From Corporate V4.2, this integration is self-service. Luminance Account Administrators configure and manage the integration in Luminance.
OpenID Connect Single Sign-On Setup with Entra ID
Note: You need administrator access to the Azure Portal and Account Administrator access to Luminance
Step 1: Register an Application in Microsoft Entra ID
Sign in to the Azure Portal
Select your account and switch directory if required
Navigate to Microsoft Entra ID
Select App registrations
Click New registration
Configure the application using the table below
Click Register
Setting | Value |
Name | Enter Luminance or another descriptive name |
Supported account types | Select the option that reflects your organization's requirements (typically "Accounts in this organizational directory only") |
Redirect URI | Platform: Web
|
Note: Replace <your-luminance-url> with your Luminance instance URL (e.g., acme-corporate.app.luminance.com)
Step 2: Configure Authentication
Navigate to Authentication
Enable ID tokens under Implicit grant and hybrid flows
Add a second redirect URI: https://<your-luminance-proxy>.app.luminance.com/auth/callback
Click Save
Note: Retrieve the <proxy> value using:
- dig +short <your-luminance-url> in Terminal
- Resolve-DnsName <your-luminance-url> in Powershell
Step 3: Note Your Application Details
Collect the following values from the Overview page:
Application (client) ID
Directory (tenant) ID
Step 4: Create the Integration in Luminance
Log in to Luminance as an Account Administrator
Navigate to Account Settings → Integrations
Click Create Integration
Select Entra ID and complete the fields in the table below
Click Create
Field | Required | Description |
Name | Yes | Enter a descriptive name (e.g., Microsoft SSO or Entra ID). Users may see this on the login screen. |
Type | Yes | Select SSO or SSO (Autoprovision) |
Application (client) ID | Yes | The Application (client) ID from Step 3 |
Directory (tenant) ID | Yes | The Directory (tenant) ID from Step 3 |
Step 5: Test SSO
Open a new incognito or private browser window
Navigate to your Luminance URL
Click Log in with SSO, or enter an SSO-enabled email address
Sign in via Microsoft
Confirm access to Luminance
Note: Test immediately after configuration to identify and resolve issues early.
Managing SSO Profiles
Existing Users
Navigate to Account Settings → Users and select the user
Click Edit
Click + and select the SSO Identity Provider
Enter the user’s email address
Save the changes
Auto-Provisioning
If you select SSO (Autoprovision):
Create user accounts on first sign-in
Assign no permissions or document access by default
Require an Account Administrator to assign divisions and groups
Autoprovision Linking
Navigate to Account Settings → Security
Locate the Autoprovision Linking table
Click +
Enter a filter (e.g., @yourcompany.com$)
Select a user group
Security best practices
Restrict account types to your organization
Enable ID tokens only—do not enable access tokens unless required
Use Conditional Access for MFA or device compliance
Review application registration regularly
Test with a single user before rollout
Usage: Expected Behavior
Use the table below to understand expected SSO behavior after setup.
Behavior | Details |
Sign-in flow | Users click Log in with SSO and are redirected to Microsoft. After authentication, they are returned to Luminance |
Session management | Luminance creates a session after validating the ID token. Session duration is controlled by Luminance |
Auto-provisioning | Create accounts on first sign-in. No permissions assigned by default |
Existing users | Require an SSO profile before signing in |
Password login | Users can sign in with SSO or password if both are configured |
Claims Mapping | Not supported for Entra ID (OpenID Connect). Use SAML 2.0 for group mapping |
Troubleshooting
Use this table to identify and resolve common issues.
Issue | Cause | Resolution |
No option to log in via SSO | Integration not created | Create the Entra ID integration in Account Settings → Integrations |
AADSTS50011: The redirect URI does not match | Redirect URI mismatch | Verify both redirect URIs are configured in Azure |
“User not enabled” after SSO login | No SSO profile linked | Create an SSO profile (see Managing SSO Profiles) |
User gets a new empty account | Duplicate account created | Delete the duplicate and link the original account |
AADSTS700016: Application not found | Incorrect Application (client) ID | Verify the Application (client) ID matches Azure Portal |