Set up SSO with Entra ID

Set up SSO with Entra ID

For IT admins: register TxHub as an app in Microsoft Entra ID, add the redirect URIs and a client secret, and send TxHub the details to turn on single sign-on.

Single sign-on lets people in your organization sign in to TxHub with their Microsoft work account, on the dashboard and when they connect a device. Your organization owns the app registration in its own Microsoft Entra ID directory, so you stay in control of who can sign in. This page is for the IT admin who manages Entra ID. It takes about ten minutes.

What you will send TxHub

When you have finished the steps below, send these to info@txhub.is:

ItemWhere to find it
Directory (tenant) IDThe app’s Overview page in Entra ID. A GUID.
Application (client) IDThe same Overview page. Also a GUID.
Client secretThe secret’s Value, shown once when you create it.
Email domainsThe domains people sign in with, for example acme.com.
Important
The client secret is a password for the app. Send it through a channel you trust, such as a password manager share, not in plain email. TxHub stores it encrypted and never shows it again.

Set up the app in Entra ID

Open each step in turn. You need a role that can register apps, such as Application Administrator.

1. Register the app
  1. Sign in to the Microsoft Entra admin center.
  2. Go to Identity → Applications → App registrations and click New registration.
  3. Enter a Name, such as TxHub. People may see it on the Microsoft sign-in page.
  4. Under Supported account types, choose Accounts in this organizational directory only (single tenant).
  5. Under Redirect URI, choose the platform Web and enter the first address from step 2.
  6. Click Register. Copy the Application (client) ID and Directory (tenant) ID from the Overview page.
2. Add both redirect URIs

TxHub signs people in from two places: the dashboard, and devices joining your TxNet. Both addresses must be on the app, or that kind of sign-in fails with a redirect URI error.

  1. In the app, open Authentication. Under Web → Redirect URIs, make sure both of these are listed, then click Save:
https://app.txhub.is/api/auth/callback
https://control.txhub.is/a/callback

Leave Access tokens and ID tokens under implicit grant unticked. TxHub uses the authorization code flow and doesn’t need them.

3. Create a client secret
  1. Open Certificates & secrets, then Client secrets, and click New client secret.
  2. Enter a description, such as TxHub, and choose when it expires.
  3. Click Add and copy the Value straight away. It is shown only once. The Secret ID next to it is not the secret.
Note
Put the expiry date in your calendar. When the secret expires, nobody in your organization can sign in to TxHub until TxHub has a new one. See Rotate the client secret.
4. Check the permissions

TxHub only asks Microsoft who the person is. It needs the delegated permissions openid, profile and email, and reads no other data from your directory.

  1. Open API permissions. A new app already has Microsoft Graph → User.Read; you can keep it.
  2. Click Add a permission → Microsoft Graph → Delegated permissions, tick openid, profile and email, and click Add permissions.
  3. Click Grant admin consent so that people aren’t asked to consent the first time they sign in.
5. Optional: choose who can sign in

By default anyone in your directory can sign in to the app. To limit it to certain people or groups:

  1. Go to Identity → Applications → Enterprise applications and open the app.
  2. Under Properties, set Assignment required? to Yes and save.
  3. Under Users and groups, add the people or groups who should use TxHub.

Signing in to Microsoft is not enough on its own: a person also needs to be a member of a TxNet, either added by an admin or through auto-join. See Organizations and users.

6. Send the details to TxHub

Send the tenant ID, client ID, client secret and email domains to info@txhub.is. TxHub connects your directory and confirms when single sign-on is on. From then on:

  • People with an address at your domains are always sent to Microsoft to sign in.
  • Password sign-in stops working for those addresses, even if a password was set before.
  • Your organization’s managers can turn on auto-join and send invites under SSO in the dashboard.

Which address TxHub uses

TxHub identifies a person by their email address when Microsoft marks it as verified, and otherwise by their sign-in name (the user principal name, such as ada@acme.com). In most directories that is the sign-in name, so its domain must be one of the domains you send TxHub.

If some people sign in as name@acme.onmicrosoft.com or another domain, include that domain too, or change their sign-in name in Entra ID. A token is only accepted from your own tenant, so another organization can’t sign in as your domain.

Rotate the client secret

  1. Create a new client secret on the app, as in step 3. Keep the old one for now.
  2. Send the new value to info@txhub.is and wait for TxHub to confirm it is in use.
  3. Delete the old secret in Entra ID.

Do this well before the old secret expires, so nobody is locked out.

Troubleshooting

What you seeWhat to do
Microsoft says the redirect URI does not match (AADSTS50011)One of the two redirect URIs is missing or mistyped. Add both exactly as in step 2.
Microsoft says the client secret is invalid or expired (AADSTS7000215, AADSTS7000222)Create a new secret and send it to TxHub. See Rotate the client secret.
Microsoft says the person is not assigned to the app (AADSTS50105)Assignment is required on the app. Add the person or their group under Users and groups.
Microsoft asks for consent, or says an admin must approveGrant admin consent under API permissions (step 4).
“No network access yet” after signing inSign-in worked, but the person isn’t in a TxNet. Add them, or turn on auto-join for your domain.
The person is asked for a password instead of being sent to MicrosoftTheir address is at a domain TxHub doesn’t know yet. Send TxHub the domain.

For how people sign in once this is set up, see Sign-in and SSO.