​
Prerequisites

  • A Microsoft Entra ID (formerly Azure AD) tenant
  • Global Administrator or Application Administrator role
  • Admin access to LowerPlane Settings

​
Setup Steps

1

Navigate to Settings > SSO

In LowerPlane, go to Settings and select the SSO tab.
2

Select Microsoft as your provider

Click Microsoft from the list of SSO providers.
3

Register LowerPlane in Entra ID

In the Microsoft Entra admin center, register a new application:
  1. Go to Identity > Applications > App registrations > New registration.
  2. Set the Name to LowerPlane SSO.
  3. Set Supported account types to “Accounts in this organizational directory only”.
  4. Set the Redirect URI to: 
    https://api.lowerplane.com/api/v1/auth/sso/callback/oidc
  5. Click Register.
4

Configure API permissions

In the app registration:
  1. Go to API permissions > Add a permission > Microsoft Graph > Delegated permissions.
  2. Add: openid, profile, email, User.Read.
  3. Click Grant admin consent for your organization.
5

Create a client secret

  1. Go to Certificates & secrets > New client secret.
  2. Add a description (e.g., LowerPlane SSO) and set an expiration.
  3. Copy the Value immediately — it won’t be shown again.
6

Enter credentials in LowerPlane

Back in LowerPlane’s SSO settings, enter:
  • Tenant ID: Found on the app registration’s Overview page (Directory (tenant) ID)
  • Client ID: Found on the app registration’s Overview page (Application (client) ID)
  • Client Secret: The value you copied in the previous step
7

Test and enable

Click Test Connection to verify the configuration. Once successful, toggle SSO to Active.

​
How It Works

  1. A user visits your LowerPlane login page and enters their email address.
  2. LowerPlane detects the Microsoft SSO configuration for your organization.
  3. The user is redirected to Microsoft’s sign-in page.
  4. After successful authentication, Microsoft sends the user back to LowerPlane with an authorization code.
  5. LowerPlane exchanges the code for tokens, extracts the user’s profile (email, name), and logs them in.

​
Configuration Details

SettingValue
ProtocolOAuth 2.0 / OpenID Connect
Scopesopenid, profile, email, User.Read
Authorization endpointhttps://login.microsoftonline.com/{tenant-id}/oauth2/v2.0/authorize
Token endpointhttps://login.microsoftonline.com/{tenant-id}/oauth2/v2.0/token
Userinfo endpointhttps://graph.microsoft.com/v1.0/me
Redirect URIhttps://api.lowerplane.com/api/v1/auth/sso/callback/oidc

​
Conditional Access

If your organization uses Entra ID Conditional Access policies, ensure that the LowerPlane SSO application is included in the appropriate policies. You can require:
  • Multi-factor authentication (MFA)
  • Compliant device enrollment
  • Specific geographic locations
  • Risk-based sign-in evaluation

​
Troubleshooting

This usually means the User.Read permission was not granted. Go to your app registration in Entra ID, ensure User.Read is listed under API permissions, and click Grant admin consent.
The user’s account may not have a mail attribute set in Entra ID. Ensure the user has a valid email address configured in their Entra ID profile under Properties > Contact information.
Verify that:
  • The Client Secret has not expired
  • The Redirect URI matches exactly: https://api.lowerplane.com/api/v1/auth/sso/callback/oidc
  • The Tenant ID and Client ID are correct
Set Supported account types to “Accounts in this organizational directory only” in the app registration to restrict access to your tenant.
Create a new client secret in Entra ID and update it in LowerPlane’s SSO settings. Client secrets have a maximum lifetime of 24 months.