Microsoft Entra ID integration
One company login for every internal system, and one place to switch it off when somebody leaves.
Identity
Chosen per project
Maintainable handover
Most organisations that use Microsoft 365 already have an identity directory they are paying for, and most internal applications still ignore it in favour of their own username and password table. That produces the two problems every audit finds: staff reusing passwords, and accounts that survive the person leaving.
Wiring an application to Entra ID removes both. Access follows the directory, group membership drives roles, and disabling one account closes every door at once.
What we build with Entra ID
Internal tools that should not have their own password database
Applications where access must be revoked the day someone leaves
Systems needing multi-factor authentication without building it
Role-based permissions driven by existing security groups
Where it fits — and where it does not
Good fit when
Organisations already on Microsoft 365
Internal and partner-facing applications
Anywhere access review or audit evidence is required
Consider something else when
Public consumer sign-up, which is better served by a customer identity service
Organisations with no existing directory, where the setup cost lands first
What single sign-on actually removes
Each step here is a place where a bespoke login goes wrong.
No password stored
Your app never holds credentials to leak.
MFA inherited
Whatever the organisation enforces applies here too.
Roles from groups
Access managed where staff records already live.
One offboarding
Disable the account; every application closes.
How we work with Entra ID
Standard protocols
OpenID Connect and OAuth 2.0 rather than anything bespoke, so the integration is portable.
Groups drive roles
Application permissions mapped from directory groups, so access changes are made by IT, not by us.
Least privilege
Token scopes narrowed to what the application genuinely needs.
Break-glass path
A documented route to administration if the directory itself is unavailable.
Our typical Entra ID setup
| Concern | What we use |
|---|---|
| Protocols | OpenID Connect for sign-in, OAuth 2.0 for API access |
| Roles | App roles or security-group claims mapped to permissions |
| Policy | Conditional access and MFA enforced by the directory |
| Service auth | Managed identity for app-to-service calls, no secrets |
| Audit | Sign-in and consent logs retained in the tenant |
Frequently asked questions
For external users Entra External ID is the right product; the staff directory is not designed for public sign-up. The integration pattern is similar.
They are usually mapped to directory identities during a transition period, then retired. We would not switch everyone over in one step without a fallback.
If they support SAML or OpenID Connect, generally yes. Many packaged products do, and it is worth checking before adding another password store.
Topics people search for
Services built with Entra ID
Enterprise Software Development
Systems for organisations where several departments, sites and approval chains all have to work from the same data.
Custom Software Development
Software shaped around the way your business already works, instead of a packaged product you have to reorganise around.
Web Application Development
Applications that run in the browser, handle real workloads and hold up when several departments depend on them at once.
Digital Transformation
Moving a business off paper and spreadsheets without stopping the business to do it.
Tell us what you are trying to build
Describe the problem in plain language and we will tell you what it would take to solve it — the approach, the moving parts and the sensible order to build them in. No obligation either way.