To add SSO login on your custom domain, you need to set up your Identity Provider (IdP) for IXON Cloud. This article goes into specifics on how you set up Microsoft Entra ID.

• Create a new app registration
• Create a new client secret
• Create a new optional claim
• Send us the required information
• Set a reminder

Create a new app registration

The IXON Cloud needs to be registered as an app in your Microsoft Azure environment.

1. Before you start, check the main article SSO login on your custom domain for preparation steps.
2. Open Microsoft Azure and log in.
3. Search for and open the App registrations service.
   
4. Create a New registration.
5. Enter the requested information (details below).

   Field	Description
   Name	Enter a descriptive name. For example, "IXON Cloud SSO".
   Supported account types	Select whom you want to be able to use the SSO login button on your custom domain. This depends on who uses your IXON Cloud company and whether you plan to later enforce SSO for them. Note that regardless of your selection here, only users in your IXON Cloud company will be able to log in. If someone has a Microsoft account but is not a user in your IXON Cloud company, they do not have access. Below is an overview of use case examples to assist you in selecting the suitable option for you. Use case examples Recommended selection Only colleagues make use of your IXON Cloud company. Now and in the future. Single tenant Colleagues, external partners, customers, etc. make use of your IXON Cloud company. Multitenant or Multitenant and personal accounts (e.g. outlook.com , hotmail.com , and others) The same behavior as IXON's default SSO login buttons, where anyone with a Microsoft account can log in. Multitenant and personal accounts If you are still unsure what to select and you are not the Platform Administrator in your IXON Cloud company, please contact your colleague that is.
   Redirect URI	Select and enter the following. Platform Web URI https://api.ayayot.com/sso/redirect/2

6. Click Register.
7. Copy the your app registration's Application (client) ID and Directory (tenant) ID. You will need them later.
   

Create a new client secret

A new client secret is required.

8. In the left menu, under Manage, go to Certificates & secrets.
9. Go to the tab Client secrets and create a New client secret.
   
10. Enter the requested information (details below).

    Field	Description
    Description	Enter a descriptive name. For example, "Client secret used by IXON Cloud SSO".
    Expires	This determines how long the client secret will remain valid. Once it expires, the SSO login button can no longer be used to log in. At the end of this article there's a step to set a reminder and prevent this from happening. To reduce the amount of manual intervention, it is recommended to set this to the highest available value.

11. Click Add.
12. Copy the Value. This is only visible once and you will need it later. The Secret ID is not needed.
    

Create a new optional claim

A new optional claim is required. Contrary to what the name may imply, this is not optional.

13. In the left menu, under Manage, go to Token configuration.
14. Create a new Optional claim.
    
15. Select the following.

    Token type	ID
    Claim	upn

16. Click Add.
17. A popup may appear asking to turn on Microsoft Graph profile permission. This is required to make the "upn" claim available. Select the checkbox and click Add.
    
18. Verify that the “upn” claim is added to your app registration’s token configuration.
    

Send us the required information

You've prepared your Microsoft Entra ID environment. Now, we require specific information from your environment to complete the SSO login button setup.

19. Contact us and send us the following information securely. If you do not already have a means to send data securely, you can create an encrypted zip file and send us the password separately.

    IXON Cloud company name	This information can be found in IXON Cloud at Admin > Identity. Enter your company name.
    IXON Cloud company ID	This information can be found in IXON Cloud at Admin > Identity. Enter your company ID.
    Provider	Microsoft Entra ID
    Supported account type	Enter your selection at step 4.
    Tenant ID	Enter your Directory (tenant) ID from step 6.
    Client ID	Enter your Application (client) ID from step 6.
    Client secret	Enter your Value from step 11.
    Login name	The text that will be displayed in the SSO login button. The default text is "Log in with Microsoft". Enter the text you would like to display. This needs to start with "Log in with".
    Login icon	The icon that will be displayed in the SSO login button. The default icon is the Microsoft logo. Specify the icon you would like to display. In case of the default icon, state "Microsoft logo". In case of no icon, state "No icon". In case of a custom icon, like your company logo, attach it in .png format.
    Test credentials	We request (temporary) login credentials to validate the SSO login. While this is optional, it has proven to be beneficial and often speed up the deployment of a functional SSO login button. If you choose to not provide credentials, you will need to validate the SSO login once we have completed the setup.

20. Please wait for us to process your request and complete the setup. This may take several business days.

Set a reminder

The client secret will eventually expire. Make sure that your SSO login continues to work beyond that.

21. Set a reminder for yourself or team to generate a new client secret and e-mail it to us before the current one expires, to prevent downtime in the SSO login capability.
    • It is recommended to not wait until the very last moment.
    • If you're unsure when it expires, see the details that you entered at step 9.
    • Do not delete the current client secret yet before you've received confirmation from us that your SSO login has been set up with your new client secret.