Setting Up Microsoft 365 SSO

Last updated:

Setting Up Microsoft 365 SSO

This guide walks you through configuring Microsoft 365 Single Sign-On (SSO) so your employees can sign in to Chorum using their Microsoft accounts.

Prerequisites

  • An Azure Active Directory (Azure AD) tenant
  • Admin access to the Azure Portal
  • Admin access to Chorum (Settings > Integrations)

Step 1: Create an Azure App Registration

  1. Sign in to the Azure Portal
  2. Navigate to Azure Active Directory > App registrations
  3. Click + New registration
  4. Fill in the details:
    • Name: Chorum SSO (or your company name)
    • Supported account types: Select Single tenant (recommended for most organisations) or Multi-tenant if you need to allow external Microsoft accounts
  5. Click Register

Step 2: Upload the Chorum Logo

To make the app recognisable when employees sign in:

  1. In your App Registration, go to Branding & properties
  2. Upload the Chorum logo (you can download it from the SSO setup wizard in Chorum)
  3. Click Save

Step 3: Configure the Redirect URI

  1. In the left menu, click Authentication
  2. Under Platform configurations, click Add a platform > Web
  3. Enter the redirect URI: https://chorum.io/api/auth/microsoft/callback
  4. Important: Always use the platform URL (chorum.io), NOT your tenant URL. All tenants relay through the main Chorum server, so only one redirect URI is needed in Azure.
  5. Under Implicit grant and hybrid flows, tick ID tokens
  6. Click Configure
Why only one redirect URI?
Chorum uses a relay pattern — when your users click “Sign in with Microsoft”, the OAuth flow redirects through chorum.io, which securely forwards the authentication to your specific tenant. You never need to update Azure when new tenants are added.

Step 4: Add API Permissions

  1. Go to API permissions in the left menu
  2. Click Add a permission > Microsoft Graph > Delegated permissions
  3. Add the following permissions:
    • openid
    • profile
    • email
    • User.Read
  4. Click Grant admin consent for [your organisation]

Step 5: Create a Client Secret

  1. Go to Certificates & secrets in the left menu
  2. Click New client secret
  3. Add a description (e.g. "Chorum SSO") and choose an expiry period
  4. Click Add
  5. Important: Copy the secret value immediately — it will not be shown again

Step 6: Enter Credentials in Chorum

  1. In Chorum, go to Settings > Integrations
  2. Under SSO / Authentication, click Set Up Microsoft SSO
  3. Enter the following from your Azure App Registration:
    • Application (Client) ID — found on the app's Overview page
    • Client Secret — the value you copied in Step 5
    • Directory (Tenant) ID — found on the app's Overview page (use "common" to allow any Microsoft account)
  4. Click Save Credentials

Step 7: Enable SSO

  1. Go to Settings > Security
  2. Under Organisation Security > Single Sign-On (SSO), toggle SSO on
  3. Optionally, tick Require SSO for all users to disable password login entirely
  4. Optionally, set Allowed Email Domains to restrict SSO to specific domains (e.g. yourcompany.co.uk)
  5. Click Save Organisation Settings

Testing

After completing the setup:

  1. Go back to Settings > Integrations
  2. Click the Test SSO Login button next to Microsoft 365 SSO
  3. You should be redirected to the Microsoft login page
  4. After signing in, you should be redirected back to Chorum and logged in

Troubleshooting

AADSTS50011: The redirect URI does not match

The redirect URI in Azure must be exactly https://chorum.io/api/auth/microsoft/callback (the platform URL, not your tenant URL). All tenants relay through chorum.io. Remove any tenant-specific redirect URIs from Azure.

AADSTS700016: Application not found

The Client ID is incorrect. Verify it matches the Application (client) ID on the app's Overview page.

AADSTS7000215: Invalid client secret

The client secret has expired or is incorrect. Create a new secret in Certificates & secrets and update it in Chorum.

SSO works but users cannot log in

Check that the user's email domain is in the Allowed Email Domains list (Settings > Security). If the list is empty, all domains are allowed.

Users still see the password form

If you want to force SSO-only login, tick Require SSO for all users in Settings > Security. This will hide the password form on the login page.

Security Notes

  • Client secrets are encrypted at rest in Chorum's database
  • We recommend setting a client secret expiry of 12–24 months and rotating it before expiry
  • Use Single tenant mode unless you specifically need multi-tenant access
  • Domain restrictions add an extra layer of security by limiting which email addresses can sign in