Docs/Single sign-on

Microsoft Entra ID

~10 minutes

Set up OpenID Connect sign-in against Microsoft Entra ID (formerly Azure AD). Once configured, members whose email matches your tenant's domain land on the Microsoft sign-in flow automatically.

Before you start

A Microsoft Entra ID tenant.
The Application Developer role (or higher) on that tenant.
Your Wando contact on standby to receive the credentials at the end.

Steps

1
Open the Entra admin center
Sign in to the Microsoft Entra admin center at entra.microsoft.com. If you have access to more than one tenant, use the Settings icon to switch to the right one before continuing.
2
Create a new app registration
In the left navigation, open Entra ID → App registrations and click "New registration". Give the app a name such as "Wando", then choose the account type — "Single tenant" is the right answer for almost every business deployment.
3
Add the Wando redirect URI
Under "Redirect URI", choose the "Web" platform and paste the URL below. This is the address Microsoft will send the user back to after sign-in. Click "Register" to create the app.
```
https://www.wando.tromb.com/api/auth/callback/<your-provider-id>
```
Replace `<your-provider-id>` with the slug you will use in Wando (e.g. "entra-acme"). You set this in step 7.
4
Record the Application (client) ID and Tenant ID
You will see the new app's Overview page. Copy the "Application (client) ID" and "Directory (tenant) ID" — Wando needs both.
5
Create a client secret
In the left menu of the app, open "Certificates & secrets" → "Client secrets" → "New client secret". Pick an expiry that suits your rotation policy and click "Add". Copy the secret VALUE (not the ID) immediately — it is shown only once.
Microsoft only shows the secret value once. If you navigate away you will need to create a new one.
6
Confirm the API permissions
Open "API permissions". Microsoft Graph → "User.Read" is added by default, which is what we need for sign-in. If you are configuring an external tenant, click "Grant admin consent for <tenant>" so users do not have to consent individually.
7
Note the OpenID Connect metadata URL
Wando uses the OIDC discovery endpoint to find the rest of the configuration automatically. The URL pattern for Entra is:
```
https://login.microsoftonline.com/<tenant-id>/v2.0/.well-known/openid-configuration
```

Hand off to Wando

Send your values to your Wando contact

hej@wando.app

Send the values below to your Wando contact. They will wire them into your organisation's SSO config and confirm when the provider is live for your users to sign in with.

Suggested provider ID: entra-<short-org-name> (lowercase, hyphens only)
Issuer URL: https://login.microsoftonline.com/<tenant-id>/v2.0
Email domain: acme.com (your tenant's primary domain)
Client ID: Application (client) ID from step 4
Client secret: Secret value from step 5

Steps

Open the Entra admin center

Sign in to the Microsoft Entra admin center at entra.microsoft.com. If you have access to more than one tenant, use the Settings icon to switch to the right one before continuing.

Create a new app registration

In the left navigation, open Entra ID → App registrations and click "New registration". Give the app a name such as "Wando", then choose the account type — "Single tenant" is the right answer for almost every business deployment.

Add the Wando redirect URI

Under "Redirect URI", choose the "Web" platform and paste the URL below. This is the address Microsoft will send the user back to after sign-in. Click "Register" to create the app.

https://www.wando.tromb.com/api/auth/callback/<your-provider-id>

Replace `<your-provider-id>` with the slug you will use in Wando (e.g. "entra-acme"). You set this in step 7.

Record the Application (client) ID and Tenant ID

You will see the new app's Overview page. Copy the "Application (client) ID" and "Directory (tenant) ID" — Wando needs both.

Create a client secret

In the left menu of the app, open "Certificates & secrets" → "Client secrets" → "New client secret". Pick an expiry that suits your rotation policy and click "Add". Copy the secret VALUE (not the ID) immediately — it is shown only once.

Microsoft only shows the secret value once. If you navigate away you will need to create a new one.

Confirm the API permissions

Open "API permissions". Microsoft Graph → "User.Read" is added by default, which is what we need for sign-in. If you are configuring an external tenant, click "Grant admin consent for <tenant>" so users do not have to consent individually.

Note the OpenID Connect metadata URL

Wando uses the OIDC discovery endpoint to find the rest of the configuration automatically. The URL pattern for Entra is:

https://login.microsoftonline.com/<tenant-id>/v2.0/.well-known/openid-configuration