Enterprise SSO
Microsoft Entra ID
Register ThreatPrevent as a confidential web application in your Entra tenant, then connect it to your ThreatPrevent organisation.
1. Create the app registration
- Open Microsoft Entra admin centre and select App registrations → New registration.
- Use a recognisable name such as ThreatPrevent SSO.
- Select Accounts in this organisational directory only.
- Choose the Web platform and enter the callback below exactly.
Redirect URI (Web)
https://api.threatprevent.io/v1/auth/sso/callback2. Collect the identifiers
From the app overview, copy the Application (client) ID and Directory (tenant) ID. Create a client secret under Certificates & secrets and copy its value immediately; Entra shows it only once.
Record the secret expiry in your operational calendar. An expired secret prevents new SSO sessions.
3. Configure ThreatPrevent
| Field | Value |
|---|---|
| Provider | Microsoft Entra ID |
| Issuer URL | https://login.microsoftonline.com/TENANT_ID/v2.0 |
| Client ID / secret | Values from the app registration |
| Scopes | openid profile email |
| Subject claim | sub |
| Email claim | preferred_username |
| Tenant claim | tid |
| Token authentication | Client secret in request body |
| Require email verified | Off for the Entra default configuration |
4. Verify and activate
- Save the provider.
- Run Test provider to validate discovery, issuer and signing-key metadata.
- Activate only after the test succeeds.
- Add your organisation domain and publish the exact DNS TXT record displayed.
- Verify the domain in ThreatPrevent.