Microsoft Entra OIDC

This guide creates an Entra app registration for interactive Tenvyr sign-in. You need a Tenvyr owner or administrator and an Entra administrator who can create app registrations and client secrets.

Before you begin

Record:

• your Entra directory (tenant) UUID;
• the Entra cloud: Public, US Government, or China;
• your Tenvyr tenant UUID; and
• a local Tenvyr owner account that you can use if the provider is unavailable.

The app registration and the SCIM enterprise application can be the same Entra application or separate applications. Separate applications make permissions, owners, and rotation easier to audit.

1. Create the Entra app registration

In the Microsoft Entra admin center:

1. Open Identity → Applications → App registrations.
2. Select New registration.
3. Give the application a clear name, such as Tenvyr production sign-in.
4. Choose Accounts in this organizational directory only.
5. Register the application. You can add the redirect URI after Tenvyr creates the provider ID.
6. Copy the Application (client) ID and Directory (tenant) ID.
7. Under Certificates & secrets, create a client secret and copy its value immediately.

Use a short, governed expiration period and assign at least two application owners.

2. Add the provider to Tenvyr

In Tenvyr, open Integrations → Identity providers → Add provider and set:

Leave Provision mapped SCIM users on first sign-in off until the SCIM connector and role mappings are tested.

Save the provider and copy its Tenvyr provider UUID from the provider list. Tenvyr encrypts the client secret and never returns it. When editing the provider later, a blank secret field preserves the current value.

3. Add the redirect URI

Return to the Entra app registration and open Authentication → Add a platform → Web. Add:

https://app.tenvyr.com/auth/v1/oidc/PROVIDER_UUID/callback

Replace PROVIDER_UUID with the ID created by Tenvyr. Redirect URIs must match exactly, including scheme, path, and capitalization. Microsoft documents the same Authentication → Add a platform → Web flow in its redirect URI guide.

4. Limit access and test

In the corresponding Entra enterprise application:

1. Set Assignment required? to Yes.
2. Assign only a pilot group.
3. Open a private browser window and start sign-in from Tenvyr.
4. Complete Tenvyr MFA when prompted.
5. Confirm the correct tenant, person, and role appear in Tenvyr.

Test with an ordinary user, not only an Entra or Tenvyr administrator.

Enable first-sign-in provisioning

After Entra SCIM is delivering users and groups:

1. Assign a Tenvyr role to the test SCIM user or one of their SCIM groups.
2. Edit the Entra OIDC provider.
3. Enable Provision mapped SCIM users on first sign-in.
4. Sign in as a person who has never used Tenvyr.

Tenvyr creates the account only when the OIDC identity has an exact immutable external-ID match and an eligible role mapping. Email similarity is ignored.

Rotate the client secret

Create a second Entra secret before the first expires. Update the provider in Tenvyr with the new value, test sign-in, and then remove the old Entra secret. Record the next expiration in your secrets-management process.