SSO with Microsoft Entra ID (Azure AD)

This guide connects Plenix to Microsoft Entra ID, the sign-in service behind Microsoft 365 (formerly Azure AD). Your team can then click Sign in with Microsoft on the Plenix login page.

You need to be an administrator in Plenix and have the Application Administrator (or Global Administrator) role in Microsoft Entra.

There are two ways to do it. Option A (OpenID Connect) is quicker and recommended. Use option B only if your IT policy requires SAML.

Option A: OpenID Connect (recommended)

A1. Copy the redirect URI from Plenix

1. In Plenix, go to Settings → SSO.
2. In Details for your identity provider, copy the Redirect URI (web platform).

A2. Register the app in Microsoft Entra

1. Go to entra.microsoft.com and sign in as an administrator.
2. Open Identity → Applications → App registrations and click New registration.
3. Name: Plenix.
4. Supported account types: Accounts in this organizational directory only (Single tenant).
5. Redirect URI: choose platform Web and paste the Redirect URI from Plenix.
6. Click Register.

A3. Note the IDs

On the app's Overview page, copy:

• Application (client) ID. This is the Plenix Client ID.
• Directory (tenant) ID. You need it for the Issuer URL.

Your Issuer URL is: https://login.microsoftonline.com/<Directory (tenant) ID>/v2.0

Replace <Directory (tenant) ID> with the ID you copied. Don't use common or organizations. Plenix needs your own tenant ID.

A4. Create a client secret

1. Open Certificates & secrets → Client secrets → New client secret.
2. Give it a description (for example Plenix SSO) and pick an expiry. 24 months is the maximum.
3. Click Add, then copy the Value column straight away. Don't copy the Secret ID, and note that the value is hidden once you leave the page.
4. Put a reminder in your calendar a few weeks before the expiry date (see Renewing the secret below).

A5. Check permissions

Open API permissions. Microsoft Graph User.Read is added by default. Click Add a permission → Microsoft Graph → Delegated permissions and tick openid, email and profile, then Add permissions. If your organisation requires it, click Grant admin consent.

A6. Connect it in Plenix

1. Back in Settings → SSO, click Connect identity provider.
2. Protocol: OpenID Connect.
3. Button label: Microsoft.
4. Issuer URL: the address from step A3.
5. Client ID: the Application (client) ID.
6. Client secret: the secret value from step A4.
7. Set Allowed email domains (for example acme.com), and choose whether to auto-provision new users. See who can sign in.
8. Switch on Enable single sign-on and click Save.

A7. Test

Open a private browser window, go to https://<your-workspace>.plenix.cloud/tenant-login, click Sign in with Microsoft, and sign in. The first time, Microsoft may ask you to accept the permissions.

Limit who can use it (optional)

By default anyone in your Microsoft tenant can try to sign in. Plenix still only lets in people who have a Plenix account or match your allowed domains. To restrict it in Microsoft too:

1. Go to Identity → Applications → Enterprise applications and open Plenix.
2. Under Properties, set Assignment required? to Yes and save.
3. Under Users and groups, add the people or groups who should have access.

Renewing the secret

When the secret is close to expiry, create a new one (step A4), paste it into Settings → SSO → Edit → Client secret and save. Then delete the old secret in Entra. If a secret expires before you replace it, SSO sign-in stops until you do. Passwords keep working in the meantime.

Option B: SAML

B1. Copy the SAML details from Plenix

In Settings → SSO, copy the Entity ID (Identifier / Audience) and the Assertion Consumer Service (Reply) URL.

B2. Create the enterprise application

1. In entra.microsoft.com, open Identity → Applications → Enterprise applications and click New application.
2. Click Create your own application, name it Plenix, choose Integrate any other application you don't find in the gallery (Non-gallery), and click Create.
3. Open Single sign-on and choose SAML.

B3. Basic SAML Configuration

Click Edit on Basic SAML Configuration:

• Identifier (Entity ID): paste the Plenix Entity ID and tick it as default.
• Reply URL (Assertion Consumer Service URL): paste the Plenix ACS URL.
• Sign on URL: https://<your-workspace>.plenix.cloud/tenant-login (optional). Click Save.

B4. Attributes & Claims

Leave the defaults. Microsoft sends the user's email in the standard emailaddress claim, which Plenix reads. If your users' user principal name is not their email address, edit Unique User Identifier (Name ID) and set it to user.mail with the format Email address.

B5. Copy the metadata URL

In SAML Certificates, copy the App Federation Metadata Url.

B6. Assign people

Open Users and groups → Add user/group and add who should have access.

B7. Connect it in Plenix

1. Settings → SSO → Connect identity provider.
2. Protocol: SAML 2.0. Button label: Microsoft.
3. IdP metadata URL: the App Federation Metadata Url.
4. Set allowed domains and provisioning, switch on Enable single sign-on and click Save.
5. Test in a private window.

Microsoft renews the signing certificate on its own schedule. Because you used the metadata URL, Plenix picks up the new certificate automatically.

Where to go next

• The full setup guide → Single Sign-On (SSO): Complete Setup Guide
• SSO with Microsoft Entra ID (Azure AD)
• SSO with Google Workspace
• SSO with Okta
• Rolling Out SSO and Fixing Sign-In Problems
• See where this fits in the bigger picture → Integrations Overview — What You Can Connect