Microsoft Entra ID SSO Login Configuration

Purpose

This guide explains how to let users from Microsoft Entra ID (formerly Azure AD) log in to Logsign USO with their Microsoft account. You register an application in Entra ID, give Logsign its Client ID, Tenant ID and Client Secret, sync the Entra ID users into Logsign and assign them a role. From then on, those users are sent to the Microsoft sign-in page when they log in, and their password never reaches Logsign.

The same Entra ID integration in Logsign is also used for identity and device sync and as a Response integration. This guide covers the login part; the credentials are shared.

If your users live in on-premises Active Directory instead, see LDAP Configuration and LDAP Users Login. For Google Workspace, see Google Workspace SSO Login Configuration.

How the Login Works

1. The user opens Logsign, types their username and clicks Next.
2. Logsign sees that the user was synced from Entra ID and redirects the browser to the Microsoft sign-in page of your tenant.
3. The user signs in to Microsoft, including any Conditional Access or MFA your tenant enforces.
4. Microsoft redirects the browser back to https://<logsign-address>/login with an authorization code, and Logsign exchanges it for tokens directly with Microsoft.
5. Logsign takes the preferred_username from the ID token (normally the UPN, such as jane.doe@contoso.com), uses the part before @, and matches it to a Logsign user synced from the same Entra ID integration. If Logsign two-factor authentication is enabled for that user, the 2FA step follows. The dashboard then opens.

The round trip must complete within 2 minutes of step 2. If it takes longer, the login fails and the user must start again from the username step.

Prerequisites

Step 1: Register an Application in Microsoft Entra ID

1. Sign in to the Microsoft Entra admin center and go to Identity > Applications > App registrations.
2. Click New registration. Enter a name such as Logsign USO and choose Accounts in this organizational directory only.
3. Under Redirect URI, choose platform Web and enter https://<logsign-address>/login. Click Register.
4. On the Overview page, copy the Application (client) ID and the Directory (tenant) ID.

Important: the redirect URI must match exactly, including https:// and the /login path, and it must be registered under the Web platform, not Single-page application. Correct: https://siem.contoso.com/login. Wrong: https://siem.contoso.com. A mismatch makes Microsoft stop the login with error AADSTS50011.

Create a client secret

1. Open Certificates & secrets and click New client secret.
2. Enter a description, choose an expiry and click Add.
3. Copy the secret Value (not the Secret ID) immediately. It is shown only once.

Note the expiry date. When the secret expires, Entra ID logins to Logsign and the identity sync stop until you create a new secret and enter it in Logsign.

Grant API permissions

Open API permissions, click Add a permission, choose Microsoft Graph and add the following, then click Grant admin consent:

Step 2: Configure Microsoft Entra ID in Logsign USO

1. Go to Settings > Integrations > Responses, search for Microsoft Entra ID, click Configure and click +Device.
2. Fill in the fields below and save.

Step 3: Add the Users to Logsign

SSO only logs in users who already exist in Logsign. It never creates users.

1. Go to Settings > Enrichment > Identities, click Sync Ldap, select the Microsoft Entra ID integration and sync.

   

2. Select the users who should have access and click Apply Role Selected.
3. In the Add Logsign User window choose the role and save.

Manual sync always works regardless of the Sync Interval, and a failure in one source does not stop the others from syncing. The added users can now log in as described in How the Login Works.

Behavior to Be Aware Of

• A user synced from Entra ID cannot log in to Logsign with a password. Logsign always redirects them to Microsoft.
• Entra ID Conditional Access and Microsoft MFA apply at the Microsoft sign-in step. Logsign two-factor authentication, if enabled for the user, applies in addition.
• Disabling a user in Entra ID stops their next Microsoft sign-in. Disabling the user in Logsign also blocks them regardless of Entra ID.

Troubleshooting

For every failed login Logsign records the exact reason in its API service log. If the table above does not explain the problem, contact Logsign Support with the time of the failed attempt and the username.