or enable automatic joining (JIT) to admit assigned Entra users as Members, subject to organization limits. On Kanroo’s sign-in page, members choose Continue with SSO and enter the organization’s slug, or open the SSO sign-in link you copy from Settings → SSO, which preselects the organization.

The first login requires Kanroo email verification. If Microsoft supplies no email claim, Kanroo asks for an address and verifies it. Later login with the same linked identity does not repeat the linking code. Existing roles stay unchanged; a new JIT member receives Member access.

As the owner, generate Recovery codes under Settings → SSO, verify the email code, save the codes, and acknowledge their storage. Enable Require SSO. In a separate session, sign a member in personally: accessing this organization must require an Entra login.

For recovery, provider-session behavior, and offboarding, see SSO help. Remove departing members in Kanroo too; disabling them in Entra alone does not immediately revoke existing Kanroo SSO access.