> ## Documentation Index
> Fetch the complete documentation index at: https://docs.pastahr.com/llms.txt
> Use this file to discover all available pages before exploring further.

# Single Sign-On for PastaHR via Microsoft Entra ID

> Set up Single Sign-On for PastaHR using Microsoft Entra ID. Follow the registration steps and send your credentials to the support team.

Single Sign-On (SSO) lets your team members log in to PastaHR using the same credentials they use for other Microsoft applications in your organisation.

PastaHR supports SSO via **Microsoft Entra ID** (formerly Azure Active Directory), the identity platform for organisations using Microsoft 365. Once SSO is configured, your users authenticate through your existing identity provider.

## How SSO with Microsoft Entra ID Works

When SSO is enabled, the PastaHR login flow changes: instead of entering an email address and waiting for a login code, users click **Sign in with Microsoft** and are redirected to the Microsoft authentication page. After authenticating with their Microsoft credentials (including any MFA policies enforced by Entra ID), they are automatically redirected back to PastaHR and logged in.

## Enabling SSO for Your Organisation

Setting up SSO requires configuration in your Microsoft Entra ID tenant, after which you send the resulting credentials to PastaHR. Your IT administrator and a PastaHR Admin should carry out these steps together.

### Step 1: Register PastaHR as an app in Entra ID

Follow [Microsoft's app registration guide](https://learn.microsoft.com/en-us/entra/identity-platform/quickstart-register-app) and set:

* **Supported account types:** `Accounts in any organizational directory (Any Azure AD directory – Multitenant)`
* **Redirect URI type:** `Web`
* **Redirect URI value:** `https://auth.pastahr.com/login/callback`

### Step 2: Note down the app parameters

After registration, note down the following values, you'll need to send them to PastaHR:

* **Entra ID Domain**: your organisation's Entra ID domain (e.g. `yourcompany.onmicrosoft.com`)
* **Client ID**: generated automatically after app registration
* **Client Secret**: create a new secret following [Microsoft's credentials guide](https://learn.microsoft.com/en-us/entra/identity-platform/how-to-add-credentials?tabs=certificate) and copy the value immediately, it's only shown once

### Step 3: Add the required API permissions

Add these [Microsoft Graph](https://learn.microsoft.com/en-us/entra/identity-platform/quickstart-configure-app-access-web-apis#add-permissions-to-access-web-apis) permissions in the Entra ID app registration:

* **User.Read** (Users)
* **Directory.Read.All** (Directory)

### Step 4: Send your credentials to PastaHR

Send the following to [support@pastahr.com](mailto:support@pastahr.com):

* Your Entra ID Domain
* Your Client ID
* Your Client Secret

PastaHR configures the connection on their end and confirms once SSO is live for your workspace.

<Warning>
  SSO configuration affects every user in your workspace. Before switching to SSO, ensure all team members have a corresponding account in your Microsoft Entra ID tenant. Users without an Entra ID account will no longer be able to log in once SSO is enforced.
</Warning>