Create an app registration in your Microsoft Entra directory, add two optional claims, and copy three values into MSPCFO.

1. Register the application

1. Sign in to the Microsoft Entra admin center (https://entra.microsoft.com) as at least an Application Administrator.
2. Go to Identity → Applications → App registrations and choose New registration.
3. Enter:
   • Name: e.g. MSPCFO
   • Supported account types: Accounts in this organizational directory only (single tenant)
   • Redirect URI: platform Web, value https://app.mspcfo.com/user/auth/entra_id/callback
4. Choose Register.

[SCREENSHOT: Entra "Register an application" page filled in]

2. Copy the IDs

On the app registration's Overview page, copy:

• Application (client) ID → MSPCFO Client ID
• Directory (tenant) ID → MSPCFO Directory (tenant) ID

ALERT The Directory (tenant) ID must be your directory's GUID (xxxxxxxx-xxxx-xxxx-xxxx-xxxxxxxxxxxx). MSPCFO refuses common, organizations, consumers, and domain names such as contoso.onmicrosoft.com.

[SCREENSHOT: Entra app Overview page with Client ID and Tenant ID highlighted]

3. Create a client secret

1. Open Certificates & secrets → Client secrets and choose New client secret.
2. Add a description (e.g. MSPCFO SSO) and pick an expiry. Note the expiry date.
3. Copy the secret's Value → MSPCFO Client secret. Entra shows it only once.

WARNING Common mistake: Copy the Value column, not the Secret ID. The Secret ID looks like a GUID and won't work.

[SCREENSHOT: Entra Client secrets list with the Value column highlighted]

4. Add the optional claims (required)

MSPCFO needs Entra to send the user's email address and to confirm that the address belongs to your verified domain. Without this, existing users can't be matched and new users can't be created.

1. Open Token configuration and choose Add optional claim.
2. Choose token type ID.
3. Tick email and xms_edov, then choose Add. If Entra asks to turn on the Microsoft Graph email permission, accept.

INFO xms_edov ("email domain owner verified") tells MSPCFO that the email is on a domain your organization has verified in Entra.

[SCREENSHOT: Entra Add optional claim dialog with email and xms_edov ticked]

5. Check API permissions and consent

• Under API permissions, the Microsoft Graph delegated permissions openid, profile, email and User.Read should be listed. Add any that are missing.
• If your tenant doesn't let users consent to apps, choose Grant admin consent.
• Optional: To limit who can use MSPCFO, open the matching Enterprise application, set Assignment required? to Yes, and assign users or groups.

6. Make sure people have an email address

Entra sends an email address only when the user's Email (mail) property is set. Check it's filled in, with the address they use for MSPCFO, for everyone who will sign in.

7. Finish in MSPCFO

Save, then run Test sign-in.

Entra-specific problems