Set up single sign-on with Microsoft Entra ID

FormCan connects to Microsoft Entra ID (formerly Azure AD) with OpenID Connect or SAML 2.0. OpenID Connect uses an app registration; SAML 2.0 uses an enterprise application and gives members a tile in My Apps.

For an overview of the Single Sign-On page, see Single sign-on (SSO).

Before you begin

• You are an Entra administrator who can register applications.
• In FormCan, you are the team owner or a member with the Manage members access.
• In FormCan, open your team menu and select Single Sign-On. On the Connection tab, pick Microsoft Entra ID and the protocol you prefer. Keep this page open: it shows the values Entra needs, each with a Copy button.

Option 1: OpenID Connect

In the Microsoft Entra admin center

1. Go to Identity > Applications > App registrations and click New registration.

2. Enter a name, for example FormCan. Under Supported account types, select Accounts in this organizational directory only.

3. Under Redirect URI, choose the platform Web and paste the Sign-in redirect URI from FormCan. Click Register.

4. On the Overview page, copy the Application (client) ID and the Directory (tenant) ID.

5. Go to Certificates & secrets, click New client secret, and copy the secret Value at once. It is shown only once.

   Note

   Copy the Value of the secret, not the Secret ID. Note the expiry date: when the secret expires, sign-in stops until you paste a new one in FormCan.

6. Under API permissions, the default User.Read is enough. Click Grant admin consent so members do not see a consent prompt.

In FormCan

1. Under 3. Values from your identity provider, enter the Issuer URL: https://login.microsoftonline.com/your-tenant-id/v2.0, with your Directory (tenant) ID in place of your-tenant-id.

2. Paste the Application (client) ID as the Client ID, and the secret Value as the Client secret.

3. Click Save connection.

Option 2: SAML 2.0

In the Microsoft Entra admin center

1. Go to Identity > Applications > Enterprise applications and click New application, then Create your own application.

2. Enter a name, for example FormCan, select Integrate any other application you don’t find in the gallery, and click Create.

3. Open Single sign-on and select SAML.

4. Edit Basic SAML Configuration:

   • Identifier (Entity ID): the Entity ID from FormCan.
   • Reply URL (Assertion Consumer Service URL): the ACS URL from FormCan.
   • Sign on URL (optional): the Start URL from FormCan.

   Click Save.

5. Leave Attributes & Claims at the defaults. FormCan recognises the email, given name and surname claims Entra sends when you pick Microsoft Entra ID as the provider.

6. Under SAML Certificates, copy the App Federation Metadata Url.

7. Under Users and groups, assign the people or groups who may sign in.

In FormCan

1. Under 3. Values from your identity provider, paste the App Federation Metadata Url into Metadata URL and click Load from metadata. FormCan fills in the entity ID, the sign-on URL and the signing certificate.

2. Check the values and click Save connection.

Verify your domain, test and turn on

1. On the Email domains tab, add your company domain, create the TXT record FormCan shows at your DNS provider, and click Verify.

2. In the status card, click Test connection. A window signs you in through Entra ID and shows the email, name and claim names FormCan received.

3. Click Turn on single sign-on.

Members can now click SSO on the FormCan login page, open the start URL, or use the FormCan tile in My Apps. See Sign-in rules to require single sign-on or to let new members join automatically.

Good to know

• Users without a mailbox: when Entra sends no email claim, FormCan uses the user principal name as the email address. It must be on one of your verified domains.
• Guest users: a guest’s address is usually on another domain, so the sign-in is refused unless you verify that domain too.

Troubleshooting