Configuring Microsoft Entra ID SSO for Vantage

Environments: Production, and optionally Staging/UATPurpose: Register Vantage in your Microsoft Entra ID (formerly Azure Active Directory) tenant so your users can sign in to Vantage through federated Single Sign-On (SSO), using NPI's Auth0 tenant.

Environment Values

If you want to test SSO before going live, NPI can set up a Staging/UAT connection first. Register a separate app registration for each environment, so each has its own client ID and secret. Wherever this guide shows a Production value, use the matching UAT value from this table for your UAT registration.

1. Prerequisites

Before starting, verify:

• You can sign in to the Microsoft Entra admin center (https://entra.microsoft.com) with at least the Application Developer role, which is enough to register the app.
• Someone in your organization can grant tenant-wide admin consent, typically a Cloud Application Administrator, Application Administrator, or higher. You need them in Steps 4 and 6.
• If you have access to more than one tenant, you know which one holds your Vantage users. Registering in the wrong directory is the most common setup mistake.

2. Register the Vantage Application

1. Sign in to the Microsoft Entra admin center. If you have access to multiple tenants, use the Settings icon in the top menu to switch to the correct one.
2. Browse to Entra ID → App registrations and select New registration.
3. Complete the form. The values below are for Production; for UAT, use the UAT column of the Environment Values table.

4. Select Register.
5. On the app's Overview page, copy the Application (client) ID and the Directory (tenant) ID.

2.1 Add the backup Redirect URI

1. In your app registration, go to Manage → Authentication.
2. Under the Web platform, select Add URI and enter https://npi-prod.us.auth0.com/login/callback (UAT: https://npi-uat-2026-05-22.us.auth0.com/login/callback).
3. Select Save.

⚠️ Redirect URIs must match exactly: https, no trailing slash, no wildcards.

Why single tenant? Single tenant restricts sign-in to your organization's directory, and Auth0 requires it if you later want SCIM-based user provisioning. Choose a multitenant option only if NPI asks you to.

3. Create a Client Secret

1. In your app registration, go to Manage → Certificates & secrets → Client secrets and select New client secret.
2. Enter a description, for example Auth0 - Vantage Prod, and choose an expiration.
3. Select Add, then copy the secret's Value immediately. Entra shows it only once.

✅ Copy the Value, not the Secret ID. ✅ Record the expiration date. Sign-in to Vantage stops working when the secret expires, so create a replacement and send it to NPI before that date.

4. Configure API Permissions

Every new app registration starts with the Microsoft Graph delegated permission User.Read, which is all Vantage needs for basic sign-in.

1. In your app registration, go to Manage → API permissions.
2. Confirm Microsoft Graph → User.Read (Delegated) is listed.
3. Only if NPI asks for group membership or extended profile attributes, select Add a permission → Microsoft Graph → Delegated permissions and add Directory.Read.All.
4. Select Grant admin consent for <your tenant name>, then select Yes.

5. (Optional) Control Who Can Sign In

By default, any user in your tenant can sign in to Vantage once SSO is live. To limit access to specific users or groups:

1. Browse to Entra ID → Enterprise apps and select your Vantage app, for example NPI Vantage (Auth0) - Prod.
2. Under Properties, set Assignment required? to Yes and select Save.
3. Under Users and groups, select Add user/group and assign the users or groups who should have access.

Users who are not assigned will see an Entra error when they try to sign in.

6. Share Required Details with the Vantage Team

Provide the following to your Vantage implementation engineer. If you set up UAT too, send one set for each environment and label each with its environment.

? Share the client secret through a password manager share or another encrypted channel agreed with your implementation engineer. Do not send it over email.

6.1 Grant consent for the Auth0 connection

After NPI creates the connection, Auth0 generates a consent URL. Your implementation engineer will send it to you.

1. Open the URL while signed in as an administrator who can grant tenant-wide consent.
2. Review the requested permissions and accept on behalf of your organization.

Until this is done, users see a "Need admin approval" message when they try to sign in.

7. Test the Connection

Once NPI confirms the connection is live and consent has been granted, test in UAT first if you set it up, then in Production:

1. Open a private or incognito browser window.
2. Go to the Vantage Login URL for the environment (Production: https://www.npi-digital.com; UAT: https://uat.npi-digital.com) and enter the test user's work email.
3. Confirm you are redirected to the Microsoft sign-in page, not the Vantage password prompt.
4. Sign in. You should land in Vantage, signed in as the test user, with no consent prompt.

If a step fails, note the time and the full error text, including any AADSTS code, and send them to NPI.

8. Common Errors to Avoid

9. Frequently Asked Questions

Can we test SSO before going live in Production?  Yes. Ask your implementation engineer for a Staging/UAT connection. Create a second app registration using the UAT values in the Environment Values table, send NPI its details, and test at https://uat.npi-digital.com. Once UAT works, repeat the steps with the Production values.

Can we use one app registration for both UAT and Production?We recommend separate registrations. They keep the secrets independent, so rotating or revoking one does not affect the other.

Do we need to do anything when Microsoft rotates its signing keys?No. Entra ID rolls its token-signing keys periodically, and Auth0 picks up the new keys automatically.

Can we send custom or optional claims to Vantage?Not through this connection type. Auth0's Microsoft Entra ID connection returns a fixed set of claims, so custom or optional claims configured in Entra will not reach Vantage. If you need them, ask NPI about an OIDC or SAML connection instead.

What happens when our client secret expires?Sign-in to Vantage fails for all users. Create a new secret before the old one expires, send it to NPI securely, and delete the old secret only after NPI confirms the switch.

We previously used Azure Active Directory. Does anything change?No action is needed for existing connections. Microsoft renamed Azure Active Directory to Microsoft Entra ID; the portal moved to https://entra.microsoft.com, but the steps are the same.

10. Quick Checklist

Complete the checklist once for each environment you set up.

• [ ] (Optional) UAT app registration created and tested before Production
• [ ] App registered in the correct Entra tenant as Single tenant
• [ ] Both redirect URIs added under the Web platform
• [ ] Client secret Value copied and expiration date recorded
• [ ] User.Read present; Directory.Read.All added only if requested
• [ ] Admin consent granted in API permissions
• [ ] (Optional) User assignment configured
• [ ] Domain, tenant ID, client ID, secret, expiry, and test user sent to NPI
• [ ] Auth0 consent URL accepted by an administrator
• [ ] Test sign-in completed

Need Help?

If you encounter issues or need assistance, contact your Vantage implementation engineer or reach us at support@npi-digital.com.

Sources

• Auth0: Connect Your App to Microsoft Azure Active Directory
• Microsoft: Register an application in Microsoft Entra ID
• Microsoft: Add and manage application credentials in Microsoft Entra ID