Let visitors sign in with Microsoft Entra ID (Azure AD)

Updated
View as text
Open in Confluence
Open in ChatGPT Open in Claude

To let visitors sign in to a Confluence site with Microsoft Entra ID (Azure AD), a Confluence admin opens the site's Settings, chooses Access, selects the Microsoft card, adds your organisation by email domain or tenant ID under Organisations, and selects Save changes. Members of that organisation can then sign in with their work or school account.

#Before you start

  • You need to be a Confluence admin. Collaborators cannot turn on Microsoft sign-in or change who it lets in.

  • You do not need an app registration, client ID or secret in Entra. Capable runs the sign-in app.

  • Know your organisation's email domain, such as contoso.com, or its tenant ID from the overview page of the Microsoft Entra admin center.

  • Depending on your user consent settings, a Microsoft admin may need to approve Capable Sites the first time someone signs in.

#Steps

  1. Open Capable, choose Sites, open your site, and select Settings, then the Access card.

  2. Under Who can view this site, select Microsoft.

  3. In Organisations, type your email domain and press Enter. It is looked up to your tenant. You can paste a tenant ID instead.

  4. To let in people invited to your organisation as guests, turn on Allow guests. It needs exactly one organisation.

  5. Optionally, add Email domains to narrow the organisation down to people with those addresses.

  6. Under Sessions, choose Stay signed in for. Microsoft sessions last at most 7 days.

  7. Select Save changes.

  8. Open the site in a private window, select Sign in with Microsoft and check you get in.

#If it does not work

  • Microsoft shows Need admin approval. An Entra admin signs in to the site and chooses Consent on behalf of your organization, or grants consent to Capable Sites under Enterprise applications.

  • No Microsoft organisation uses this domain. The domain is not registered to an Entra tenant. Paste the tenant ID instead.

  • Guest accounts do not have access to this site. Turn on Allow guests, with exactly one organisation listed.

  • Your account does not have access to this site. The person is in your organisation but not on the Email domains you narrowed it to.

  • This site does not accept personal Microsoft accounts. Personal accounts are always refused, even as guests.

  • Microsoft sign-in is not fully set up yet. This is a setup problem on Capable's side. Contact Capable support rather than changing your settings.

Your tenant, your people, no app registration.