Set up SSO with Microsoft Entra ID

Pilot

Company single sign-on is currently enabled only for pilot organizations. It is not generally available yet. You create the connection in Focus in Settings → Security → Single sign-on, which is part of the new version of the dashboard and is shown to the owner of the organization.

This guide registers Workify360 Focus as an app in your Microsoft Entra ID tenant. You need an Entra account that can register apps and grant admin consent, and a verified domain in Focus (domain verification). Read single sign-on first for how testing, activation and sign-in work.

What to register in Entra

Setting	Value
Supported account types	Single tenant (accounts in this organizational directory only) is recommended; multitenant also works
Redirect URI (platform Web)	https://auth.focus.workify360.com/sso/oidc/callback
Optional claims (ID token)	email and xms_edov
API permissions (Microsoft Graph, delegated)	openid, email, profile, offline_access, with admin consent
Credential	A certificate from Focus (recommended) or a client secret

With a multitenant app, Focus still accepts only accounts of your own tenant: every sign-in must carry your tenant ID (tid) and your tenant’s issuer.

Step by step

1. In the Microsoft Entra admin center, open App registrations and choose New registration.

2. Name it, for example “Workify360 Focus”, and choose the supported account type.

3. Under Redirect URI, select Web and enter:

   https://auth.focus.workify360.com/sso/oidc/callback

4. Choose Register. On the Overview page, copy the Application (client) ID and the Directory (tenant) ID.

5. Open Token configuration → Add optional claim, choose the token type ID and select email and xms_edov. Accept when Entra offers to add the Microsoft Graph email permission. Focus uses xms_edov to know that your organization owns the e-mail domain, and reads the address from email (or from preferred_username when email is empty).

6. Open API permissions and make sure Microsoft Graph has the delegated permissions openid, email, profile and offline_access. Choose Grant admin consent. offline_access gives the desktop app the refresh token it needs to check the account regularly.

7. Add a credential, either:

   • Certificate (recommended): in Focus, create the connection with the authentication method “Certificate (private_key_jwt, recommended)” (private_key_jwt). Focus creates a key pair and a certificate valid for 2 years, and the private key never leaves Focus. On the connection card, choose Download certificate and upload the file in Entra under Certificates & secrets → Certificates → Upload certificate. The card shows the certificate’s thumbprint and expiry date.
   • Client secret: in Entra, open Certificates & secrets → Client secrets → New client secret and copy the Value (not the secret ID). Client secrets expire; replacing the secret of an active connection means choosing Disable, entering the new secret with Edit, testing and activating again (sso_connection_active), so note the expiry date.

Create the connection in Focus

1. Open Settings → Security → Single sign-on and choose Add connection.
2. Choose the provider Microsoft Entra ID.
3. Enter the name shown on the sign-in page, the Directory (tenant) ID and the Application (client) ID (as “Client ID”). Choose the authentication method: the certificate, or “Client secret” with the secret’s Value. Focus derives the issuer from the tenant ID: https://login.microsoftonline.com/<tenant-id>/v2.0.
4. Check the Redirect URI step against what you registered in Entra, choose who is added on their first sign-in, and save.
5. With a certificate, choose Download certificate on the connection card and upload it in Entra (step 7 above).
6. Choose Test connection, sign in with an account of your verified domain in the new tab, and check the results on the card. The tenant check must pass, and the refresh token check should.
7. Choose Activate (a passed test from the last 24 hours is needed, sso_test_required).

Optional settings in Entra

• Who can sign in: in Enterprise applications, open the app, set Assignment required to Yes under Properties and add people or groups under Users and groups. Others are then refused by Entra.
• Multi-factor authentication: require it with a Conditional Access policy. If the connection has “Require two-step verification at the provider” (requireIdpMfa) on, Focus accepts a sign-in only when Entra reports multi-factor authentication.