Enable Microsoft SSO for Deal Engine’s user interface

Microsoft Entra sign-in is live for the OnePoint user interface; this is not a proposal, it's how your team signs in today (or can start signing in) once your tenant is connected.

TL;DR

1. Admin grants Microsoft Entra consent
2. Deal Engine app is created in tenant
3. (Optional) Restrict users/groups
4. Users click “Sign in with Microsoft”
5. Conditional Access & MFA apply

This guide explains how your organization can enable “Sign in with Microsoft” to access Deal Engine using your own Microsoft Entra ID (formerly Azure AD) tenant. It takes ~5–10 minutes and requires an admin from your tenant.

Note: SSO governs sign-in to the OnePoint UI only. It does not create the underlying OnePoint user accounts; those are provisioned by the Deal Engine team (see Managing users). A person needs an existing Deal Engine account before Entra sign-in will authenticate them.

1. Prerequisites

• You use Microsoft Entra ID (Azure AD) for your organization’s accounts.
• You can sign in as a Global Administrator, Cloud Application Administrator, or Privileged Role Administrator in your tenant.
• Outbound HTTPS access to https://login.microsoftonline.com.

2. Approve the Deal Engine application (Admin consent)

1. Determine your Tenant ID (GUID) or verified domain (e.g., contoso.com).
   • You can find it in Entra admin center → Identity → Overview.
2. Open this Admin Consent URL in a private window while signed in as an admin in your tenant. Replace {TENANT_ID_OR_DOMAIN} with your tenant GUID or your verified domain:

3. Review the permissions (standard OpenID Connect permissions). Click Accept.
4. After acceptance, Microsoft will create an Enterprise application (service principal) for Deal Engine in your tenant.

3. Restrict who can sign in (Optional)

By default, once the app is approved, any user in your tenant can sign in.

To limit access to specific people or groups:

1. Entra admin center → Enterprise applications → find the newly created entry for Deal Engine.
2. Open Properties → set User assignment required? to Yes.
3. Go to Users and groups → Add user/group → assign the allowed users or groups.

4. Test the logic

1. Navigate to your Deal Engine environment and click Sign in with Microsoft.
2. Use a user account from your tenant that has access (per step 3 if you restricted usage).
3. You should be prompted by Microsoft login; once authenticated, you’ll be redirected back to Deal Engine and signed in.

If your tenant enforces Conditional Access (MFA, compliant device, location), those policies will be evaluated during sign-in.

5. Common issues & resolutions

a. Error: AADSTS900144: The request body must contain the following parameter: 'scope'.

• Cause: A call was made to the v2.0 endpoints without the required scope parameter (a library or custom code used a v1-style request).
• Action: Deal Engine has addressed this on our side; if you still see it, let us know the timestamp and the email used so we can check the audit logs.

b. “Need admin approval” after consent

• Usually occurs if User assignment required is turned on but no users/groups have been assigned, or if Conditional Access blocks the sign-in.
• Action: Assign users/groups to the Enterprise app, or adjust Conditional Access to allow the scenario.

c. “User not authorized” inside Deal Engine

• Your users authenticated, but your organization hasn’t been enabled in our system yet.
• Action: Send us your Tenant ID so we can allow-list it and map it to your customer account.

d. Different environment (Production vs QA)

• Each environment has its own registered redirect URIs and sometimes its own application registration. Admin consent may need to be granted separately per environment if client IDs differ.

6. Security & privacy notes

• Deal Engine receives standard OpenID Connect claims (name, email, tenant ID).
• Your password never passes through Deal Engine; authentication happens on Microsoft’s servers.
• You retain full control from your tenant: you can revoke access, require MFA, and see sign-in logs in the Entra admin center.

7. What to send Deal Engine

Please share the following so we can complete the linkage on our side:

• Your Tenant ID (GUID) and verified domain.
• The list of groups you assigned (if using “User assignment required”).

Optional but helpful:

• Your security contact for quick coordination if Conditional Access changes affect sign-ins.

8. Contact

If anything isn’t working, send us:

• A screenshot of the error page (including the Request Id, Correlation Id, and Timestamp).
• The user’s email and your Tenant ID.

We’ll review server-side logs and get you unblocked quickly.