Skip to main content

Single Sign-On (SSO) with Microsoft Entra ID

Configure Single Sign-On (SSO) between Kivo and Microsoft Entra ID (formerly Azure AD), including admin consent steps, authentication flow details, and what to expect during setup and login.

C
Written by Casey Huxtable
Updated over a month ago

Required Roles: N/A

Required Permissions: Workspace Manager

Introduction

This article explains how to configure single sign-on (SSO) between Kivo and Microsoft Entra ID (formerly Azure Active Directory). It includes background on how the integration works, what permissions are required, and what customers can expect during setup.

Overview

Microsoft Entra ID is Microsoft’s cloud-based identity and access management service. When integrated with Kivo, it allows users to authenticate using their corporate Microsoft credentials.

Kivo supports Entra ID–based authentication using a tenant consent model, where Entra ID authorizes Kivo to read limited user profile information required for authentication.

Integration Models

Kivo supports two Entra ID integration approaches.

Option 1 – Kivo-Managed App Registration (Recommended)

  • Kivo owns and manages the Entra ID application registration

  • Customers grant admin consent to Kivo’s application

  • Kivo manages tokens and key rotation

Pros:

  • Simplified setup

  • No customer key management

  • Faster onboarding

Cons:

  • Users authenticate via Microsoft’s standard login experience (no custom branding)

Option 2 – Customer-Managed App Registration

  • Customer creates and manages their own Entra ID app registration

  • Customer provides:

    • Application (client) ID

    • Tenant domain

    • Client secret

  • Customer is responsible for rotating secrets

Pros:

  • Fully branded Microsoft login experience

  • Authentication occurs directly within the customer’s tenant

Cons:

  • More complex setup

  • Ongoing secret management required

How Authentication Works

When a user logs in:

  1. Kivo redirects the user to Microsoft Entra ID

  2. Entra ID authenticates the user using your policies (MFA, conditional access, etc.)

  3. Entra ID returns a signed response to Kivo

  4. Kivo validates the response and creates a session

Kivo reads basic profile attributes only, such as:

  • Email address

  • User identifier

Kivo does not modify directory data.

Configuration Steps (Kivo-Managed App)

Step 1 – Identify Your Entra ID Tenant

  1. Log in to the Azure portal

  2. Navigate to Microsoft Entra ID

  3. Locate your Primary Domain

Step 2 – Grant Admin Consent

  1. Copy the URL below

  2. Replace [[Your Domain]] with your tenant domain

  3. Paste the URL into a browser and sign in as an Entra ID admin

https://login.microsoftonline.com/[[Your Domain]]/adminconsent?client_id=fa5ce509-b556-442b-831f-4c5bb5e589f1&redirect_uri=https%3A%2F%2Fkivo.io

This grants Kivo read-only access to user profile data for authentication.

Step 3 – Notify Kivo

Once consent is complete:

  • Notify your Kivo point of contact or [email protected]

  • Kivo completes the remaining configuration

  • SSO is enabled for your workspace

Post-Configuration Behavior

  • Users log in via the Kivo login page

  • Users select Sign in with SSO

  • After first login, future sessions redirect automatically

  • Group membership in Kivo controls access after authentication

Related Articles or Next Steps

Related Articles
Multi-Factor Authentication (MFA) with Kivo
Resetting Passwords
How to Clear Cache and Cookies in Browser
Inviting New Users
Single Sign-On (SSO) Overview
Did this answer your question?