Connect Microsoft Entra ID with OIDC

Available onEnterprise

Who can do thisWorkspace owners in Infyva, and an Application Administrator (or higher) in Entra ID

This guide connects Infyva to Microsoft Entra ID with OpenID Connect, using an app registration. If your team usually connects apps with SAML, use Connect Microsoft Entra ID with SAML instead.

Before you start

• Your workspace is on Enterprise. Single sign-on is not part of Starter, Pro or the Pro trial.
• You are a workspace owner in Infyva. Admins can open the page and choose the role new teammates get, but only owners can connect a provider, verify domains or turn SSO on.
• You can add a DNS TXT record for your company email domain, or you know who can.
• You can open Infyva's SSO page: in the sidebar click Settings, then Single sign-on (under Security). If the page shows Set up single sign-on with Coming soon, single sign-on is not switched on for your workspace yet. Email support@infyva.ai.
• Keep a second browser window, or a private window, for testing. Stay signed in to Infyva as an owner in the first one until SSO works.

Values to copy from Infyva

Open Settings > Single sign-on in Infyva and choose the OIDC tab under 1 Connect your identity provider. Copy the Redirect URL with its Copy button.

In Infyva	Paste into	Value
Redirect URL	Redirect URI (platform: Web)	https://sso.infyva.ai/api/oauth/oidc

Step 1: Register the application

1. Sign in to the Microsoft Entra admin center.
2. Go to Entra ID > App registrations. In older menus this is Identity > Applications > App registrations.
3. Click New registration.
4. Set Name to Infyva.
5. Under Supported account types, choose Accounts in this organizational directory only (Single tenant).
6. Under Redirect URI, choose the platform Web and paste Infyva's Redirect URL.
7. Click Register.
8. On the app's Overview, copy the Application (client) ID and the Directory (tenant) ID. You need both later.

Microsoft's guides: Register an application and Add a redirect URI.

Step 2: Create a client secret

1. In the app, open Certificates & secrets > Client secrets.
2. Click New client secret, add a description such as Infyva SSO, and pick an expiry.
3. Click Add.
4. Copy the secret's Value now. Entra shows it only once. Do not copy the Secret ID.

Write down the expiry date. When the secret expires, SSO sign-in stops working until you save a new one in Infyva. Microsoft's guide: Add credentials.

Step 3: Send the email and name claims

Infyva reads email, given_name and family_name from the ID token or the user info endpoint. email is required.

1. In the app, open Token configuration.
2. Click Add optional claim, choose token type ID, tick email, family_name and given_name, and click Add.
3. If Entra asks, tick Turn on the Microsoft Graph email, profile permission and click Add.
4. Open API permissions. Check that Microsoft Graph lists the delegated permissions openid, email and profile. Add any that are missing with Add a permission > Microsoft Graph > Delegated permissions.
5. Optional: click Grant admin consent for your organisation, so people are not asked to consent the first time.

Claim	Used by Infyva for
email	Email (required). Its domain must be verified in Infyva.
given_name	First name
family_name	Last name

Groups and roles in the token are ignored.

Step 4: Choose who can sign in

By default, anyone in your tenant can sign in to an app registration. To limit it to people you choose:

1. Go to Entra ID > Enterprise apps and open Infyva (Entra created it with the registration).
2. Open Properties, set Assignment required? to Yes, and click Save.
3. Open Users and groups, click Add user/group, and assign the people or groups who use Infyva. Include yourself.

Microsoft's guide: Assign users and groups.

Step 5: Save the connection in Infyva

1. In Infyva, on the OIDC tab, fill in:
   • Discovery URL: https://login.microsoftonline.com/<Directory (tenant) ID>/v2.0/.well-known/openid-configuration, with your tenant ID in place of the placeholder. You can also copy it from the app's Overview > Endpoints > OpenID Connect metadata document.
   • Client ID: the Application (client) ID.
   • Client secret: the secret Value from Step 2.
2. Click Save connection.

Infyva checks the discovery URL before saving. You see Identity provider connected. The secret is stored encrypted and never shown again.

Verify your email domain in Infyva

Only people whose email address is on a verified domain can sign in with SSO.

