Set up single sign-on with Microsoft Entra ID

This guide walks you through connecting Part3 to Microsoft Entra ID so the people at your company sign in with their Microsoft work account.

It's written for the person setting it up, usually someone in IT.

New to single sign-on? Start with Single Sign-On (SSO): Overview.

In this article we'll cover the following:

• Before you start
• Part 1: Register Part3 in Microsoft Entra
• Part 2: Add the connection in Part3
• Part 3: Check the configuration
• Part 4: Run a test sign-in
• Part 5: Turn on single sign-on
• Manage single sign-on
• Turn off single sign-on
• Troubleshooting

Before you start

You'll need:

• The right Part3 role. You must be an organization admin or an IT admin in Microsoft. See The IT admin role.
• A Part3 password for you and every other admin and IT admin on the domain. It's how an admin gets back in if signing in with Microsoft fails or single sign-on is set up wrong. Part3 checks for it before turning single sign-on on, and you need your own to turn it off. See Backup passwords.
• Your email domain added to Part3 (for example, acme.com). It needs to be verified before you can turn single sign-on on, but you can do Parts 1 to 4 while it verifies. See Verify your email domains.
• Access to Microsoft Entra that lets you register an application and assign people to it. Microsoft's Application Administrator or Cloud Application Administrator role covers every step in Part 1. See Microsoft's guides to registering an application and assigning users to it.
• A Microsoft account of your own on the domain, matching the email you use for Part3. You'll use it for the test sign-in.

Part 1: Register Part3 in Microsoft Entra

These steps happen in the Microsoft Entra admin center. Microsoft occasionally renames menus, so the labels may differ slightly.

Step 1: Go to Entra ID → App registrations and select New registration.

Step 2: Fill in the registration:

• Name: Part3. This is the name your team sees on the Microsoft sign-in page.
• Supported account types: Single tenant only (older versions of the page call it Accounts in this organizational directory only).

• Redirect URI: choose the Web platform and enter the address below. Part3 also shows it, with a Copy button, on the connection form in Part 2 and in each connection's Edit window:

  https://app.part3.ca/__/auth/handler   

Select Register.

Step 3: On the app's Overview page, copy these two values. You'll paste them into Part3 in Part 2.

• Directory (tenant) ID
• Application (client) ID

Step 4: Create a client secret. Go to Certificates & secrets → Client secrets → New client secret. Give it a description such as Part3, choose when it expires, and select Add.

Copy the secret's Value right away, because Entra only shows it once. Note the Expires date too. You'll enter it in Part3, which shows it on your connections list as a reminder to replace the secret before it stops working.

Step 5: Make sure Microsoft sends each person's email address. Go to Token configuration → Add optional claim, choose the ID token type, tick email and select Add. If Entra asks, tick Turn on the Microsoft Graph email permission.

Step 6 (recommended): Choose who can use Part3. Go to Entra ID → Enterprise apps, open Part3, and under Properties set Assignment required? to Yes. Then, under Users and groups, add the people or groups who use Part3. Include yourself.

Part 2: Add the connection in Part3

Step 1: In Part3, go to your Organization → Settings → Single sign-on, and select Set up single sign-on. If your organization already has a connection, select New connection instead.

Step 2: Choose domain. Pick the email domain your team signs in with, then select Continue. Members with an email on this domain will sign in through this connection.

If the domain isn't verified yet, Part3 says so and shows a Verify domain button. You can keep going and verify it in parallel.

Step 3: Set up connection. Microsoft Entra ID is already selected as the identity provider. Fill in the details from Part 1:

Continue stays greyed out until you've checked the configuration and run a test sign-in on this page. Part3 shows what's missing next to it.

Part 3: Check the configuration

Under Configuration checks, select Verify configuration. Part3 saves the connection, then reads what Microsoft publishes for your directory and checks it against what you entered. Nobody signs in during this check.

Each check shows Pass, Warn or Fail. Only Fail stops you from turning single sign-on on.

Under the checks, Part3 lists the addresses that can sign in through this connection: your domain, plus your secondary domain if you entered one. Anyone who comes back from Microsoft with a different address is refused.

If you change any details after a check, Part3 asks you to verify again.

Part 4: Run a test sign-in

The test sign-in shows exactly what Microsoft sends to Part3, without creating an account or changing who's signed in. You stay signed in to Part3 as yourself.

Step 1: Under Test sign-in, Run a test sign-in unlocks once Verify configuration passes. Part3 then gets the test ready in the background. If the button says Getting the test ready…, give it a moment.

Step 2: Select Run a test sign-in. A Microsoft sign-in window opens with your email already filled in. Sign in with your own Microsoft account, the one that matches your Part3 email. If your browser blocks the window, allow pop-ups for Part3 and try again.

Step 3: Back in Part3, the result shows who Microsoft signed in, for example "The test signed in as jane@acme.com", followed by:

• Whether that address matches someone in your organization, for example "Matched to a member of Acme Engineering."
• "This is your own account." You need this before you can turn single sign-on on.

When the checks pass and your test sign-in worked, select Continue. If an admin or IT admin on the domain has no Part3 password, Part3 names them here instead. Ask them to set one, then select Check again. Saving can take up to a minute.

Part 5: Turn on single sign-on

Step 1: Review the summary on the Ready to turn on single sign-on page:

• Domain: the domain that will sign in through Microsoft.
• Connection: the connection you just set up.
• Members affected: how many people in your organization are on that domain.

