--- title: "Configure Single Sign-On with Accept Mission" description: "# Configure Single Sign-On with [Accept Mission](https://www.acceptmission.com/pt/encyclopedia/accept-mission/) This guide explains how an organisation's IT administrator can configure Single Sign-On (SSO) for [Accept Mission](https://www.acceptmission.com/pt/encyclopedia/accept-mission/) using Microsoft Entra ID, formerly called Azure Active Directory or Azure AD. The setup creates a trust…" url: "https://www.acceptmission.com/pt/knowledge/configure-single-sign-on-with-accept-mission/" updated: "2026-10-16" category: "Security & Trust" tags: - Microsoft Entra ID - Security - SSO --- # Configure Single Sign-On with Accept Mission # Configure Single Sign-On with [Accept Mission](https://www.acceptmission.com/pt/encyclopedia/accept-mission/) This guide explains how an organisation's IT administrator can configure Single Sign-On (SSO) for [Accept Mission](https://www.acceptmission.com/pt/encyclopedia/accept-mission/) using Microsoft Entra ID, formerly called Azure Active Directory or Azure AD. The setup creates a trust relationship between [Accept Mission](https://www.acceptmission.com/pt/encyclopedia/accept-mission/) and your organisation's Microsoft identity platform. Users can then sign in to the [Accept Mission](https://www.acceptmission.com/pt/encyclopedia/accept-mission/) environment through the organisation's identity provider. This guide is intended for an IT administrator who can manage app registrations and permissions in Microsoft Entra ID. ## What you need from [Accept Mission](https://www.acceptmission.com/pt/encyclopedia/accept-mission/) Before you begin, ask your [Accept Mission](https://www.acceptmission.com/pt/encyclopedia/accept-mission/) contact for: - Your [Accept Mission](https://www.acceptmission.com/pt/encyclopedia/accept-mission/) application subdomain - The exact redirect URI - The exact logout URL - Any customer-specific configuration instructions The redirect URI and logout URL are specific to your [Accept Mission](https://www.acceptmission.com/pt/encyclopedia/accept-mission/) environment. Do not substitute values from another organisation. ## Required Microsoft Entra permissions You need permission to manage enterprise applications or app registrations in Microsoft Entra ID. Depending on your organisation's setup, one of these roles may be required: - Application Administrator - Application Developer - Cloud Application Administrator You may also need permission to grant administrator consent for Microsoft Graph delegated permissions. ## Step 1: Register the [Accept Mission](https://www.acceptmission.com/pt/encyclopedia/accept-mission/) application 1. Sign in to the [Microsoft Entra admin center](https://entra.microsoft.com). 2. If you manage more than one tenant, select the correct directory. 3. Go to **Entra ID → App registrations → New registration**. 4. Enter a clear display name, such as **[Accept Mission](https://www.acceptmission.com/pt/encyclopedia/accept-mission/) SSO**. 5. Select the sign-in audience required by your organisation and [Accept Mission](https://www.acceptmission.com/pt/encyclopedia/accept-mission/)'s instructions. 6. Leave **Redirect URI** empty during this initial registration. It is added in the next step. 7. Select **Register**. 8. Copy the **Application (client) ID** and **Directory (tenant) ID**. These values are needed by [Accept Mission](https://www.acceptmission.com/pt/encyclopedia/accept-mission/). The display name can be changed later. The Application (client) ID uniquely identifies the registration. ## Step 2: Configure the web platform and redirect URI 1. Open the new app registration. 2. Under **Manage**, select **Authentication**. 3. Select **Add a platform**. 4. Choose **Web**. 5. Enter the exact redirect URI provided by [Accept Mission](https://www.acceptmission.com/pt/encyclopedia/accept-mission/). 6. Enter the exact front-channel logout URL provided by [Accept Mission](https://www.acceptmission.com/pt/encyclopedia/accept-mission/). 7. Save the configuration. The redirect URI is where Microsoft Entra ID sends the user after authentication. The logout URL signs the user out of the [Accept Mission](https://www.acceptmission.com/pt/encyclopedia/accept-mission/) environment. A redirect URI commonly follows this format: `https://.acceptmission.com/auth/azure_oauth2/callback` A logout URL commonly follows this format: `https://.acceptmission.com/logout` Use the exact values supplied for your environment. ## Step 3: Create a client secret 1. In the app registration, go to **Certificates & secrets**. 2. Under **Client secrets**, select **New client secret**. 3. Enter a clear description, such as **[Accept Mission](https://www.acceptmission.com/pt/encyclopedia/accept-mission/) SSO**. 4. Select an expiry period. Microsoft Entra client secrets can be valid for up to 24 months. [Accept Mission](https://www.acceptmission.com/pt/encyclopedia/accept-mission/) recommends selecting **730 days (24 months)** unless your organisation requires a shorter period. 5. Select **Add**. 