SSO with Microsoft Entra ID

Create an enterprise application in Microsoft Entra ID and link it to your Keycard organization. For what SSO does after setup, see Single Sign-On.

• The Admin organization Role in Keycard.
• The Cloud Application Administrator role or higher in Entra ID.
• The User Administrator role in Entra ID, if any user is missing an email address.

1. Copy the Redirect URL

   In Keycard Console, open Settings → Connection and copy the Redirect URL.

2. Create the enterprise application

   In the Microsoft Entra admin center, go to Enterprise applications → New application → Create your own application. Enter a name, select Integrate any other application you don’t find in the gallery (Non-gallery), and click Create.

3. Add the redirect URI

   Go to App registrations and open the application. Under Authentication, click Add Redirect URI → Web and enter the Redirect URL from step 1.

4. Create a client secret

   Under Certificates & secrets, create a new client secret and copy its Value, not its Secret ID. From Overview, copy the Application (client) ID and Directory (tenant) ID.

5. Grant admin consent

   Under API permissions, select Add a permission → Microsoft Graph → Delegated permissions, select openid, profile, and email, and select Add permissions. Then select Grant admin consent for your tenant and confirm. Users can’t consent to an app that requires assignment.

6. Link Entra ID to Keycard

   In Keycard Console, open Settings → SSO, or use the Keycard Terraform provider. Turn on Enable SSO and fill in:

   Field	Value
   Identifier	https://login.microsoftonline.com/<tenant-id>/v2.0
   Client ID	The Application (client) ID from step 4
   Client Secret	The client secret from step 4

   

   Click Save SSO Configuration.

7. Set the home page URL

   In Keycard Console, copy the Initiate Login URI from Settings → SSO under Provider Configuration. In App registrations, open the application, then Branding & properties, and paste it into Home page URL.

8. Assign users and show the tile

   In Enterprise applications, open the app. Under Users and groups, assign the users who sign in to Keycard. On Properties, check that Assignment required? is Yes, and that Visible to users? is Yes so the tile appears in My Apps.

9. Check email addresses

   Every user who signs in needs an email address in Entra ID. Keycard creates each User from the ID token’s email claim, and Entra ID leaves that claim out for accounts with no email address. A User Administrator can add one: in Users, select the user, select Edit properties, and enter it under Contact info. For users synced from Windows Server Active Directory, set it there.

Sign in from the Keycard tile in My Apps. In Keycard Console, open People and confirm the User appears. New Users join as Viewer; see User Roles and Access.

To provision Users and Groups before they sign in, see Provision from Microsoft Entra ID.

The redirect URI does not match the Keycard Redirect URL. Copy it again from Settings → Connection and check that it was added under the Web platform.

The SSO configuration wasn’t saved, or the Home page URL was edited or copied incompletely. Save it in Settings → SSO and copy the Initiate Login URI again.