SSO with Microsoft Entra ID (Azure AD)

With deskbird, you can integrate Single Sign-On (SSO) using Microsoft Entra ID (formerly Azure AD). This ensures secure authentication and convenient access across your organization.

1. Set up SSO with Entra ID
2. Manual OIDC setup (no Enterprise Application required)
3. Restrict permissions via Application Assignment
4. FAQs

1. Set up SSO with Entra ID

To activate SSO, an IT administrator must install the Microsoft Entra ID Enterprise Application and grant the required permissions.

👉 Click here to install and grant access:
https://login.microsoftonline.com/common/adminConsent?client_id=60e10e49-86e8-4755-ac34-2804c82237c6&redirect_uri=https://www.deskbird.com/single-sign-on-via-azure-ad

⚠️ Note on Microsoft Conditional Access: Since June 2026, Microsoft enforces Conditional Access more strictly for some sign-ins (Microsoft change MC1223829). If one of your policies targets All resources and has at least one resource exclusion, sign-ins that only request basic scopes (such as openid, profile, email or User.Read) are now evaluated against that policy. The deskbird sign-in requests only these scopes (openid, profile, email, User.Read), so excluding deskbird from such a policy no longer skips these checks. Users may therefore be asked for MFA or a compliant device, or be blocked, when signing in to deskbird, even though it worked before. Microsoft describes the options for your IT team in Enforcement for baseline scopes in Conditional Access.

If your users are affected and your IT team cannot adjust the policy, you can switch deskbird to a login that your organization configures itself: Manual OIDC setup (below) or SSO with SAML 2.0. To tell a Conditional Access block apart from a missing admin approval, see FAQs.

The required permissions are:

• User.Read: Allows users to sign in to deskbird and allows deskbird to read the profiles of signed-in users. Note: deskbird has no access to the profile data of users who have never signed in.
• Group.Read.All: Allows deskbird to read all user groups. This is used, for instance, to import user groups in the admin portal or to sync groups when users sign in.

There are additional standard permissions that are automatically added and don't require admin consent.

• offline_access: Allows deskbird to use refresh tokens to retrieve data via the Microsoft Graph API.
• email, openid, and profile: Automatically added permissions that grant deskbird similar permissions as User.Read but with less profile information.

The permission type is delegated, meaning that deskbird accesses the Graph API as the signed-in user but with access limited by the selected permission.

💡 Note: User profile pictures are automatically synced during the first SSO authentication, if available.

💡 If SSO is configured as the only login method for your organization, this restriction applies to internal users only. External users (e.g. contractors) can still be added to deskbird and can use email and password to log in, as they fall outside your identity provider's scope.

2. Manual OIDC setup (no Enterprise Application required)

If your organization cannot install the deskbird Enterprise Application from the Microsoft app gallery, or if it prefers an app registration that it owns and controls, you can set up SSO by creating your own App Registration in Entra ID and sharing the credentials with deskbird. The integration is then configured by the deskbird support team.

Step 1: Create the App Registration

1. Go to Azure Portal > Microsoft Entra ID > App registrations > New registration.
2. Enter a name, for example deskbird SSO.
3. Under Supported account types, select Accounts in this organizational directory only (single tenant).
4. Under Redirect URI, select the platform Web and enter: https://api.deskbird.app/v2/auth/oAuthRedirectHandler.
5. Click Register.

⚠️ Note: Make sure the Redirect URI matches exactly the one above. A mismatch (or a missing entry) will cause an AADSTS50011 error when a user tries to sign in.

Step 2: Note the IDs

1. From the app's Overview page, copy the Application (client) ID and the Directory (tenant) ID.

Step 3: Create a Client Secret

1. Go to Certificates & secrets > Client secrets > New client secret.
2. Enter a description, for example deskbird production, and choose an expiry duration.
3. Click Add and copy the Value immediately — it will not be shown again.

Step 4: Configure API permissions

1. Go to API permissions > Add a permission > Microsoft Graph > Delegated permissions.
2. Add the following permissions: openid, profile, email, User.Read.
3. Click Grant admin consent for [Organization].

Step 5: Share credentials with deskbird

Contact deskbird support and provide the following three values:

• Directory (tenant) ID
• Application (client) ID
• Client Secret value

Please share all three values in one message so the setup can be completed without back-and-forth: Directory (tenant) ID, Application (client) ID, and Client Secret value.

The deskbird support team will complete the configuration on your behalf.

⚠️ Note: The Client Secret value is sensitive. Share it securely and avoid sending it over unencrypted channels.

3. Restrict permissions via Application Assignment

You can restrict which users or groups are allowed to access deskbird using SSO.

• In the Entra admin center, open the deskbird Enterprise App.
• Under Properties, set Assignment required to "Yes".
• Add specific users or groups under Users and groups.

💡 Application Assignment is not the same as Conditional Access policy scoping. Application Assignment controls who may sign in. Conditional Access controls under which conditions they may sign in (device compliance, location, MFA). For Conditional Access, see the note in Set up SSO with Entra ID and the FAQs.

⚠️ Application Assignment restricts sign-in access, but does not provision users. For automated provisioning, a separate SCIM configuration is required.

⚠️ AADSTS50105 error: This error occurs when someone tries to sign in but isn't assigned to a group that's allowed access. Ask your internal IT team to add the user to the correct access group (or update their permissions), then try again.

4. FAQs