Configure Single Sign-On with Aceptar misión #

This guide explains how an organisation’s IT administrator can configure Single Sign-On (SSO) for Aceptar misión using Microsoft Entra ID, formerly called Azure Active Directory or Azure AD.

The setup creates a trust relationship between Aceptar misión and your organisation’s Microsoft identity platform. Users can then sign in to the Aceptar misión environment through the organisation’s identity provider.

This guide is intended for an IT administrator who can manage app registrations and permissions in Microsoft Entra ID.

What you need from Aceptar misión #

Before you begin, ask your Aceptar misión contact for:

• Tu Aceptar misión application subdomain
• The exact redirect URI
• The exact logout URL
• Any customer-specific configuration instructions

The redirect URI and logout URL are specific to your Aceptar misión environment. Do not substitute values from another organisation.

Required Microsoft Entra permissions #

You need permission to manage enterprise applications or app registrations in Microsoft Entra ID. Depending on your organisation’s setup, one of these roles may be required:

• Application Administrator
• Application Developer
• Cloud Application Administrator

You may also need permission to grant administrator consent for Microsoft Graph delegated permissions.

Step 1: Register the Aceptar misión aplicación #

1. Sign in to the Microsoft Entra admin center.
2. If you manage more than one tenant, select the correct directory.
3. Ir a Entra ID → App registrations → New registration.
4. Enter a clear display name, such as Aceptar misión SSO.
5. Select the sign-in audience required by your organisation and Aceptar misión’s instructions.
6. Leave Redirect URI empty during this initial registration. It is added in the next step.
7. Seleccione Register.
8. Copy the Application (client) ID y Directory (tenant) ID. These values are needed by Aceptar misión.

The display name can be changed later. The Application (client) ID uniquely identifies the registration.

Step 2: Configure the web platform and redirect URI #

1. Open the new app registration.
2. En Gestionar, Seleccione Autenticación.
3. Seleccione Add a platform.
4. Elija Web.
5. Enter the exact redirect URI provided by Aceptar misión.
6. Enter the exact front-channel logout URL provided by Aceptar misión.
7. Guarda la configuración.

The redirect URI is where Microsoft Entra ID sends the user after authentication. The logout URL signs the user out of the Aceptar misión medio ambiente.

A redirect URI commonly follows this format:

https://<your-subdomain>.acceptmission.com/auth/azure_oauth2/callback

A logout URL commonly follows this format:

https://<your-subdomain>.acceptmission.com/logout

Use the exact values supplied for your environment.

Step 3: Create a client secret #

1. In the app registration, go to Certificates & secrets.
2. En Client secrets, Seleccione New client secret.
3. Enter a clear description, such as Aceptar misión SSO.
4. Select an expiry period. Microsoft Entra client secrets can be valid for up to 24 months. Aceptar misión recommends selecting 730 days (24 months) unless your organisation requires a shorter period.
5. Seleccione Añadir.
6. Immediately copy the secret’s Valor.

Importante: Aceptar misión needs the client secret Valor, not the Secret ID. The full Value is shown only when the secret is created.

Never place the secret in an ordinary email, screenshot, ticket, or this document. Use your approved secure transfer method.

Step 4: Configure token claims #

1. En Gestionar, open Token configuration.
2. Add the following ID token claims:

The optional profile_picture claim can be used to create the user’s profile picture in Aceptar misión. It may require additional internal permissions.

Step 5: Configure Microsoft Graph permissions #

1. En Gestionar, open API permissions.
2. Seleccione Add a permission.
3. Seleccione Microsoft Graph.
4. Seleccione Delegated permissions.
5. Add these permissions:

• email
• profile
• User.Read

1. Seleccione Add permissions.
2. Seleccione Grant Admin consent for your organisation.
3. Confirm that the required permissions show as consented.

Granting administrator consent prevents each user from being asked to consent individually during sign-in. Without the required consent, a user’s account may not be created correctly in Aceptar misión.

Step 6: Send the configuration details securely #

After the configuration is complete, send the following to your Aceptar misión contact using an approved secure transfer method:

• Confirmation that the configuration is complete
• Application (client) ID
• Directory (tenant) ID
• Client secret Valor

Do not send the client secret through ordinary email. Aceptar misión will use these details to complete the connection and test the sign-in flow.

Step 7: Test the SSO connection #

1. Confirm that Aceptar misión has completed the configuration.
2. Abra el Aceptar misión environment using the customer URL.
3. Sign in with an existing organisation account.
4. Confirm that you are redirected through Microsoft Entra ID.
5. Confirm that you reach the correct Aceptar misión medio ambiente.
6. Confirm that the user profile is created or recognised correctly.

If the sign-in fails, confirm that the redirect URI, logout URL, tenant, claims, permissions, consent, and client secret Value are correct. Contact Aceptar misión if the issue continues.

Renew an expired client secret #

This renewal process applies to the existing Aceptar misión customer app registration. It does not migrate your organisation to a new enterprise SSO connection.

Client secret expiry cannot be extended. When the existing secret is close to expiry:

1. Open the existing Aceptar misión app registration in Microsoft Entra ID.
2. Ir a Certificates & secrets → Client secrets → New client secret.
3. Create a replacement secret.
4. Copy the new secret’s Valor, not the Secret ID.
5. Share the Value securely with your Aceptar misión contact together with your organisation name, customer URL, Application (client) ID, and new expiry date.
6. Pregunte a Aceptar misión to update the connection.
7. Test sign-in with an existing account.
8. Retire the old secret only after the replacement has been tested and your organisation’s policy permits it.
9. Record the new expiry date and schedule the next renewal in advance.

Do not delete the app registration. Keep the client ID, tenant ID, redirect URI, logout URL, claims, and permissions unchanged unless Aceptar misión instructs you otherwise.

Important security guidance #

• Use the existing customer app registration when renewing a secret.
• Never include a client secret in screenshots or ordinary email.
• Share credentials only through an approved secure transfer method.
• Do not share the Secret ID when Aceptar misión needs the secret Value.
• Test the connection before retiring an old secret.
• Contacto Aceptar misión if you are unsure which app registration belongs to your environment.

For security questions, contact [email protected].