6. Immediately copy the secret's **Value**. Important: [Accept Mission](https://www.acceptmission.com/pt/encyclopedia/accept-mission/) needs the client secret **Value**, not the **Secret ID**. The full Value is shown only when the secret is created. Never place the secret in an ordinary email, screenshot, ticket, or this document. Use your approved secure transfer method. ## Step 4: Configure token claims 1. Under **Manage**, open **Token configuration**. 2. Add the following ID token claims: | Claim | Token type | Required | | --- | --- | --- | | email | ID | Yes | | family_name | ID | Yes | | given_name | ID | Yes | | profile_picture | ID | No | The optional profile_picture claim can be used to create the user's profile picture in [Accept Mission](https://www.acceptmission.com/pt/encyclopedia/accept-mission/). It may require additional internal permissions. ## Step 5: Configure Microsoft Graph permissions 1. Under **Manage**, open **API permissions**. 2. Select **Add a permission**. 3. Select **Microsoft Graph**. 4. Select **Delegated permissions**. 5. Add these permissions: - email - profile - User.Read 1. Select **Add permissions**. 2. Select **Grant [Admin](https://www.acceptmission.com/pt/encyclopedia/admin/) consent** for your organisation. 3. Confirm that the required permissions show as consented. Granting administrator consent prevents each user from being asked to consent individually during sign-in. Without the required consent, a user's account may not be created correctly in [Accept Mission](https://www.acceptmission.com/pt/encyclopedia/accept-mission/). ## Step 6: Send the configuration details securely After the configuration is complete, send the following to your [Accept Mission](https://www.acceptmission.com/pt/encyclopedia/accept-mission/) contact using an approved secure transfer method: - Confirmation that the configuration is complete - Application (client) ID - Directory (tenant) ID - Client secret **Value** Do not send the client secret through ordinary email. [Accept Mission](https://www.acceptmission.com/pt/encyclopedia/accept-mission/) will use these details to complete the connection and test the sign-in flow. ## Step 7: Test the SSO connection 1. Confirm that [Accept Mission](https://www.acceptmission.com/pt/encyclopedia/accept-mission/) has completed the configuration. 2. Open the [Accept Mission](https://www.acceptmission.com/pt/encyclopedia/accept-mission/) environment using the customer URL. 3. Sign in with an existing organisation account. 4. Confirm that you are redirected through Microsoft Entra ID. 5. Confirm that you reach the correct [Accept Mission](https://www.acceptmission.com/pt/encyclopedia/accept-mission/) environment. 6. Confirm that the user profile is created or recognised correctly. If the sign-in fails, confirm that the redirect URI, logout URL, tenant, claims, permissions, consent, and client secret Value are correct. Contact [Accept Mission](https://www.acceptmission.com/pt/encyclopedia/accept-mission/) if the issue continues. ## Renew an expired client secret This renewal process applies to the existing [Accept Mission](https://www.acceptmission.com/pt/encyclopedia/accept-mission/) customer app registration. It does not migrate your organisation to a new enterprise SSO connection. Client secret expiry cannot be extended. When the existing secret is close to expiry: 1. Open the existing [Accept Mission](https://www.acceptmission.com/pt/encyclopedia/accept-mission/) app registration in Microsoft Entra ID. 2. Go to **Certificates & secrets → Client secrets → New client secret**. 3. Create a replacement secret. 4. Copy the new secret's **Value**, not the Secret ID. 5. Share the Value securely with your [Accept Mission](https://www.acceptmission.com/pt/encyclopedia/accept-mission/) contact together with your organisation name, customer URL, Application (client) ID, and new expiry date. 6. Ask [Accept Mission](https://www.acceptmission.com/pt/encyclopedia/accept-mission/) to update the connection. 7. Test sign-in with an existing account. 8. Retire the old secret only after the replacement has been tested and your organisation's policy permits it. 9. Record the new expiry date and schedule the next renewal in advance. Do not delete the app registration. Keep the client ID, tenant ID, redirect URI, logout URL, claims, and permissions unchanged unless [Accept Mission](https://www.acceptmission.com/pt/encyclopedia/accept-mission/) instructs you otherwise. ## Important security guidance - Use the existing customer app registration when renewing a secret. - Never include a client secret in screenshots or ordinary email. - Share credentials only through an approved secure transfer method. - Do not share the Secret ID when [Accept Mission](https://www.acceptmission.com/pt/encyclopedia/accept-mission/) needs the secret Value. - Test the connection before retiring an old secret. - Contact [Accept Mission](https://www.acceptmission.com/pt/encyclopedia/accept-mission/) if you are unsure which app registration belongs to your environment. For security questions, contact **security@acceptmission.com**.