How to enable Entra ID single sign-on (SSO)

Setting up single sign-on in Qvalia using entra ID, formerly Azure Active Directory. Technical experience and admin permission is required.

SSO for your Qvalia account is configured using Entra ID. SSO will be enabled for all Qvalia users in your organization.

Register a new client​

1. Browse to the App registration menus and create dialog to create a new app.
2. Give the application a name and choose who should be able to login (Single-Tenant).
3. Choose "Web" in the redirect uri field and add the URL:
   https://qvalia-xsmzae.zitadel.cloud/ui/login/login/externalidp/callback.
4. Save the Application (client) ID and the Directory (tenant) ID from the detail page.

Add client secret​

1. Generate a new client secret to authenticate your user.
2. Click on client credentials on the detail page of the application or use the menu "Certificates & secrets".
3. Click on "+ New client secret" and enter a description and an expiry date, add the secret afterwards.
4. Copy the value of the secret. You will not be able to see the value again after some time.

Token configuration​

1. Click on Token configuration in the side menu.
2. Click on "+ Add optional claim".
3. Add email, family_name, given_name and preferred_username to the id token.

API permissions

1. Go to "API permissions" in the side menu.
2. Make sure the permissions include "Microsoft Graph": email, profile and User.Read
3. The "Other permissions granted" should include "Microsoft Graph: openid"

Final step

Send the following credentials to Qvalia:

• Application (client) ID
• Directory (tenant) ID
• Client secret