Web:Kemp's Microsoft Entra Logon - Revision history

Jspenceratty: /* Configuring Entra Sign-In */

2026-04-23T18:42:48Z

Configuring Entra Sign-In

← Older revision		Revision as of 18:42, 23 April 2026
Line 73:		Line 73:
	#* In the Entra app registration, go to API permissions.		#* In the Entra app registration, go to API permissions.
	#* Add delegated permissions for Microsoft Graph: openid, profile, email.		#* Add delegated permissions for Microsoft Graph: openid, profile, email.
	#* Grant admin consent ~~if required~~.		#* Grant admin consent.

	===Managing User Links===		===Managing User Links===

Jspenceratty: /* Configuring Entra Sign-In */

2026-04-23T18:42:10Z

Configuring Entra Sign-In

← Older revision		Revision as of 18:42, 23 April 2026
Line 58:		Line 58:
	#* Set the name (e.g., "Prime16 Staff Sign-In").		#* Set the name (e.g., "Prime16 Staff Sign-In").
	#* Choose supported account types (typically "Accounts in this organizational directory only").		#* Choose supported account types (typically "Accounts in this organizational directory only").
	#* Set the redirect URI to: <nowiki>https://your-domain/Account/MicrosoftLinkCallback.aspx</nowiki> (replace with your actual domain). Remember you may have more than one for Prime 16. For example, you may have a ~~test site,~~ normal site, and the new kemps.app site. Contact us for assistance with these.		#* Set the redirect URI to: <nowiki>https://your-domain/Account/MicrosoftLinkCallback.aspx</nowiki> (replace with your actual domain). Remember you may have more than one for Prime 16. For example, you may have a normal site, and the new kemps.app site. Contact us for assistance with these.
	# Obtain Credentials:		# Obtain Credentials:
	#* From the app registration, note the Application (client) ID and Directory (tenant) ID.		#* From the app registration, note the Application (client) ID and Directory (tenant) ID.
Line 64:		Line 64:
	# Configure in the Application:		# Configure in the Application:
	#* Log in as an administrator.		#* Log in as an administrator.
	#* Go to Admin > Staff > SMember Entra Setup.		#* Go to Admin > Staff - SMember Entra Setup.
	#* Enable the feature.		#* Enable the feature.
	#* Enter the Tenant ID, Client ID, Client Secret, and optional Client Secret Expiration Date.		#* Enter the Tenant ID, Client ID, Client Secret, and optional Client Secret Expiration Date.

Jspenceratty: /* Configuring Entra Sign-In */

2026-04-23T18:41:08Z

Configuring Entra Sign-In

← Older revision		Revision as of 18:41, 23 April 2026
Line 58:		Line 58:
	#* Set the name (e.g., "Prime16 Staff Sign-In").		#* Set the name (e.g., "Prime16 Staff Sign-In").
	#* Choose supported account types (typically "Accounts in this organizational directory only").		#* Choose supported account types (typically "Accounts in this organizational directory only").
	#* Set the redirect URI to: https://your-domain/Account/MicrosoftLinkCallback.aspx (replace with your actual domain).		#* Set the redirect URI to: <nowiki>https://your-domain/Account/MicrosoftLinkCallback.aspx</nowiki> (replace with your actual domain). Remember you may have more than one for Prime 16. For example, you may have a test site, normal site, and the new kemps.app site. Contact us for assistance with these.
	# Obtain Credentials:		# Obtain Credentials:
	#* From the app registration, note the Application (client) ID and Directory (tenant) ID.		#* From the app registration, note the Application (client) ID and Directory (tenant) ID.