1. In Infyva, on the Single sign-on page, go to 2 Verify your email domain.
2. Type your domain, for example northwindlabs.com, and click Add domain.
3. Copy the Name and Value with their Copy buttons and add them as a TXT record at your DNS provider.
4. Click Check now. When the badge changes from Waiting for DNS to Verified, you are done.

DNS changes can take a few minutes, sometimes longer. Details and limits: Verify your domain.

Turn on SSO and test it

Infyva has no separate test button. You test by signing in.

1. Go to 3 Turn it on. Switch on Allow sign-in with SSO.
2. Under New teammates join as, choose Recruiter or Viewer. This is the role a person gets the first time they sign in with SSO.
3. Click Save.
4. In a private window, open the Infyva sign-in page.
5. Type your work email in the email field, then click Sign in with SSO. Do not type a password.
6. Sign in at your identity provider. You come back to Infyva and land in your workspace.

The Status panel on the right now shows On and the time of the Last SSO sign-in. The sign-in is also in your audit log.

Start sign-in from Infyva

Infyva supports sign-in that starts on the Infyva sign-in page. Sign-in that starts from a tile in your provider's app launcher, or from a provider's own Test button that signs in from the provider side, is not supported. Point the tile at https://www.infyva.ai/auth/login, or hide it.

Require SSO

Once one SSO sign-in has worked, you can make SSO the only way in for your verified domains.

1. On the Single sign-on page, switch on Require SSO. The switch stays greyed out until the first successful SSO sign-in.
2. Click Save.

From then on:

• People on your verified domains can no longer sign in with a password. They see Your workspace requires single sign-on. Use "Sign in with SSO" instead.
• Password sessions that were already open for those people end. Someone already signed in is asked to sign in again when their current session runs out.
• Workspace owners keep password sign-in, so an owner can still get in if your identity provider is down. Read Require SSO and the owner fallback before you turn this on.

To also protect links you send to hiring managers, see Require SSO on hiring-manager links.

Roll back

• To pause SSO, switch off Allow sign-in with SSO and click Save. Everyone signs in with passwords again.
• To remove it completely, click Turn off and remove SSO in the Status panel. People keep their Infyva accounts.
• If you click Replace and save a new connection, Infyva turns Require SSO off until someone signs in with SSO again. This stops a broken connection from locking your team out.

Troubleshooting Entra ID (OIDC)

What you see	Likely cause	Fix
AADSTS50011: the redirect URI does not match	The redirect URI on the app registration is not exactly Infyva's Redirect URL, or it was added under a platform other than Web	In Authentication, add the Redirect URL under Web. Microsoft's article
AADSTS700016: application was not found in the directory	The Client ID in Infyva is wrong, or the discovery URL points at a different tenant	Copy the Application (client) ID and Directory (tenant) ID again. Error code reference
AADSTS7000215: invalid client secret	The secret ID was pasted instead of the secret value, or the secret was deleted	Create a new secret, click Replace in Infyva and save it
AADSTS7000222: the client secret keys have expired	The secret passed its expiry date	Create a new secret and save it in Infyva
AADSTS50105: the signed in user is not assigned	Assignment required? is Yes and the person is not assigned	Assign them in Users and groups. Microsoft's article
Infyva: The discovery URL didn't return an OpenID configuration.	The URL is not the metadata document	Use the /v2.0/.well-known/openid-configuration URL for your tenant
Infyva: <email> is not on a verified domain for this workspace.	The email claim is missing or on another domain	Add the optional email claim (Step 3) and make sure the person's mailbox address is on a verified domain

More: Troubleshooting SSO.

Limits in this release

• No SCIM. Infyva does not receive user or group updates from your provider. Accounts are created the first time someone signs in. When someone leaves, block them in your provider and choose Suspend account in Settings > Team and roles. Remove alone is not enough: a removed person who can still sign in at your provider joins again on their next SSO sign-in.
• No group or role mapping. Everyone who joins through SSO gets the role set in New teammates join as. Change roles afterwards in Team and roles.
• Sign-in starts from Infyva. Sign-in started from your provider's app tile is not supported.
• One identity provider per workspace. Saving a new one replaces the old one.
• Metadata is read once. If you give a metadata URL, Infyva reads it when you click Save connection. After a certificate change at your provider, save the connection again.
• Team members only. Candidates never sign in with SSO.

Next steps

• Require SSO and the owner fallback
• Accounts, roles and limits
• Microsoft's OIDC overview