Sign-in with Entra ID and AD FS
People in your organisation can sign in to komplai with their Microsoft work account, through Microsoft Entra ID or AD FS. komplai sets up the connection together with your IT team: you prepare an app registration in Entra ID or a relying party trust in AD FS, send komplai a few values, and komplai connects it to your organisation. The hub says the same under Organisation › Sign-in and security › Sign-in (/settings/sso).
How sign-in works
- People sign in at hub.komplai.dk with their work email address. komplai's sign-in service at
auth.komplai.dksends them on to Microsoft and takes them back once they have signed in there. The sign-in service runs on komplai's servers in Germany. - Your own Microsoft policies, such as Conditional Access and Microsoft's MFA, apply while people sign in at Microsoft.
- Only people you invite get access. A Microsoft sign-in on its own gives no access to your organisation in komplai. Invitations explains how people join.
Before you start
Agree with komplai:
- whether you connect Entra ID or AD FS
- whether people may still sign in with a password alongside the Microsoft sign-in, or only through Microsoft
- who in your IT team komplai works with
Then open /settings/sso, expand Technical details and copy Organisation short name and ID in the sign-in system. komplai uses them to connect the right organisation.
Microsoft Entra ID
You create a single-tenant app registration. komplai's sign-in service uses it to send people to Microsoft and to read their basic profile.
- In the Microsoft Entra admin center, go to App registrations and choose New registration.
- Give it a name people recognise, such as
komplai. - Under Supported account types, choose Accounts in this organizational directory only.
- Under Redirect URI, choose Web and enter the redirect URI komplai gives you for your organisation. Choose Register.
- Under API permissions, check that Microsoft Graph has the delegated permissions
openid,profile,emailandUser.Read. If your users may not consent to apps themselves, choose Grant admin consent. - Under Certificates & secrets, create a new client secret. Copy its Value straight away, because Entra shows it only once, and note when it expires.
- On Overview, copy the Directory (tenant) ID and the Application (client) ID.
Send komplai these values:
| Value | Where you find it |
|---|---|
| Directory (tenant) ID | Overview |
| Application (client) ID | Overview |
| Client secret value | Certificates & secrets |
| The secret's expiry date | Certificates & secrets |
Send the client secret as a one-time link, for example from secret, never in the email itself. The tenant ID and client ID are not secret. komplai's sign-in service stores the client secret encrypted.
The client secret expires
Sign-in through Entra ID stops working on the day the client secret expires. Create a new secret in good time before that date and send it to komplai the same way. Delete the old secret once komplai has confirmed that the new one is in use.
The connection asks Microsoft for openid, profile, email and User.Read: the person's basic profile, such as name and email address. It never creates accounts, and it does not link a Microsoft account to a komplai account just because the email addresses match.
AD FS
AD FS connects over SAML, with komplai as a relying party trust. komplai creates its side first, because your relying party trust is built from komplai's metadata.
- Send komplai the address of your AD FS federation metadata, normally
https://<your AD FS host>/FederationMetadata/2007-06/FederationMetadata.xml. If the address cannot be reached from the internet, send the metadata file instead. - komplai creates the connection and sends you the address of its metadata.
- In AD FS Management, choose Add Relying Party Trust, select Claims aware and import the data from komplai's metadata address. Name the trust
komplai. - Choose an access control policy. Permit everyone lets everyone in your directory continue to komplai, where only invited people get in. A policy for a group limits the Microsoft sign-in to that group.
- Add claim issuance rules that send the claims komplai names with its metadata. They are usually the ones in the table below.
- Tell komplai that the trust is ready.
| Claim | What to send |
|---|---|
| Name ID | A value that stays the same for the person, such as the user principal name, in the Name ID format that komplai's metadata names |
| E-Mail Address | The person's work email address (E-Mail-Addresses) |
| Given Name | Given-Name |
| Surname | Surname |
Token-signing certificates
komplai keeps a copy of your federation metadata, including the token-signing certificate. When AD FS creates a new token-signing certificate, tell komplai before it becomes the primary certificate, so sign-in keeps working.
Test before you invite people
Test the connection with one person before you invite others with it.
- Wait until komplai tells you that the connection is in place.
- On Members (
/team), open Invite a colleague and enter the address of one colleague, for example from IT. - Open the Sign-in line above Send invitation (it shows your current default), choose Organisation sign-in (SSO) as Sign-in method, and choose Send invitation.
- Your colleague opens the invitation email, enters their name, chooses Sign in and signs in with their Microsoft work account.
- The test has worked when your colleague lands in komplai.
Then make it the default for new invitations: on /settings/sso, under Default invitation method, choose Organisation sign-in (SSO) and then Save sign-in method. You can still choose another method for each invitation. Members who already have an account keep the sign-in method they have.
Two-factor authentication
Under Two-factor authentication on /settings/sso you choose who must use it:
- Require two-factor authentication for administrators
- Require two-factor authentication for members and guests
The requirement follows the person's role, whatever sign-in method they use. A person it covers who signs in with Microsoft is asked for their komplai second factor after the Microsoft sign-in, in addition to what your Microsoft policies ask for. People set up an authenticator app or a security key at their next sign-in. A person who belongs to more than one organisation in komplai follows the strictest requirement.
Saving a change needs a recent sign-in: if yours is more than five minutes old, the hub asks you to confirm it. To turn a requirement off while administrators must use two-factor authentication, you confirm with two-factor authentication.
Get it set up
To connect Entra ID or AD FS, contact us or use Contact us about SSO on /settings/sso. Include the two values from Technical details.