Microsoft Entra SSO

Use this guide to set up Microsoft Entra ID (Azure AD) SSO for one workspace. Each workspace can have its own Entra app registration.

Prerequisites

• Workspace owner/admin access in Quantum SmartQR.
• Permission to create app registrations in Microsoft Entra.
• Production host served over HTTPS.

Quick Flow

1. Create an app registration in Entra.
2. Copy Tenant ID, Client ID, and Client Secret.
3. Copy Redirect URI from Quantum SmartQR Settings and add it to Entra.
4. Grant admin consent in Entra for the app (recommended to avoid end-user consent prompts).
5. Save Entra config in Quantum SmartQR.
6. Enable "Require Microsoft Entra SSO" in SSO policy.

1) Create the Entra app

1. Open Microsoft Entra admin center.
2. Go to Applications -> App registrations -> New registration.
3. After registration, copy:
   • Directory (tenant) ID
   • Application (client) ID
4. Create a client secret under Certificates and secrets and copy the secret Value.

2) Configure Redirect URI in Entra

In Quantum SmartQR, go to Settings → Integrations and open the Microsoft Entra SSO card.

The Redirect URI field is prefilled from your current host. Copy that exact value and add it in Entra:

• Authentication -> Add a platform -> Web
• Redirect URIs: paste the exact URL

Typical value: https://your-domain.com/auth/sso/callback

3) Step 1 — Save the Entra connection

1. Open Settings → Integrations.
2. Under Step 1 — Connect your Entra app, enter:
   • Entra tenant ID
   • Application (client) ID
   • Client secret
   • Redirect URI (keep prefilled value unless intentionally using another sign-in host)
3. Turn on Active for this workspace when the details are correct.
4. Click Save Entra connection.

4) Grant Admin Consent (recommended)

1. In Entra app registration, open API permissions.
2. Click Grant admin consent for your directory.
3. This prevents first sign-in consent prompts for each user in most enterprise setups.

5) Step 2 — Enforce sign-in policy

1. In the same Microsoft Entra SSO card, open Step 2 — Workspace sign-in policy.
2. Enable Require Microsoft Entra SSO after Step 1 is active.
3. Optionally enable Require MFA from identity provider.
4. Click Save sign-in policy.

Troubleshooting

• Workspace context is required: refresh and save again. This page uses your signed-in workspace context when saving settings.
• AADSTS50011 redirect mismatch: copy Redirect URI from Quantum SmartQR Settings and paste exactly into Entra Web Redirect URIs.
• Not configured for this workspace: complete Step 1 and activate the Entra connection before saving Step 2.

Secret Rotation

When client secret expires: create a new secret in Entra, paste it in Quantum SmartQR, and save. Then remove old secret in Entra.

Need help?

See Workspace and Settings, FAQ, or Contact Support.