Jspenceratty: /* Troubleshooting */

2026-04-23T18:39:01Z

Troubleshooting

← Older revision		Revision as of 18:39, 23 April 2026
Line 93:		Line 93:

	===Troubleshooting===		===Troubleshooting===
	• Users Can't Sign In: Verify Entra settings, tenant matching, and secret validity.		* Users Can't Sign In: Verify Entra settings, tenant matching, and secret validity.
	• Link Errors: Check for duplicate links or invalid Entra accounts.		* Link Errors: Check for duplicate links or invalid Entra accounts.
	• Logs Show Failures: Review error messages (e.g., "Tenant Mismatch" or "Unmapped Account") and adjust settings accordingly.		* Logs Show Failures: Review error messages (e.g., "Tenant Mismatch" or "Unmapped Account") and adjust settings accordingly.
	For further assistance, contact your system administrator or refer to Microsoft Entra documentation.		For further assistance, contact your system administrator or refer to Microsoft Entra documentation.

Jspenceratty: /* Security Considerations */

2026-04-23T18:38:40Z

Security Considerations

← Older revision		Revision as of 18:38, 23 April 2026
Line 87:		Line 87:

	===Security Considerations===		===Security Considerations===
	• Client secrets should be rotated regularly (e.g., annually).		* Client secrets should be rotated regularly (e.g., annually).
	• Use Entra's conditional access policies for additional security.		* Use Entra's conditional access policies for additional security.
	• Disable the feature in the admin setup if not needed.		* Disable the feature in the admin setup if not needed.
	• Ensure the web server has appropriate permissions if using certificate-based auth (not recommended for this setup).		* Ensure the web server has appropriate permissions if using certificate-based auth (not recommended for this setup).

	===Troubleshooting===		===Troubleshooting===
	• Users Can't Sign In: Verify Entra settings, tenant matching, and secret validity.		• Users Can't Sign In: Verify Entra settings, tenant matching, and secret validity.

Jspenceratty: /* Monitoring and Logs */

2026-04-23T18:38:25Z

Monitoring and Logs

← Older revision		Revision as of 18:38, 23 April 2026
Line 82:		Line 82:

	===Monitoring and Logs===		===Monitoring and Logs===
	• All login attempts (successful and failed) are logged in the system's audit trail.		* All login attempts (successful and failed) are logged in the system's audit trail.
	• Check logs for issues like tenant mismatches, unmapped accounts, or expired secrets.		* Check logs for issues like tenant mismatches, unmapped accounts, or expired secrets.
	• If the client secret expires, update it in the admin setup and test sign-in.		* If the client secret expires, update it in the admin setup and test sign-in.

	===Security Considerations===		===Security Considerations===
	• Client secrets should be rotated regularly (e.g., annually).		• Client secrets should be rotated regularly (e.g., annually).

Jspenceratty: /* Managing User Links */

2026-04-23T18:38:10Z

Managing User Links

← Older revision		Revision as of 18:38, 23 April 2026
Line 76:		Line 76:

	===Managing User Links===		===Managing User Links===
	• Go to Admin > Staff > SMember Entra Links.		* Go to Admin > Staff - SMember Entra Links.
	• Search for staff members by SNUM, name, or linked Entra account.		* Search for staff members by SNUM, name, or linked Entra account.
	• View details of linked accounts, including Entra user name, email, tenant ID, and link timestamps.		* View details of linked accounts, including Entra user name, email, tenant ID, and link timestamps.
	• To remove a link: Select the staff member, click Remove Link, and confirm.		* To remove a link: Select the staff member, click Remove Link, and confirm.

	===Monitoring and Logs===		===Monitoring and Logs===
	• All login attempts (successful and failed) are logged in the system's audit trail.		• All login attempts (successful and failed) are logged in the system's audit trail.

Jspenceratty: /* Configuring Entra Sign-In */

2026-04-23T18:37:00Z

Configuring Entra Sign-In

← Older revision		Revision as of 18:37, 23 April 2026
Line 53:		Line 53:

