Support Knowledgebase
NAV

OpenID Connect with Microsoft Entra ID (SimpleHelp Single Sign-On)

SimpleHelp supports single sign-on (SSO) using OpenID Connect with Microsoft Entra ID (formerly Azure Active Directory / Azure AD). To enable technicians to authenticate using Entra ID, an administrator must create an App Registration in the Microsoft Entra admin center (or Azure portal) and enter the application details into SimpleHelp.

Overview

Entra ID Authentication

SimpleHelp supports single sign-on with Entra ID using OpenID Connect. In order for SimpleHelp users to authenticate using Entra ID the administrator will need to create an authentication application in Entra ID and enter the details of that application into SimpleHelp. This guide details how to configure this Entra ID application.

Three steps are required to configure Entra ID: 1. An App Registration must be created and configured. 2. A Client Secret must be generated.

This document will guide you through completing the following steps:

  1. Create and configure an App Registration
  2. Create an application credential (client secret)
  3. Copy the required values into SimpleHelp (Client ID, Tenant ID, Credential)

In Entra ID, select the directory you wish to register the application with. Start by choosing App Registrations and you will be presented with a screen similar to the following:

App Registrations Screenshot

1) Create the App Registration

  1. Select New registration to create a new App Registration.
  2. Enter a Name for the application, for example: SimpleHelp Integration.
  3. Under Supported account types, choose the option that best matches your login requirements.
    • If unsure, select Accounts in this organizational directory only (Single tenant).
  4. Under Redirect URI, select Web and paste the redirect URI provided by SimpleHelp (ending in .../oidc).
    • This can be found in the SimpleHelp Technician Console when configuring Authentication Services under the Azure App Settings. Azure App Settings Screenshot
  5. Select Register (or Create) to complete the registration.

A summary for your new App Registration is presented in the figure below.

Completed App Registration Screenshot

Record these values

You will need the following values to input in the SimpleHelp Technician Console:

  • Application (client) ID
  • Directory (tenant) ID

2) Configure Authentication and Tokens

  1. In App registrations, click Authentication (Preview) in the menu to the left.
  2. Select the Settings tab (next to Redirect URI configuration).
  3. Under Implicit grant and hybrid flows, check both:
    • Access tokens
    • ID tokens
  4. Click Save.

Add Group Claims (optional)

If you want SimpleHelp to receive group membership information in tokens (role/group mapping), configure group claims:

  1. In the left menu, select Token configuration.
  2. Select Add group claims (next to Add optional claim).
  3. Choose which group types to return.
    • If you only want groups assigned to the app, select Groups assigned to the application.
  4. Select Add at the bottom to save the claim.

A summary of your new Token Configuration is presented.

Token Configuration Screenshot

Note: For advanced configuration of group claims and roles, please consult Microsoft’s official documentation and guidance.

Now that the App Registration is configured in Entra ID, enter the following details into SimpleHelp: - Client ID - Client Secret - Tenant ID

A technician that attempts to log in using Entra ID will be presented with a web page to proceed with the login, after which they will be forwarded to the SimpleHelp server and their session will begin.

API Permissions (OpenID scopes)

In most environments, the minimum delegated permissions for basic sign-in is User.Read. This permission is considered least privileged and allows the application to read basic profile information of the signed-in user (display name, user ID, email address). We will use User.Read as the baseline for the application which only needs to authenticate and read the user profile.

When a login is attempted with Entra ID, the authentication application will return information about the user to the SimpleHelp server. What information is sent to the server can be configured in Entra ID, and this information can be used to filter logins in the SimpleHelp technician console.

  1. In the left menu, select API permissions.
  2. Select Add a permission.
  3. Select Microsoft Graph.
  4. Select Delegated permissions.
  5. Search for openid.0
  6. Select openid and Add permission.
  7. Select Grant admin consent to apply the permissions.

Note: By default, your tenant may already include User.Read on new app registrations. Only grant additional permissions if you have a clear requirement.

Select the relevant authentication service, and press the button. This will send you to the login page in your browser. After logging in, a pop-up window will open in the technician console telling you if the user authenticated successfully, if the user satisfies the configured filters, and the details of the token returned by Entra ID.

3) Application Credentials (Client Secret or Certificate)

To create a client secret in the App Registration:

  1. Go to Certificates & secrets (left menu).
  2. Under Client secrets, select New client secret.

Note: The client secret description should be clear and descriptive to identify its purpose. For expiration, security best practices strongly advise against long-lived secrets. Microsoft experts often recommend shorter expiration periods such as 3–6 months to reduce the risk of credential exposure.

Create a client secret

If you have added a groups claim as detailed in the setup guide, included in this token will be the “groups” value. Usually this will be returned as the object ID of the group the user is assigned to in your Entra ID directory. The object ID of groups can be found in the overview under All Groups in Entra ID.

If you’re having trouble with configuring tokens, refer to the relevant available support and documentation for Microsoft Entra.

Returning to SimpleHelp, you can now use this information to filter which Entra ID group logins are allowed or disallowed. This is useful if you have multiple separate groups of technicians logging in with Entra ID, as you can direct which technician groups they will be logged into.

In the same section as the Test Technician Login feature, click the button to enter a new attribute. Name it after the attribute you intend to filter, in this case “groups”. To filter such that only users in a certain Entra ID group can log in to this technician group, set it to equals and enter the value as the object ID of the Entra ID group.

If the ability to add groups to the Enterprise applications > Users and Groups section is included in your Microsoft Entra ID plan, this can be used to filter group logins in SimpleHelp using their titles in plain text. Adding the target group to this section will cause the token to return the name of the group rather than the object ID. This can then be passed into the filtering attributes section in lieu of the object ID.

  1. Select New client secret.
  2. Enter a description and choose an expiration duration.
  3. Press Add at the bottom of the window to generate the new client secret.
  4. Copy the Value immediately and store it securely — you cannot retrieve the value later.

Security best practice: Store secrets in a secure vault (e.g., Azure Key Vault or an equivalent secret manager). Avoid storing secrets in emails, tickets, or shared documents.

The new client secret will appear in the summary.

Entra Secret Summary Screenshot

4) Final Steps in SimpleHelp

In SimpleHelp, create or edit the Microsoft Entra ID / Azure option under Authentication Services, then enter:

  • Client ID (Application ID)
  • Tenant ID (Directory ID)
  • Client Secret value

When a technician selects this login option, they will be redirected to Microsoft Entra ID to sign in. After successful authentication, Entra ID redirects the user back to the SimpleHelp server via the configured redirect URI.