Microsoft Entra ID integration
Two things from one app registration: single sign-on for the people who use Tagaris, and a people import that pulls your directory into the register. This is the Entra guide; Okta, Google Workspace and any other OpenID Connect provider work too.
Single sign-on
With single sign-on set up, people sign in to Tagaris with their Microsoft account instead of a Tagaris password. Tagaris is an OpenID Connect client of your Entra ID tenant, one identity provider per install, configured by the install owner under Settings, Application, Single sign-on. On someone's first sign-in Tagaris creates their account and attaches it to the organisation with the role your directory says they should have. The same page takes Okta, Google Workspace or any other OpenID Connect provider (Keycloak, Authentik, JumpCloud, OneLogin, AD FS); the single sign-on documentation has the exact values for each.
- Roles come from your directory: a required mapping from Entra App Roles (or group object IDs) to Admin, Editor and View only, re-checked on every sign-in
- A directory group can also be mapped onto an access group by name, to give people particular jobs without making them Editors
- Anyone without a mapped value gets the default role you choose, View only or Editor, never Admin
- "Require single sign-on" switches off password sign-in for everyone except the install owner
- The owner keeps a local password as the break-glass account, behind Sign in as owner on the login screen
- Enter the client secret's expiry and Tagaris warns 30, 7 and 1 days ahead, in the banner and the daily digest
- The client secret is stored encrypted (AES-256-GCM), PKCE is used, and the browser callback is bound to the state cookie
- A single sign-on user uses a seat if they can change things; view-only people are free and unlimited
- Two-factor for single sign-on users happens at Microsoft; Tagaris does not ask a second time
What single sign-on needs
Full steps are in the single sign-on documentation.
The owner account and enough seats
Single sign-on is on every plan, and only the install owner (SuperAdmin) can configure it. View-only people sign in free, and the owner is never a seat; each person who can change things uses one, so a team of editors needs a Team plan with enough seats.
An app registration
In Entra ID, register a Web app with a redirect URI of your Tagaris address followed
by /api/auth/oauth2/callback/sso; the settings page shows the exact URL
to copy. The default OpenID scopes need no admin consent. Copy the tenant ID, client
ID and a client secret.
App Roles
Create app roles with the values Admin, Editor and Viewer (the View only role is still written VIEWER in the mapping), and assign people or groups to them in Enterprise applications. Assigning a group needs Entra ID P1; assigning individual users is free. To match on raw group claims instead, map group object IDs.
Configure and restart
Enter the values and the mapping under Settings, Application, Single sign-on, save,
and restart the app (docker compose restart app). Test a Microsoft
sign-in before turning on Require single sign-on.
People import (free, still in testing)
Separately from sign-in, an administrator can pull people from Entra ID into the
register from People, Import, then Pull from Microsoft Entra. This is for assignees,
the people who hold kit, most of whom will never log in to Tagaris. It reuses the app
registration you already have for single sign-on or Microsoft 365 email, with one more
application permission, User.Read.All, granted with admin consent. The
importing documentation
covers it alongside the CSV importer.
- Enabled users with a name are imported; disabled accounts are skipped
- Matched by email, so running it again only adds new starters
- The same preview and commit as a CSV import; nothing is saved until you confirm
- Read-only against the directory; nothing is written to Entra ID
- Free and open on every plan, with no key to request. It is marked still in testing until it has been proven across a range of real tenants; tell [email protected] how it behaves on yours
What it will not do
- Grant SuperAdmin through single sign-on. The install owner is set up in Tagaris and stays a local login.
- Create logins or use seats through the people import. It creates people records for assigning kit.
- Write to Entra ID. Neither single sign-on nor the import changes the directory.
- Edit or remove existing people on a re-run of the import. It adds new starters and leaves the rest alone.
- Support SAML or LDAP. Single sign-on is OpenID Connect: Microsoft Entra ID, Okta, Google Workspace or any other OpenID Connect provider.
How the roles and the break-glass account fit together is on the security page and in roles and access. The same app can also feed the Intune device sync; everything that connects is listed on the integrations page.
Common questions
What happens if single sign-on breaks?
Sign in as the install owner with their password, using the Sign in as owner link on the login screen, then fix or turn off single sign-on. The owner is a local login on purpose, so recovery never depends on the identity provider.
Can single sign-on make someone an administrator?
Yes, through the mapping: map an app role or group to Admin. It can never grant SuperAdmin, which is the local install owner. Remove someone from the Admin role in Entra and their next sign-in drops them to the default role.
Do imported people use a licence seat?
No. Seats are for logins that can change things. People in the register are the assignees you check kit out to, and there is no limit on them.
Does Tagaris work with identity providers other than Entra ID?
Yes. Okta, Google Workspace and any OpenID Connect provider such as Keycloak, Authentik, JumpCloud, OneLogin or AD FS. Choose the provider under Settings, Application, Single sign-on and the form asks for what it needs. The single sign-on documentation has the exact values for each.
Can one Entra app serve sign-in, email, the people import and Intune?
Yes. Each use adds its own permission to the same app: the default OpenID scopes for sign-in, Mail.Send for Microsoft 365 email, User.Read.All for the people import and DeviceManagementManagedDevices.Read.All for Intune sync.
Sign in with the accounts you already have
Try the current release in the live demo. Single sign-on and the people import are on every plan, the free tier included.