# Let visitors sign in with Microsoft Entra ID (Azure AD)

To let visitors sign in to a Confluence site with Microsoft Entra ID (Azure AD), a Confluence admin opens the site's **Settings**, chooses **Access**, selects the **Microsoft** card, adds your organisation by email domain or tenant ID under **Organisations**, and selects **Save changes**. Members of that organisation can then sign in with their work or school account.

---

## Before you start

* You need to be a Confluence admin. Collaborators cannot turn on Microsoft sign-in or change who it lets in.
* You do not need an app registration, client ID or secret in Entra. Capable runs the sign-in app.
* Know your organisation's email domain, such as `contoso.com`, or its tenant ID from the overview page of the Microsoft Entra admin center.
* Depending on your user consent settings, a Microsoft admin may need to approve Capable Sites the first time someone signs in.

---

## Steps

1. Open Capable, choose **Sites**, open your site, and select **Settings**, then the **Access** card.
2. Under **Who can view this site**, select **Microsoft**.
3. In **Organisations**, type your email domain and press Enter. It is looked up to your tenant. You can paste a tenant ID instead.
4. To let in people invited to your organisation as guests, turn on **Allow guests**. It needs exactly one organisation.
5. Optionally, add **Email domains** to narrow the organisation down to people with those addresses.
6. Under **Sessions**, choose **Stay signed in for**. Microsoft sessions last at most 7 days.
7. Select **Save changes**.
8. Open the site in a private window, select **Sign in with Microsoft** and check you get in.

---

## If it does not work

* **Microsoft shows Need admin approval.** An Entra admin signs in to the site and chooses **Consent on behalf of your organization**, or grants consent to **Capable Sites** under **Enterprise applications**.
* **No Microsoft organisation uses this domain.** The domain is not registered to an Entra tenant. Paste the tenant ID instead.
* **Guest accounts do not have access to this site.** Turn on **Allow guests**, with exactly one organisation listed.
* **Your account does not have access to this site.** The person is in your organisation but not on the **Email domains** you narrowed it to.
* **This site does not accept personal Microsoft accounts.** Personal accounts are always refused, even as guests.
* **Microsoft sign-in is not fully set up yet.** This is a setup problem on Capable's side. Contact Capable support rather than changing your settings.

---

## Related

### [Restrict access to sites](https://help.gocapable.com/sites/restrict-access-to-sites.html)

Organisations, guests, consent and refusals in full.

### [Access modes](https://help.gocapable.com/sites/access-modes.html)

All five modes and sessions.

### [Let visitors sign in to a Confluence site with Google](https://help.gocapable.com/sites/let-visitors-sign-in-to-a-confluence-site-with-google.html)

The same with Google accounts.

### [Securing a published site](https://help.gocapable.com/sites/securing-a-published-site.html)

More guides for protected sites.

---

_Your tenant, your people, no app registration._