	===Configuring Entra Sign-In===		===Configuring Entra Sign-In===
	1. Create an App Registration:		# Create an App Registration:
	• Go to the Microsoft Entra admin center.		#* Go to the Microsoft Entra admin center.
	• Navigate to Applications > App registrations > New registration.		#* Navigate to Applications > App registrations > New registration.
	• Set the name (e.g., "Prime16 Staff Sign-In").		#* Set the name (e.g., "Prime16 Staff Sign-In").
	• Choose supported account types (typically "Accounts in this organizational directory only").		#* Choose supported account types (typically "Accounts in this organizational directory only").
	• Set the redirect URI to: https://your-domain/Account/MicrosoftLinkCallback.aspx (replace with your actual domain).		#* Set the redirect URI to: https://your-domain/Account/MicrosoftLinkCallback.aspx (replace with your actual domain).
	2. Obtain Credentials:		# Obtain Credentials:
	• From the app registration, note the Application (client) ID and Directory (tenant) ID.		#* From the app registration, note the Application (client) ID and Directory (tenant) ID.
	• Go to Certificates & secrets and create a new client secret. Copy the Value (not the ID) immediately, as it will not be shown again. Set an expiration (e.g., 12 months) and plan to rotate it before expiry.		#* Go to Certificates & secrets and create a new client secret. Copy the Value (not the ID) immediately, as it will not be shown again. Set an expiration (e.g., 12 months) and plan to rotate it before expiry.
	3. Configure in the Application:		# Configure in the Application:
	• Log in as an administrator.		#* Log in as an administrator.
	• Go to Admin > Staff > SMember Entra Setup.		#* Go to Admin > Staff > SMember Entra Setup.
	• Enable the feature.		#* Enable the feature.
	• Enter the Tenant ID, Client ID, Client Secret, and optional Client Secret Expiration Date.		#* Enter the Tenant ID, Client ID, Client Secret, and optional Client Secret Expiration Date.
	• Set the Redirect URI (must match the Entra app registration).		#* Set the Redirect URI (must match the Entra app registration).
	• Optionally set an Allowed Domain (e.g., yourdomain.com) to restrict sign-ins.		#* Optionally set an Allowed Domain (e.g., yourdomain.com) to restrict sign-ins.
	• Save the settings.		#* Save the settings.
	4. Grant Permissions:		# Grant Permissions:
	• In the Entra app registration, go to API permissions.		#* In the Entra app registration, go to API permissions.
	• Add delegated permissions for Microsoft Graph: openid, profile, email.		#* Add delegated permissions for Microsoft Graph: openid, profile, email.
	• Grant admin consent if required.		#* Grant admin consent if required.

	===Managing User Links===		===Managing User Links===
	• Go to Admin > Staff > SMember Entra Links.		• Go to Admin > Staff > SMember Entra Links.

Jspenceratty: /* Setup Requirements */

2026-04-23T18:34:20Z

Setup Requirements

← Older revision		Revision as of 18:34, 23 April 2026
Line 48:		Line 48:
	==Administrator Guide==		==Administrator Guide==
	===Setup Requirements===		===Setup Requirements===
	• Access to your organization's Microsoft Entra admin center.		* Access to your organization's Microsoft Entra admin center.
	• Permissions to create app registrations in Entra.		* Permissions to create app registrations in Entra.
	• Database access to configure settings.		* Database access to configure settings.

	===Configuring Entra Sign-In===		===Configuring Entra Sign-In===
	1. Create an App Registration:		1. Create an App Registration:

Jspenceratty: /* Troubleshooting */

2026-04-23T18:34:08Z

Troubleshooting

← Older revision		Revision as of 18:34, 23 April 2026
Line 42:		Line 42:

	===Troubleshooting===		===Troubleshooting===
	• Link Fails: Ensure your Entra account is in the allowed tenant and not already linked to another staff account.		* Link Fails: Ensure your Entra account is in the allowed tenant and not already linked to another staff account.
	• Sign-In Fails: Verify your Entra credentials and that the feature is enabled. If issues persist, contact your administrator.		* Sign-In Fails: Verify your Entra credentials and that the feature is enabled. If issues persist, contact your administrator.
	• Not Seeing the Button: The Microsoft sign-in option may appear after completing ConvergeOne authentication if that is enabled.		* Not Seeing the Button: The Microsoft sign-in option may appear after completing ConvergeOne authentication if that is enabled.

	==Administrator Guide==		==Administrator Guide==
	===Setup Requirements===		===Setup Requirements===