Set up Microsoft sign-in through your own Entra app for the employee portal

Let your employees sign in to the Ploy employee portal through an app registration in your own Microsoft Entra tenant, instead of Ploy's shared Microsoft app. Your own app means your tenant decides who can sign in and which Conditional Access policies apply. Your app trusts short-lived tokens signed by Ploy through a federated credential, so there is no client secret to create, store or rotate. This is separate from SAML single sign-on, which signs admins in to the Ploy dashboard.

Before you start

You need:

• Permission to register applications in Microsoft Entra, for example the Application Administrator role.

• Access to Settings → Portal in Ploy.

• Your employees already in Ploy. Ploy signs someone in only when the email Microsoft returns matches an employee in your organization.

Choose your own app in Ploy

1. In Ploy, go to Settings → Portal.

2. Under Login Options, make sure Microsoft is turned on. The Microsoft sign-in panel appears below.

3. Under App people sign in through, choose Your own Microsoft Entra app.

4. Keep this page open, and do not save yet. You copy the Redirect URI from it into Microsoft Entra.

Register the app in Microsoft Entra

1. In the Microsoft Entra admin center, go to Entra ID → App registrations and click New registration.

2. Name it something recognisable, for example Ploy employee portal.

3. Fill in the settings below, then click Register.

4. On the app's Overview page, copy the Application (client) ID and the Directory (tenant) ID. You paste both into Ploy later.

Check the app's permissions

Ploy reads the signed-in person's own profile to get their email address. On the app's API permissions page, make sure the delegated Microsoft Graph permission User.Read is listed. New app registrations include it by default.

If your tenant does not let users consent to apps, click Grant admin consent on that page so employees are not asked to approve the app.

Add the auth_time claim (optional)

Ploy asks an employee to sign in again before they add or remove a passkey, and it uses the auth_time claim to confirm that they did. Without the claim, sign-in works but passkey setup is refused.

1. On the app's Token configuration page, click Add optional claim.

2. Choose ID as the token type, tick auth_time, then click Add.

Add a federated credential

1. On the app's Certificates & secrets page, open the Federated credentials tab and click Add credential.

2. Under Federated credential scenario, choose Other issuer.

3. Copy the three values from the Microsoft sign-in panel in Ploy:

4. Give the credential a name, for example ploy-portal-sign-in, then click Add.

Choose who can sign in (optional)

By default, anyone in your tenant can use the app. To limit it, go to Entra ID → Enterprise apps, open the app, set Assignment required? to Yes under Properties, then assign people or groups under Users and groups.

You can also target the app with Conditional Access policies, for example to require multifactor authentication or a compliant device.

Open the portal from My Apps (optional)

So employees can open the portal from their Microsoft My Apps page and be signed in straight away, give the app a home page URL that starts Microsoft sign-in automatically.

1. On the app registration's Branding & properties page, set Home page URL to your portal's sign-in address with ?auth=microsoft on the end:

https://<your-portal-subdomain>.employee-access.com/members/auth/sign-in?auth=microsoft

2. Click Save.

3. In Entra ID → Enterprise apps, open the app and make sure Visible to users? is Yes under Properties.

With ?auth=microsoft, the portal skips its login page and sends the employee to Microsoft, as long as Microsoft is turned on under Login Options. Without it, the same address shows the login page with its buttons. You can use the same link anywhere else you point employees at the portal, for example an intranet page or a bookmark.

Connect Ploy

Back in Ploy on Settings → Portal, fill in the Microsoft sign-in panel, then click Save.

Test it

1. Open your portal address, for example https://<your-portal-subdomain>.employee-access.com. You can find it under Portal URL on Settings → Portal.

2. Click Login with Microsoft. Microsoft shows your own tenant's sign-in page, with the name of your app.

3. Sign in with an account from your tenant whose email matches an employee in Ploy.

What employees see

Nothing changes on the portal's login page. Employees click Login with Microsoft as before, and Ploy sends them to your app. The Ploy browser extension, Ploy Desktop and Ploy for iPhone use your app as well.

Once you save, Ploy stops accepting Microsoft sign-ins to your portal through its shared app. Employees who are already signed in stay signed in until their session ends, then sign in through your app.

To go back, choose Ploy's Microsoft app under App people sign in through and click Save.

Fix sign-in errors