Microsoft Entra ID single sign-on

An owner or admin configures the connection in Settings → Single sign-on. To create and deactivate members or assign their Cust roles automatically, also follow Microsoft Entra ID provisioning.

Before you begin

• Your Cust organization has access to Single sign-on settings. Contact support@cust.co if you need it enabled for your plan.
• You can register a web application and manage its assignments in your Microsoft Entra tenant.
• You can publish DNS records for the email domains your team uses.

Select the EU or US region at the top of these docs to match your organization. Copy connection values from that organization's settings.

A new user signing in through SSO joins as a Member. Existing accounts with the same email are retained. Configure SCIM when Entra should assign a different Cust role; an app role in a sign-in token does not assign that role in Cust.

1. Register the sign-in application

1. In Cust's Single sign-on settings, select Other OpenID Connect provider. Copy the complete Callback URL.
2. In the Microsoft Entra admin center, open Entra ID → App registrations → New registration.
3. Name the application Cust and select the single-tenant account type for your organization.
4. Register the application. Under Authentication, add a Web platform and set its redirect URI to the Callback URL copied from Cust. If the registration form offers a redirect URI field, you can set it there instead.
5. On the app's Overview, copy Application (client) ID and Directory (tenant) ID.
6. Under Certificates & secrets, create a client secret. Copy its Value while it is shown and record its expiry date.

Use the secret's value, not its secret ID. The callback includes your Cust configuration identifier, so copy it exactly, including its path.

Microsoft's app registration guide and credential guide cover the portal controls in more detail.

2. Save the connection in Cust

Enter these fields under Identity provider:

Select Save. Use your tenant-specific issuer, rather than a common or organizations endpoint. Keep the /v2.0 suffix and omit /.well-known/openid-configuration from the value entered in Cust.

When editing an existing connection, leaving Client secret blank keeps its stored value. Replace it in Cust before the Entra secret expires, then test sign-in before retiring the previous secret.

3. Verify your email domains

1. In Cust, add each domain used by the team's sign-in email addresses under Domains.
2. Publish the displayed TXT record with your DNS provider. Copy its host and value exactly.
3. Select Verify once the record is available.

Verify each required subdomain separately. Use domains your organization controls; public email-provider domains cannot be added.

Cust uses the email supplied by Entra. For accounts without an email claim, it can use the Entra sign-in name (preferred_username, normally the UPN). That address must still belong to a verified domain. If you also use SCIM, map the same identity for provisioning.

4. Assign access and test sign-in

1. In Entra, open the Enterprise application corresponding to the sign-in app registration.
2. If access should be limited to assigned people, set Assignment required? to Yes in its Properties, then assign your test user under Users and groups.
3. In Cust, turn on Enable single sign-on.
4. In a private browser window, open the Cust sign-in page for the same region. Enter the test user's work email and continue through Entra.
5. Confirm the user reaches the intended Cust organization and has the expected role.

The app registration holds the sign-in credentials. Its corresponding enterprise application controls who can use that application in your tenant.

5. Choose your sign-in policy

After a successful test, an owner or admin can turn on Require single sign-on for verified domains in Cust. This refuses the ordinary Google and Microsoft sign-in methods for those domains and ends their existing non-SSO sessions. Those non-SSO sessions also stop working in other Cust organizations; existing SSO sessions remain valid. Team members then sign in through your configured Entra application.

Use Allow inviting members from Cust to choose whether members may also be invited from Cust. Turning it off stops both sending and accepting invitations while SSO is enabled.

SSO and provisioning have separate controls. Turning off Enable single sign-on does not disable an existing SCIM connection. Manage it under User provisioning (SCIM).

Troubleshooting