This article describes the steps to be performed by the Entra administrator, in the Azure portal.
TestCollab shows these same steps inside the product. On the single sign-on settings page, select How to configure and setup Entra SSO to open them next to the form you are filling in.
Step 1 - Create an Enterprise application
In the Azure portal, go to Microsoft Entra ID → Enterprise Apps → New Application
On Microsoft Entra App Gallery page click Create your own application
Give it a name your team will recognise, such as TestCollab
Select "Integrate any other application you don't find in the gallery (Non-gallery)"
Step 2 - Add the sign-in address
Go to App registrations→your app→Add a Redirect URI and add this URI: https://testcollab.io/entra-callback
Choose Single-page application (SPA). Add the redirect address shown on the TestCollab single sign-on page - it appears there in a read-only field labelled Redirect URI, ready to copy.
Choose Single-page application, not Web. TestCollab signs people in from the browser, so the address has to be registered under Single-page application. Registering it under Web will stop sign-in from working.
Step 3 - Copy the two identifiers
On the app's Overview page, copy the Application (client) ID and the Directory (tenant) ID. Both look like 11111111-2222-3333-4444-555555555555. Your TestCollab administrator needs both.
Step 4 - Add the permissions
Go to API permissions → Add a permission → Microsoft Graph and add these
Application permissions:
Application.Read.All
Group.Read.All
User.ReadBasic.All
from Delegated permissions add:
email
offline_access
openid
profile
GroupMember.Read.All
User.Read.All
Then select Grant admin consent for default directory.
These let TestCollab confirm, at sign-in, that a person still belongs to the groups you have mapped to a role, and let your TestCollab administrator see the full list of groups and app roles when they set up role mapping.
Step 5 - Create a client secret
Go to Certificates & secrets → Client secrets → New client secret.
Copy the Value and keep it safe - Azure shows it only once, and the Secret ID is a different thing that will not work in its place. Give the Value to your TestCollab administrator.
Step 6 - Decide who can use the application
Assign the users, groups, or app roles that should be allowed to sign in to TestCollab. Only people with an assignment your organisation has mapped will be able to get in.
Hand over to TestCollab
Pass these three values to your TestCollab administrator:
Value | Where you found it |
Directory (tenant) ID | Overview page |
Application (client) ID | Overview page |
Client secret Value | Certificates & secrets |