Support Knowledgebase
NAV

OpenID Connect with Microsoft Entra ID (SimpleHelp Single Sign-On)

SimpleHelp supports single sign-on (SSO) using OpenID Connect with Microsoft Entra ID (formerly Azure Active Directory / Azure AD). To enable technicians to authenticate using Entra ID, an administrator must create an App Registration in the Microsoft Entra admin center (or Azure portal) and enter the application details into SimpleHelp.

Overview

This document will guide you through completing the following steps:

  1. Create and configure an App Registration
  2. Create an application credential (client secret)
  3. Copy the required values into SimpleHelp (Client ID, Tenant ID, Credential)

App Registrations Screenshot

1) Create the App Registration

  1. Select New registration to create a new App Registration.
  2. Enter a Name for the application, for example: SimpleHelp Integration.
  3. Under Supported account types, choose the option that best matches your login requirements.
    • If unsure, select Accounts in this organizational directory only (Single tenant).
  4. Under Redirect URI, select Web and paste the redirect URI provided by SimpleHelp (ending in .../oidc).
    • This can be found in the SimpleHelp Technician Console when configuring Authentication Services under the Azure App Settings. Azure App Settings Screenshot
  5. Select Register (or Create) to complete the registration.

A summary for your new App Registration is presented in the figure below.

Completed App Registration Screenshot

Record these values

You will need the following values to input in the SimpleHelp Technician Console:

  • Application (client) ID
  • Directory (tenant) ID

2) Configure Authentication and Tokens

  1. In App registrations, click Authentication (Preview) in the menu to the left.
  2. Select the Settings tab (next to Redirect URI configuration).
  3. Under Implicit grant and hybrid flows, check both:
    • Access tokens
    • ID tokens
  4. Click Save.

Add Group Claims (optional)

If you want SimpleHelp to receive group membership information in tokens (role/group mapping), configure group claims:

  1. In the left menu, select Token configuration.
  2. Select Add group claims (next to Add optional claim).
  3. Choose which group types to return.
    • If you only want groups assigned to the app, select Groups assigned to the application.
  4. Select Add at the bottom to save the claim.

A summary of your new Token Configuration is presented.

Token Configuration Screenshot

Note: For advanced configuration of group claims and roles, please consult Microsoft’s official documentation and guidance.

API Permissions (OpenID scopes)

In most environments, the minimum delegated permissions for basic sign-in is User.Read. This permission is considered least privileged and allows the application to read basic profile information of the signed-in user (display name, user ID, email address). We will use User.Read as the baseline for the application which only needs to authenticate and read the user profile.

  1. In the left menu, select API permissions.
  2. Select Add a permission.
  3. Select Microsoft Graph.
  4. Select Delegated permissions.
  5. Search for openid.0
  6. Select openid and Add permission.
  7. Select Grant admin consent to apply the permissions.

Note: By default, your tenant may already include User.Read on new app registrations. Only grant additional permissions if you have a clear requirement.

3) Application Credentials (Client Secret or Certificate)

To create a client secret in the App Registration:

  1. Go to Certificates & secrets (left menu).
  2. Under Client secrets, select New client secret.

Note: The client secret description should be clear and descriptive to identify its purpose. For expiration, security best practices strongly advise against long-lived secrets. Microsoft experts often recommend shorter expiration periods such as 3–6 months to reduce the risk of credential exposure.

Create a client secret

  1. Select New client secret.
  2. Enter a description and choose an expiration duration.
  3. Press Add at the bottom of the window to generate the new client secret.
  4. Copy the Value immediately and store it securely — you cannot retrieve the value later.

Security best practice: Store secrets in a secure vault (e.g., Azure Key Vault or an equivalent secret manager). Avoid storing secrets in emails, tickets, or shared documents.

The new client secret will appear in the summary.

Entra Secret Summary Screenshot

4) Final Steps in SimpleHelp

In SimpleHelp, create or edit the Microsoft Entra ID / Azure option under Authentication Services, then enter:

  • Client ID (Application ID)
  • Tenant ID (Directory ID)
  • Client Secret value

When a technician selects this login option, they will be redirected to Microsoft Entra ID to sign in. After successful authentication, Entra ID redirects the user back to the SimpleHelp server via the configured redirect URI.