Home / Single sign-on / Microsoft Entra ID
Single sign-on

Microsoft Entra ID

Register Masttro as an application in your Microsoft Entra ID tenant (formerly Azure Active Directory). You need a role that can create app registrations, such as Application Administrator.

Register the application

  1. In the Microsoft Entra admin center, open App registrations and click New registration.

    Entra admin center, App registrations page with New registration highlighted

  2. Fill in the registration:

    • Name: for example Masttro.
    • Supported account types: Accounts in this organizational directory only.
    • Redirect URI: platform Single-page application (SPA), with your Masttro login URL in lowercase: {{WEB_APP_URL}}/[instance].

    Click Register.

    Register an application form: name, single tenant account type, and a Single-page application redirect URI with the Masttro login URL

  3. On the application's Overview page, copy the Application (client) ID.

    Application overview with the Application (client) ID and the Endpoints button highlighted

  4. Click Endpoints and copy the OpenID Connect metadata document URL.

    Endpoints panel with the OpenID Connect metadata document URL highlighted

Add the email claim

Masttro identifies the user by the email in the access token.

  1. Open Token configuration and click Add optional claim.

  2. Select token type Access, check email and click Add. If Entra asks to add the Microsoft Graph email permission, accept.

    Token configuration, Add optional claim panel with token type Access and the email claim checked

    The claim is now listed:

    Token configuration listing the email optional claim for the Access token

Expose an API scope

  1. Open Expose an API and click Add a scope. Accept the suggested Application ID URI (api://<client id>) and click Save and continue.

    Expose an API page, Add a scope panel with the suggested Application ID URI highlighted

  2. Enter a Scope name (for example Masttro.SSO), set Who can consent to Admins only, fill in the admin consent display name and description, make sure State is Enabled, and click Add scope.

    Add a scope panel with scope name, Admins only consent, consent texts and State Enabled

  3. Copy the Application ID URI and the scope name.

    Expose an API page showing the Application ID URI and the new enabled scope

Use v2 access tokens

  1. Open Manifest. Under api, change requestedAccessTokenVersion from null to 2:

    Manifest editor with requestedAccessTokenVersion set to 2 under api

  2. Click Save.

Allow the mobile app redirect URIs

Needed if your users sign in to the Masttro phone or tablet app with SSO.

  1. Open Authentication and click Add a platform (or Add Redirect URI).

  2. Choose Mobile and desktop applications, enter these custom redirect URIs and click Configure:

    store.masttro.token://oidc/callback
store.masttro.dfo://oidc/callback

    The first is the phone app and the second the tablet app.

Allow the MCP redirect URI

Only needed if your users will connect AI assistants to Masttro through the MCP server. It can be added at any time and doesn't affect the web application.

  1. Open Authentication. If you already added the mobile app URIs, click Add URI under Mobile and desktop applications. Otherwise click Add a platform and choose Mobile and desktop applications.

  2. Enter this custom redirect URI and save:

    {{MCP_SSO_REDIRECT_URI}}
Not under single-page application The MCP sign-in is completed by the Masttro authorization server, not by the browser. Entra ID rejects that for single-page application URIs with AADSTS9002327. Use Mobile and desktop applications, the same platform as the mobile app URIs.

Send the values to Masttro

Send these to your Masttro representative. None of them is a secret:

  1. Application (client) ID
  2. OpenID Connect metadata document URL
  3. Application ID URI
  4. Scope name

Masttro configures your instance and tests the sign-in with you. See Troubleshooting if something fails.