How SSO with Microsoft Entra ID Works
When SSO is enabled, the PastaHR login flow changes: instead of entering an email address and waiting for a login code, users click Sign in with Microsoft and are redirected to the Microsoft authentication page. After authenticating with their Microsoft credentials (including any MFA policies enforced by Entra ID), they are automatically redirected back to PastaHR and logged in.Enabling SSO for Your Organisation
Setting up SSO requires configuration in your Microsoft Entra ID tenant, after which you send the resulting credentials to PastaHR. Your IT administrator and a PastaHR Admin should carry out these steps together.Step 1: Register PastaHR as an app in Entra ID
Follow Microsoft’s app registration guide and set:- Supported account types:
Accounts in any organizational directory (Any Azure AD directory – Multitenant) - Redirect URI type:
Web - Redirect URI value:
https://auth.pastahr.com/login/callback
Step 2: Note down the app parameters
After registration, note down the following values, you’ll need to send them to PastaHR:- Entra ID Domain: your organisation’s Entra ID domain (e.g.
yourcompany.onmicrosoft.com) - Client ID: generated automatically after app registration
- Client Secret: create a new secret following Microsoft’s credentials guide and copy the value immediately, it’s only shown once
Step 3: Add the required API permissions
Add these Microsoft Graph permissions in the Entra ID app registration:- User.Read (Users)
- Directory.Read.All (Directory)
Step 4: Send your credentials to PastaHR
Send the following to support@pastahr.com:- Your Entra ID Domain
- Your Client ID
- Your Client Secret