Microsoft Entra ID integration
Two things from one app registration: single sign-on for the people who use Tagaris, and a people import that pulls your directory into the register.
Single sign-on (Team)
With single sign-on set up, people sign in to Tagaris with their Microsoft account instead of a Tagaris password. Tagaris is an OpenID Connect client of your Entra ID tenant, one identity provider per install, configured by the install owner under Settings, Application, Single sign-on. On someone's first sign-in Tagaris creates their account and attaches it to the organisation with the role your directory says they should have.
- Roles come from your directory: a required mapping from Entra App Roles (or group object IDs) to Admin, Editor and Viewer, re-checked on every sign-in
- Anyone without a mapped value gets the default role you choose, Viewer or Editor, never Admin
- "Require single sign-on" switches off password sign-in for everyone except the install owner
- The owner keeps a local password as the break-glass account, behind Sign in as owner on the login screen
- Enter the client secret's expiry and Tagaris warns 30, 7 and 1 days ahead, in the banner and the daily digest
- The client secret is stored encrypted (AES-256-GCM); a single sign-on user counts against seats like any other
- Two-factor for single sign-on users happens at Microsoft; Tagaris does not ask a second time
What single sign-on needs
Full steps are in the single sign-on documentation.
A Team licence and the owner account
Single sign-on is in every Team tier. Only the install owner (SuperAdmin) can configure it; the tab shows for everyone and stays locked without the licence.
An app registration
In Entra ID, register a Web app with a redirect URI of your Tagaris address followed
by /api/auth/oauth2/callback/sso; the settings page shows the exact URL
to copy. The default OpenID scopes need no admin consent. Copy the tenant ID, client
ID and a client secret.
App Roles
Create app roles with the values Admin, Editor and Viewer, and assign people or groups to them in Enterprise applications. Assigning a group needs Entra ID P1; assigning individual users is free. To match on raw group claims instead, map group object IDs.
Configure and restart
Enter the values and the mapping under Settings, Application, Single sign-on, save,
and restart the app (docker compose restart app). Test a Microsoft
sign-in before turning on Require single sign-on.
People import (free beta)
Separately from sign-in, an administrator can pull people from Entra ID into the
register from People, Import, then Pull from Microsoft Entra. This is for assignees,
the people who hold kit, most of whom will never log in to Tagaris. It reuses the app
registration you already have for single sign-on or Microsoft 365 email, with one more
application permission, User.Read.All, granted with admin consent. The
importing documentation
covers it alongside the CSV importer.
- Enabled users with a name are imported; disabled accounts are skipped
- Matched by email, so running it again only adds new starters
- The same preview and commit as a CSV import; nothing is saved until you confirm
- Read-only against the directory; nothing is written to Entra ID
- Free while in beta, with a key from [email protected] applied under Settings, Application, Licence
What it will not do
- Grant SuperAdmin through single sign-on. The install owner is set up in Tagaris and stays a local login.
- Create logins or use seats through the people import. It creates people records for assigning kit.
- Write to Entra ID. Neither single sign-on nor the import changes the directory.
- Edit or remove existing people on a re-run of the import. It adds new starters and leaves the rest alone.
- Offer other identity providers. Single sign-on is Microsoft Entra ID.
How the roles and the break-glass account fit together is on the security page and in roles and access. The same app can also feed the Intune device sync; everything that connects is listed on the integrations page.
Common questions
What happens if single sign-on breaks?
Sign in as the install owner with their password, using the Sign in as owner link on the login screen, then fix or turn off single sign-on. The owner is a local login on purpose, so recovery never depends on the identity provider.
Can single sign-on make someone an administrator?
Yes, through the mapping: map an app role or group to Admin. It can never grant SuperAdmin, which is the local install owner. Remove someone from the Admin role in Entra and their next sign-in drops them to the default role.
Do imported people use a licence seat?
No. Seats are for logins with a role. People in the register are the assignees you check kit out to, and there is no limit on them.
Can one Entra app serve sign-in, email, the people import and Intune?
Yes. Each use adds its own permission to the same app: the default OpenID scopes for sign-in, Mail.Send for Microsoft 365 email, User.Read.All for the people import and DeviceManagementManagedDevices.Read.All for Intune sync.
Sign in with the accounts you already have
Try the current release in the live demo. Single sign-on is in every Team plan, and the people import needs a free beta key from [email protected].