> For the complete documentation index, see [llms.txt](https://docs.frends.com/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://docs.frends.com/bap/general/single-sign-on.md). # Single Sign-On How to configure SSO for your Portal. Single Sign-On (SSO) allows users of your Frends Business Automation Portal to sign in with their corporate identity provider instead of managing a separate email and password for the portal. This centralizes authentication in your existing identity infrastructure, strengthens security, and removes the burden of remembering another set of credentials for your users. SSO is configured at the portal level by Business Automation Portal Administrators. The Business Automation Portal supports multiple SSO configurations, allowing you to connect one or more Microsoft Entra ID tenants and route users automatically based on their email domains. {% hint style="info" %} Note that Frends Tenant, API Portal and Business Automation Portal all use different configuration for SSO. Please follow the corresponding instructions to set up each SSO. {% endhint %} ## Prerequisites Before you begin, make sure you have the following in place: * You need access to the Microsoft Entra ID tenant that will act as the identity provider, with permissions to create and configure an application registration. * You also need administrator rights in the Business Automation Portal, since only administrators can configure and manage SSO settings. ## Configuring the Application in Microsoft Entra ID The first step is to create an application registration in your Entra ID tenant. This application represents the Business Automation Portal and allows it to delegate authentication to your identity provider. Sign in to the Microsoft Entra admin center and navigate to **Microsoft Entra ID > Manage > App registrations**. Click **New registration**. Enter a name for the application, for example `Frends Business Automation Portal`, and leave the default **Single tenant only** option selected so that only users in your tenant can authenticate. You do not need to set a redirect URI here, since it is added separately in the next step. Click **Register** to create the application.

Entra ID app registration view.

### Configure the Redirect URI and Tokens After the application is created, you are taken to its overview page. Note the **Application (client) ID** and the **Directory (tenant) ID**, since you will need both when configuring the Business Automation Portal later. Open the application's **Authentication** page from the sidebar (under **Manage**) and click **Add a platform**. Choose **Web** and enter the redirect URI for your portal in the following format: ``` https://{bap-domain}.frendsapp.com/signin-oidc-{applicationId} ``` Replace `{bap-domain}` with the actual domain of your Business Automation Portal and `{applicationId}` with the Application (client) ID of your registered application. This redirect URI tells Entra ID where to send users after they have authenticated. Under the **Implicit grant and hybrid flows** section on the same page, select the checkbox for **ID tokens (used for implicit and hybrid flows)**. The Business Automation Portal requires ID tokens to complete the sign-in flow. Click **Configure** to save the platform. That is all that is required on the Entra ID side. You can now move on to configuring SSO in the Business Automation Portal. ## Configuring SSO in the Business Automation Portal In the Business Automation Portal, navigate to **Settings >** **SSO configuration** view and click **+ New configuration** to create a new SSO provider. The Business Automation Portal supports multiple SSO configurations, so you can register more than one identity provider if needed. Fill in the fields in the **SSO Details** dialog using the values from your Entra ID application registration: * **Entra tenant:** enter a friendly name for this SSO provider, for example `Azure-Ad-Provider`. * **Associated domains:** enter your organization's email domain, for example `frends.com`. When users enter an email address with this domain at login, the portal automatically routes them to this SSO provider. The field supports multiple domains as comma-separated list. * **Application id**: enter the Application (client) ID of your application in Entra ID, found in the application's overview page. * **Authority:** enter the identity provider authority URL in the format `https://login.microsoftonline.com/{tenantId}`, where `{tenantId}` is your Entra ID Directory (tenant) ID. * **Post logout redirect URI:** enter the URL where users should be redirected after logging out: `https://{bap-domain}.frendsapp.com/login` * Replace `{bap-domain}` with the domain of your Business Automation Portal. * **Name claim type:** enter the following claim URI: ``` http://schemas.xmlsoap.org/ws/2005/05/identity/claims/name ``` When you have filled in all the fields, click **Save** to save the configuration. The new SSO configuration is now active in the Business Automation Portal. ## How SSO Behaves at Login When Single Sign-On is configured, the Business Automation Portal handles authentication by matching the domain of the email address entered by the user. When a user enters their email address on the portal login page, the portal identifies the corresponding identity provider and redirects the user to Microsoft Entra ID to sign in. The user needs to be invited as a user to the BAP before user can log in with SSO. Because the Business Automation Portal supports multiple SSO configurations, organizations can configure separate identity providers for different domains or business units. Users authenticate through your corporate identity provider according to your organizational security policies, such as conditional access and multi-factor authentication. After authenticating successfully with Microsoft Entra ID, users are redirected back to the Business Automation Portal and logged in. When a user signs out, their session is terminated and they are returned to the configured post-logout redirect URI. --- # Agent Instructions This documentation is published with GitBook. GitBook is the documentation platform designed so that both humans and AI agents can read, navigate, and reason over technical content effectively. Learn more at gitbook.com. ## Querying This Documentation If you need additional information that is not directly available in this page, you can query the documentation dynamically by asking a question. Perform an HTTP GET request on the current page URL with the `ask` query parameter, and the optional `goal` query parameter: ``` GET https://docs.frends.com/bap/general/single-sign-on.md?ask=&goal= ``` `ask` is the immediate question: it should be specific, self-contained, and written in natural language. `goal` is optional and describes the broader end goal you are ultimately trying to accomplish on behalf of the user. GitBook uses it to tailor the answer towards what is most useful for that goal. The response will contain a direct answer to the question and relevant excerpts and sources from the documentation. Use this mechanism when the answer is not explicitly present in the current page, you need clarification or additional context, or you want to retrieve related documentation sections.