Microsoft Sign-In (Entra ID) Authorization for Spotlight.ai

Last updated: August 5, 2026

> ⚠ These URLs must exactly match the OAuth callback URL configured in Spotlight.ai.

  1. Ensure the following are enabled:

  • ✅ ID tokens

  • (Access tokens optional, depending on backend needs)

3. Create Client Credentials

  1. Go to Certificates & secrets

  2. Click New client secret

  3. Record the following values securely:

  • Application (client) ID

  • Directory (tenant) ID

  • Client secret value

These values are required in Spotlight.ai’s authentication configuration.

4. Configure API Permissions

For basic authentication, the following permissions are typically required:

  • openid

  • profile

  • email

  • User.Read

Steps: 1. Go to API permissions 2. Click Add a permission 3. Select Microsoft Graph 4. Choose Delegated permissions 5. Add: - User.Read 6. Click Grant admin consent (recommended)

5. Restrict Which Users Can Sign In

Option A: Allow All Users in the Tenant (Default)

  • Any user in the Entra tenant can sign in

  • No additional configuration required

Option B: Restrict Access to Assigned Users or Groups (Recommended)

  1. Go to Enterprise applications

  2. Select Spotlight.ai

  3. Open Properties

  4. Set:

  • Assignment required? → Yes

  1. Go to Users and groups

  2. Assign:

  • Specific users, or

  • An Entra ID group (preferred)

Only assigned users will be able to sign in.

Option C: Use Conditional Access (Advanced)

Use Conditional Access policies to enforce: - MFA - Device compliance - IP/network restrictions - Role-based access

Path: Security → Conditional Access → New policy

Target: - Cloud app: Spotlight.ai

6. (Optional) Separate App Registrations for Prod and Stage

Instead of a single app registration, you may create two:

  • Spotlight.ai (Production)

  • Spotlight.ai (Stage)

Benefits: - Separate client secrets - Independent access control - Reduced risk of stage configuration affecting production

Both approaches are valid.

7. Test the Sign-In Flow

  1. Log out of Spotlight.ai

  2. Click Sign in with Microsoft

  3. Verify:

  • Redirect to Microsoft sign-in page

  • Correct tenant is used

  • Authorized users can sign in

  • Unauthorized users are blocked

Checklist

  • [ ] App registered in Microsoft Entra ID

  • [ ] Redirect URIs configured for prod and stage

  • [ ] Client ID, tenant ID, and secret configured in Spotlight.ai

  • [ ] API permissions granted

  • [ ] User/group access restrictions configured (if required)

  • [ ] Authentication flow tested

Notes

  • Ensure callback URLs match exactly between Entra ID and Spotlight.ai

  • Store client secrets securely and rotate regularly

  • Prefer group-based access control for scalability