Microsoft single sign-on
Overview
Kompass can let your staff sign in with their Microsoft work accounts (Microsoft Entra ID). This article is for administrators: it explains what Kompass needs from you, how sign-ins are checked, and how to make Microsoft sign-in the only way in for your email domains.
Microsoft sign-in is set up for you by Kompass Support. Contact us with the details below and we will configure it.
What we need from you
- Your email domains. The domains your staff use with Kompass, for example
acme.com. Everyone whose Kompass email address is on one of these domains is sent to Microsoft when they sign in. Each domain must be a verified domain in your Microsoft directory (Microsoft Entra admin center, Domain names). - Which app to use. Either:
- The Kompass Microsoft app. A Microsoft administrator in your organisation grants it access to your directory once. Nothing else is needed on your side.
- Your own app registration in your Microsoft directory. Send us its Application (client) ID and Directory (tenant) ID, a client secret value and the date that secret expires. We give you the redirect URI to add to the app. Send us a new secret, with its expiry date, before the old one expires.
How sign-ins are checked
Kompass accepts a Microsoft sign-in only when the Microsoft directory that signed the person in is the directory that owns their email domain. A domain can be verified in only one Microsoft directory, so another organisation cannot sign in to Kompass with an address on your domain, even if it creates such an address in its own directory.
With the Kompass Microsoft app this also works when your staff are spread across more than one Microsoft directory, for example after a merger: each domain signs in from its own directory. With your own app registration, sign-in goes to that app's directory only, so all your domains have to be verified there.
Kompass relies on your Microsoft policies for multi-factor authentication when someone signs in with Microsoft, so set MFA up in Microsoft. If your Kompass site requires MFA, Microsoft sign-in satisfies it.
Requiring Microsoft sign-in
By default, people on your domains can still sign in with a Kompass password if they have one. You can ask us to require Microsoft sign-in for one or more of your domains. Once it is required:
- password sign-in is refused for addresses on that domain;
- password reset emails are not sent for them;
- personal access tokens and connected apps keep working.
Before we can require it, you prove that you control the domain: we give you a DNS TXT record to add at _kompass-verify.<your domain>, and Kompass checks it every day. If the record is removed, password sign-in opens again for that domain.
Where Microsoft sign-in is not required, people on your domains who still use a Kompass password are also sent to Microsoft when they click Continue. They can sign in with Microsoft, which uses their existing Kompass account, or with their password at https://<your Kompass address>/accounts/login/?method=password.
Exceptions for individual users
Some people may need to keep a password, for example an emergency administrator account for when Microsoft is unavailable. In Kompass Admin, open Users, choose the user and tick Exempt from required single sign-on.
- An exempt user always has to use MFA in Kompass.
- Each password sign-in sends them an email, so they notice if someone else uses their account.
- Because the login page sends their domain to Microsoft, they sign in with a password at
https://<your Kompass address>/accounts/login/?method=password.