Part3 also lists anything that needs attention first:

• Admins need a password. Every organization admin and IT admin on the domain needs a Part3 password, so an admin can still get in to turn single sign-on off or switch connections if signing in with Microsoft fails. Ask them to set one (see Backup passwords below), then select Check again.
• Test sign-in with your own account first. Select Back to test sign-in and run the test with your own Microsoft account.
• Members without a password are listed for your information. They don't block anything. They'll only need a password if single sign-on is turned off later.

Step 2: Select Turn on single sign-on. Part3 runs the checks one last time. This takes a few seconds, so don't close the page.

Step 3: You'll see Single sign-on is on. Nobody is signed out. Members on your domain are sent to Microsoft the next time they sign in.

Select Go to settings to return to the Single sign-on tab, which now shows Single sign-on is on above your connections.

Manage single sign-on

Go to Organization → Settings → Single sign-on. Under Identity provider connections, each connection shows its domain, protocol, issuer, secret expiry date and whether it's Live. Select the ⋯ menu on a connection to:

• Check (on the live connection): re-run the configuration checks and a test sign-in. Select Run a test sign-in once to get the test ready, then again to open the Microsoft window.
• Make live (on any other connection): run the checks and a test sign-in the same way, then switch single sign-on to it. Nothing changes until you select Make live in the dialog.
• Edit: change the connection's details.
• Delete: remove a connection. A live connection can't be deleted, so turn single sign-on off or make another connection live first.

Replace an expiring client secret

Client secrets expire, and when the live connection's secret expires, your team can't sign in with Microsoft. Before the date in the Expires column:

Step 1: In Entra, create a new client secret for the Part3 app (see Part 1, Step 4) and copy its Value.

Step 2: In Part3, open the connection's ⋯ menu and select Edit.

Step 3: Select Replace client secret, paste the new value and update the Secret expiry date.

Step 4: Select Save and check. Part3 saves the change and re-runs the checks.

Move to a different Entra app

To use a different Entra app registration or directory, don't edit the live connection. Select New connection, set it up as in Parts 2 to 4, then use Make live on it. Single sign-on switches over, and you can delete the old connection afterwards.

Backup passwords

Once single sign-on is on, people on your domain sign in with Microsoft and don't need a Part3 password. A backup password is a Part3 password kept for emergencies:

• Organization admins and IT admins keep it while single sign-on is on, as a way back in if signing in with Microsoft fails. The sign-in page still sends them to Microsoft first. If that fails and Part3 shows an error, select Sign in with a password under Continue, then fix or turn off single sign-on. If Microsoft can't be reached and Part3 doesn't come back with an error, contact support@part3.io.
• Everyone else can use it once single sign-on is off. People who already had a Part3 account when single sign-on was turned on can also keep using their password until the first time they sign in with Microsoft.

To set one, go to Account Settings, find Backup password, enter it twice and select Set backup password. Part3 may ask you to sign in with single sign-on again to confirm it's you.

You only see this card if you sign in with single sign-on and don't have a Part3 password yet. If you already have a password, that's your backup password. Change it under Update your password.

Turn off single sign-on

Step 1: Go to Organization → Settings → Single sign-on and select Turn off on the Single sign-on is on banner.

Step 2: Read the confirmation. It lists any members who don't have a Part3 password. They'll need to use Forgot password? on the sign-in page before they can sign in again.

Step 3: Select Turn off single sign-on.

Everyone on the domain signs in with a Part3 password again. Your connection is kept, so you can turn single sign-on back on later with Make live.

Troubleshooting

Q: The test sign-in says "The sign-in window closed before the provider answered."

If you didn't close the window yourself, Microsoft probably refused the sign-in. Check that the Part3 app is assigned to your account under Enterprise apps → Part3 → Users and groups, then test again.

Q: The test says "The browser blocked the sign-in window."

Allow pop-ups for Part3 in your browser, then test again.

Q: The test says "The provider did not send an address Part3 can sign in with."

Add the email optional claim (Part 1, Step 5), then test again.

Q: The test says the provider sent an address that is not on my domain.

Part3 only accepts sign-ins for addresses on the connection's domain, or its secondary domain if you entered one. Test again with a Microsoft account on that domain. If it's your own account, check that its email in Entra matches your Part3 email.

Q: The test says "Part3 did not accept its sign-in token" or "The sign-in service did not accept this connection."

Check the Directory (tenant) ID and Application (client) ID, and that the redirect URI in Entra matches Part 1, Step 2 exactly.

Q: It says "This is not your own account."

Someone else's Microsoft account signed in, often because the browser picked an account that was already signed in. Run the test again and choose your own account.

Q: Turning on says "Domain already in use."

Another Part3 organization already uses this domain for single sign-on. Contact support@part3.io.

Q: Turning on says "Your account has no password."

Set a backup password on your own account (see Backup passwords), then try again.

Q: A team member says Part3 sent them to Microsoft and it didn't work.

Check that they're assigned to the Part3 app in Entra and that their Microsoft account has an email on your domain. If it still fails, contact support@part3.io with the error they saw.

Q: I don't see the Single sign-on tab.

Only organization admins and IT admins see it, and only once single sign-on is enabled for your organization. Contact support@part3.io.