Skip to content
Spotlight.ai Knowledge Base home

Microsoft Sign-In (Entra ID) Authorization for Spotlight.ai

> ⚠️ These URLs must exactly match the OAuth callback URL configured in Spotlight.ai.

  1. Ensure the following are enabled:

  2. ✅ ID tokens

  3. (Access tokens optional, depending on backend needs)

3. Create Client Credentials

  1. Go to Certificates & secrets
  2. Click New client secret

  3. Record the following values securely:

  4. Application (client) ID

  5. Directory (tenant) ID
  6. Client secret value

These values are required in Spotlight.ai's authentication configuration.

4. Configure API Permissions

For basic authentication, the following permissions are typically required:

  • openid
  • profile
  • email
  • User.Read

Steps: 1. Go to API permissions 2. Click Add a permission 3. Select Microsoft Graph 4. Choose Delegated permissions 5. Add: - User.Read 6. Click Grant admin consent (recommended)

5. Restrict Which Users Can Sign In

Option A: Allow All Users in the Tenant (Default)

  • Any user in the Entra tenant can sign in
  • No additional configuration required

Option B: Restrict Access to Assigned Users or Groups (Recommended)

  1. Go to Enterprise applications
  2. Select Spotlight.ai
  3. Open Properties

  4. Set:

  5. Assignment required? → Yes

  6. Go to Users and groups

  7. Assign:

  8. Specific users, or

  9. An Entra ID group (preferred)

Only assigned users will be able to sign in.

Option C: Use Conditional Access (Advanced)

Use Conditional Access policies to enforce: - MFA - Device compliance - IP/network restrictions - Role-based access

Path: Security → Conditional Access → New policy

Target: - Cloud app: Spotlight.ai

6. (Optional) Separate App Registrations for Prod and Stage

Instead of a single app registration, you may create two:

  • Spotlight.ai (Production)
  • Spotlight.ai (Stage)

Benefits: - Separate client secrets - Independent access control - Reduced risk of stage configuration affecting production

Both approaches are valid.

7. Test the Sign-In Flow

  1. Log out of Spotlight.ai
  2. Click Sign in with Microsoft

  3. Verify:

  4. Redirect to Microsoft sign-in page

  5. Correct tenant is used
  6. Authorized users can sign in
  7. Unauthorized users are blocked

Checklist

  • [ ] App registered in Microsoft Entra ID
  • [ ] Redirect URIs configured for prod and stage
  • [ ] Client ID, tenant ID, and secret configured in Spotlight.ai
  • [ ] API permissions granted
  • [ ] User/group access restrictions configured (if required)
  • [ ] Authentication flow tested

Notes

  • Ensure callback URLs match exactly between Entra ID and Spotlight.ai
  • Store client secrets securely and rotate regularly
  • Prefer group-based access control for scalability