> For the complete documentation index, see [llms.txt](https://docs.enginsight.com/docs/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://docs.enginsight.com/docs/knowledge-base/english/miscellaneous/how-do-i-set-up-single-sign-on-sso-via-microsoft-365-in-enginsight.md). # How do I set up single sign-on (SSO) via Microsoft 365 in Enginsight? In addition to logging in via username and password, the Enginsight platform allows you to sign in via single sign-on (SSO) using Microsoft 365. In the following, we will show you which steps you need to take to configure SSO. *** ## Registering Enginsight in Microsoft Entra ID {% stepper %} {% step %} First, register Enginsight as a new application in Microsoft Entra ID (previously Azure AD). For more information, see the [official vendor documentation](https://learn.microsoft.com/en-us/entra/identity-platform/quickstart-register-app). {% hint style="warning" %} **Please note**: Enginsight assumes no liability for the content and topicality of third-party documentation. {% endhint %} {% endstep %} {% step %} Add a **Redirect URI** as follows: ``` https:///v1/users/login ``` {% hint style="info" %} Remember to replace `` with the domain of your Enginsight API. {% endhint %} {% endstep %} {% step %} After registering Enginsight, make a note of your **Client ID**, also called **Application ID**, and your **Client Secret**, also called **App Secret**. You will need to add this information to the Enginsight configuration file later. {% hint style="danger" %} **Please note**: When you add a Client Secret in Microsoft Entra ID, it is shown *only once immediately after it is created and never again*. Make sure you store your Client Secret in a safe place immediately after creation. {% endhint %} Instead of a Client Secret, you can also create a **Client Certificate**, also called **App** **Certificate**. For more information, see the [official vendor documentation](https://learn.microsoft.com/en-us/entra/identity-platform/howto-create-self-signed-certificate). {% hint style="warning" %} **Please note**: Enginsight assumes no liability for the content and topicality of third-party documentation. {% endhint %} {% endstep %} {% endstepper %} *** ## Adjusting the Enginsight Configuration File {% stepper %} {% step %} ### Open the Enginsight configuration file 1. Log in to the **Enginsight Application Server**. 2. Open the Enginsight configuration file using the following command: ``` sudo nano /opt/enginsight/enterprise/conf/services/config.json ``` {% endstep %} {% step %} ### Add the Microsoft authentication section For authentication via Microsoft, in addition to your Client ID, you can add ***either*** your Client Secret ***or*** your Client Certificate. #### Option 1: Client Secret If you want to use your **Client Secret**, add the following section to the configuration file: 
"microsoftAuthenticationLibrary": [{
    "scope": "\\@.*",
    "clientId": "<ClientID>",
    "clientSecret": "<ClientSecret>",
    "authority": "https://login.microsoftonline.com/<TenantID>"
   }],
{% hint style="info" %} Remember to replace the following placeholders in `<>` accordingly: * `` * `` * `` {% endhint %} #### Option 2: Client Certificate If you want to use your **Client Certificate**, add the following section to the configuration file: 
"microsoftAuthenticationLibrary": [{
    "scope": "\\@.*",
    "clientId": "<ClientID>",
    "clientCertificate": {
      "thumbprint": "<ClientCertificateThumbprint>",
      "privateKey": "<ClientCertificatePrivateKey>"
    },
    "authority": "https://login.microsoftonline.com/<TenantID>"
  }],
{% hint style="info" %} Remember to replace the following placeholders in `<>` accordingly: * `` * `` * `` * `` {% endhint %} Adjust the following parameters accordingly:
ParameterDescription
ScopeYou can use the scope attribute to restrict the SSO configuration to a specific Active Directory domain.

In most cases, however, no restriction is required and the default value \\@.* can be left unchanged.
<ClientID>Enter the Client ID (Application ID) of the Enginsight application registered in Microsoft Entra ID.
<ClientSecret>Enter the Client Secret (App Secret) for the Enginsight application registered in Microsoft Entra ID.
<ClientCertificateThumbprint>Enter the thumbprint of the Client Certificate (App Certificate), meaning the unique cryptographic hash value that identifies the certificate, for the Enginsight application registered in Microsoft Entra ID.
<ClientCertificatePrivateKey>Enter the private key of the Client Certificate for the Enginsight application registered in Microsoft Entra ID.
<TenantID>Enter the Tenant ID of your Microsoft 365 tenant.
{% endstep %} {% step %} ### Save the configuration changes Save the changes in the configuration file (**Ctrl** + **o**) and confirm the save process. Close the file (**Ctrl** + **x**). {% endstep %} {% step %} ### Open the Application Server configuration file Now open the configuration file of the Enginsight Application Server using the following command: ``` sudo nano /opt/enginsight/enterprise/conf/ui-m1/environment.js ``` {% endstep %} {% step %} ### Add the login parameter Navigate to the section `var ENV = {` and add the following line: ``` loginVia: ['ssoOffice365', 'usernamePassword'], ``` The complete script should now look as follows: ``` module.exports = function (environment) { var ENV = { loginVia: ['ssoOffice365', 'usernamePassword'], hinting: true, modulePrefix: 'ngs-ui-m1', environment: environment, rootURL: '/', locationType: 'auto', recaptchaKey: '', EmberENV: { FEATURES: {} }, APP: {} }; ENV.apiDomain = '%%API_URL%%'; ENV.onpremise = { version: 1 }; return ENV; ``` {% endstep %} {% step %} ### Save the configuration changes Save the changes in the configuration file (**Ctrl** + **o**) and confirm the save process. Close the file (**Ctrl** + **x**). {% endstep %} {% step %} ### Apply the changes on the Application Server 1. Navigate to the Enginsight installation directory using the following command: ``` cd /opt/enginsight/enterprise ``` 2. Run the setup script for the Application Server anew using the following command to apply the configuration changes, and confirm all prompts with the **Enter** key: ``` sudo ./setup.sh ``` {% endstep %} {% endstepper %} *** ## Testing SSO Login Now test whether login via SSO through Microsoft 365 works as expected. {% hint style="warning" %} **Please note**: For a user to be able to sign in via SSO, they must be created as a team member in the Enginsight platform first. {% endhint %} 1. Navigate to the login page of your Enginsight instance. 2. In the **Authentication method** field, select **Single-Sign-On via Microsoft Office 365**. ![](/files/KSMF53HEzo7CArPGY4nq) 3. Click **Login**. *** ## Optional: Disabling the Default Login Method After you successfully tested authentication via SSO, you can optionally disable the default login method, username and password. To do so, follow these steps: {% stepper %} {% step %} ### Open the Application Server configuration file Open the configuration file of the Enginsight Application Server using the following command: ``` sudo nano /opt/enginsight/enterprise/conf/ui-m1/environment.js ``` {% endstep %} {% step %} ### Adjust the login parameter Navigate to the section `var ENV = {` and adjust the `loginVia` line as follows: ``` loginVia: ['ssoOffice365'], ``` {% endstep %} {% step %} ### Save the configuration changes Save the changes in the configuration file (**Ctrl** + **o**) and confirm the save process. Close the file (**Ctrl** + **x**). {% endstep %} {% step %} ### Apply the changes on the Application Server 1. Navigate to the Enginsight installation directory using the following command: ``` cd /opt/enginsight/enterprise ``` 2. Run the setup script for the Application Server anew using the following command to apply the configuration changes, and confirm all prompts with the **Enter** key: ``` sudo ./setup.sh ``` {% endstep %} {% endstepper %} ***