Set up single sign-on with Microsoft Entra ID

Current signs your team in with Microsoft Entra ID, so access follows your existing identity policies — conditional access, MFA, and offboarding included.

• ＋A Microsoft Entra tenant and an account that can create app registrations (Application Administrator or Global Admin).
• ＋Tenant Admin role in Current.

1. 1
   Create an app registration

   Entra admin center → App registrations → New registration. Name it "Current" and choose single-tenant unless you have multiple Entra tenants.
2. 2
   Add the redirect URI

   Copy it from Current's Settings → Authentication → Entra ID panel and paste it as a Web redirect URI. Current validates redirect URIs against an allowlist, so it must match exactly.
3. 3
   Create a client secret

   Certificates & secrets → New client secret. Copy the value immediately — Azure only shows it once.
4. 4
   Note the IDs

   You'll need the Application (client) ID and the Directory (tenant) ID from the app's Overview page.

1. 1
   Enter the three values

   Settings → Authentication → Entra ID: client ID, tenant ID, and the client secret. The secret is encrypted at rest and never returned to the browser.
2. 2
   Test with your own account

   Use the Test sign-in button before enforcing anything. The flow uses a CSRF nonce and validates the redirect — if the URI doesn't match the allowlist, the test fails with a clear error.
3. 3
   Enforce SSO (optional)

   Once the test passes, flip Require SSO for all members. Password sign-in is disabled for everyone except break-glass admins.