> ## Documentation Index
> Fetch the complete documentation index at: https://docs.cantina.xyz/llms.txt
> Use this file to discover all available pages before exploring further.

# Microsoft Entra ID

> Connect Microsoft Entra ID (Azure AD) to Clarion to enforce enterprise single sign-on for your organization.

This guide explains how to register an app in Microsoft Entra ID (formerly Azure AD) and connect it to Clarion. Once configured, users who sign in with a mapped email domain are required to authenticate through Microsoft Entra.

> **Note:** **Estimated time:** 10-15 minutes. You will need **Microsoft Entra admin** access and access to the Clarion workspace where you want to configure SSO.

## Prerequisites

* Access to the [Microsoft Entra admin center](https://entra.microsoft.com) with permission to register applications
* Access to the Clarion workspace settings as a company manager

## Register an app in Microsoft Entra ID

1. Sign in to the [Microsoft Entra admin center](https://entra.microsoft.com).
2. Go to **Identity** > **Applications** > **App registrations**.
3. Click **New registration**.
4. Enter a name (for example, `Clarion SSO`) and click **Register**.
5. On the app overview page, copy the **Application (client) ID** - you will need this in Clarion.
6. Note your **Directory (tenant) domain** shown under **Overview** (for example, `contoso.onmicrosoft.com`).

## Create a client secret

1. In your registered app, go to **Certificates & secrets**.
2. Click **New client secret**, enter a description and expiry, then click **Add**.
3. Copy the **Value** immediately - it is shown only once.

## Add the SSO connection in Clarion

1. Open Clarion and go to **Settings** > **Single Sign-On (SSO)**.
2. Click **Add Connection**.
3. Enter the following values:
   * **Tenant Domain** - your Microsoft Entra tenant domain, for example `contoso.onmicrosoft.com`
   * **Client ID** - the Application (client) ID from your app registration
   * **Client Secret** - the secret value you copied
   * **Email Domain** - the email domain whose users will be required to sign in via Entra, for example `contoso.com`
4. Click **Create Connection**.

## Verify the connection

After saving:

* The connection appears in the **Microsoft Entra / Azure AD** section of the SSO settings page showing the tenant domain, client ID, and mapped email domain.
* Users who sign up or sign in with the mapped email domain will be redirected to Microsoft Entra for authentication.

## Remove a connection

To remove an SSO connection, click the trash icon next to the connection on the SSO settings page and confirm the deletion. Users on the mapped domains will no longer be required to sign in via Microsoft Entra.

## Troubleshooting

### `401 Unauthorized` when saving

* Confirm you are signed in to Clarion with an account that has manager access to the workspace.

### The tenant domain is rejected

* Enter only the domain portion, for example `contoso.onmicrosoft.com`. Do not include `https://`.

### Users are not redirected to Entra after setup

* Confirm the **Email Domain** matches the domain part of the users' email addresses exactly (for example `contoso.com`, not `contoso.onmicrosoft.com`).
* Allow a few minutes for the connection to propagate after creation.