Enable Microsoft SSO for Deal Engine’s user interface
This guide explains how your organization signs in to the Deal Engine OnePoint interface using your own Microsoft Entra ID (formerly Azure AD) tenant. Microsoft Entra sign-in is live today — once your tenant is connected, your team clicks Sign in with Microsoft and never handles a Deal Engine password.
How this works
Enabling SSO takes two independent tracks. Both must be complete before anyone can sign in, and they can run in parallel:
| Track | Who does it | What it produces |
|---|---|---|
| A. Approve the application | An admin in your tenant | Microsoft trusts Deal Engine to authenticate your users |
| B. Create the accounts | The Deal Engine team | Each person gets a OnePoint account and a role |
Approving the application does not create user accounts. Entra consent authorizes Deal Engine to authenticate your people; it does not tell us who they are or what they are allowed to do. If you complete track A only, your users will authenticate successfully with Microsoft and then be rejected by OnePoint. See Managing users.
1. Prerequisites
- You use Microsoft Entra ID (Azure AD) for your organization’s accounts.
- You can sign in as a Global Administrator, Cloud Application Administrator, or Privileged Role Administrator in your tenant.
- Outbound HTTPS access to
https://login.microsoftonline.com.
If your users live only in on-prem Active Directory without synchronization to Entra ID, set up Entra Cloud Sync or Azure AD Connect first.
2. Share your user list with us (track B)
Only the people on this list will be able to use OnePoint. We create one account per person, and sign-in is refused for anyone we have no account for — even when they have a perfectly valid account in your tenant and the application has been approved. There is no self-service sign-up.
Put another way: Microsoft decides who someone is, and the Deal Engine account decides whether they get in. Both are required, and approving the application in step 3 does not produce the second one.
Share with your Deal Engine contact the sign-in name (UPN) of each person who needs access, along with their name and what they should be able to do in OnePoint. The UPN is the field that matters — see the warning below.
Share later additions and removals the same way. Adding someone to the Entra application, or to an assigned group, does not create their OnePoint account.
Share the User Principal Name, not the mailbox address.
We identify people by the
preferred_usernameclaim Microsoft puts in the sign-in token, which is the account’s UPN — the name the person actually types to sign in to Microsoft. In many tenants the UPN differs from the address on the person’s business card. For example, a user might sign in as[email protected]while their mail attribute is[email protected].If you share the mailbox address but the account signs in with a different UPN, every sign-in for that person will be rejected, even with the application correctly approved.
You can see it in Entra admin center → Users → the User principal name column.
3. Approve the Deal Engine application (track A)
- Determine your Tenant ID (GUID) or verified domain (e.g.
contoso.com). Entra admin center → Identity → Overview. - Ask your Deal Engine contact which environment you are being onboarded to, and use the matching link below. Consent is granted per application, so if you are later moved to a different environment you may need to repeat this step.
- Open the link in a private window while signed in as an admin in your tenant, replacing
{TENANT_ID_OR_DOMAIN}with your tenant GUID or verified domain.
US region
Production — api.deal-engine.com
https://login.microsoftonline.com/{TENANT_ID_OR_DOMAIN}/v2.0/adminconsent?client_id=5460facb-b2a4-48d9-8410-6486ddaefa0c&scope=openid%20profile%20email%20https%3A%2F%2Fgraph.microsoft.com%2FUser.Read&redirect_uri=https%3A%2F%2Fapi.deal-engine.com%2Fauth%2Fmicrosoft%2Fcallback&state=setupSandbox — api.sandbox.deal-engine.com
https://login.microsoftonline.com/{TENANT_ID_OR_DOMAIN}/v2.0/adminconsent?client_id=5460facb-b2a4-48d9-8410-6486ddaefa0c&scope=openid%20profile%20email%20https%3A%2F%2Fgraph.microsoft.com%2FUser.Read&redirect_uri=https%3A%2F%2Fapi.sandbox.deal-engine.com%2Fauth%2Fmicrosoft%2Fcallback&state=setupQA — api.qa.deal-engine.com
https://login.microsoftonline.com/{TENANT_ID_OR_DOMAIN}/v2.0/adminconsent?client_id=5460facb-b2a4-48d9-8410-6486ddaefa0c&scope=openid%20profile%20email%20https%3A%2F%2Fgraph.microsoft.com%2FUser.Read&redirect_uri=https%3A%2F%2Fapi.qa.deal-engine.com%2Fauth%2Fmicrosoft%2Fcallback&state=setupEU region
Production — eu.api.deal-engine.com
https://login.microsoftonline.com/{TENANT_ID_OR_DOMAIN}/v2.0/adminconsent?client_id=5460facb-b2a4-48d9-8410-6486ddaefa0c&scope=openid%20profile%20email%20https%3A%2F%2Fgraph.microsoft.com%2FUser.Read&redirect_uri=https%3A%2F%2Feu.api.deal-engine.com%2Fauth%2Fmicrosoft%2Fcallback&state=setupSandbox — eu.api.sandbox.deal-engine.com
https://login.microsoftonline.com/{TENANT_ID_OR_DOMAIN}/v2.0/adminconsent?client_id=5460facb-b2a4-48d9-8410-6486ddaefa0c&scope=openid%20profile%20email%20https%3A%2F%2Fgraph.microsoft.com%2FUser.Read&redirect_uri=https%3A%2F%2Feu.api.sandbox.deal-engine.com%2Fauth%2Fmicrosoft%2Fcallback&state=setupStage — api.stage.deal-engine.com
https://login.microsoftonline.com/{TENANT_ID_OR_DOMAIN}/v2.0/adminconsent?client_id=5460facb-b2a4-48d9-8410-6486ddaefa0c&scope=openid%20profile%20email%20https%3A%2F%2Fgraph.microsoft.com%2FUser.Read&redirect_uri=https%3A%2F%2Fapi.stage.deal-engine.com%2Fauth%2Fmicrosoft%2Fcallback&state=setup- Review the permissions and click Accept. Deal Engine requests only sign-in, basic profile, email address, and
User.Read. - Microsoft creates an Enterprise application (service principal) for Deal Engine in your tenant.
You may see an error page right after clicking Accept. Microsoft returns the admin to a Deal Engine address that expects a regular sign-in, not a consent response, so the page can show a generic sign-in error even though consent succeeded.
To confirm it actually worked, check Entra admin center → Enterprise applications and look for the Deal Engine entry. If it is listed, track A is done — ignore the error page.
4. Restrict who can sign in (optional)
By default, once the app is approved, any user in your tenant can authenticate with it. They still cannot use OnePoint unless we created an account for them in track B, so this step is a second, tenant-side layer rather than your only control.
To limit it at the Entra level:
- Entra admin center → Enterprise applications → find the Deal Engine entry.
- Properties → set User assignment required? to Yes.
- Users and groups → Add user/group → assign the allowed users or groups.
You may also enforce MFA or other controls via Conditional Access; existing tenant-wide policies apply automatically.
5. Sign in
- Go to the OnePoint URL for the environment you were onboarded to — the same one you approved in step 3.
| Environment | OnePoint URL |
|---|---|
| US — Production | https://onepoint.deal-engine.com |
| US — Sandbox | https://onepoint.sandbox.deal-engine.com |
| US — QA | https://onepoint.qa.deal-engine.com |
| EU — Production | https://eu.onepoint.deal-engine.com |
| EU — Sandbox | https://eu.onepoint.sandbox.deal-engine.com |
| Stage | https://onepoint.stage.deal-engine.com |
- Click Sign in with Microsoft.
- Authenticate with an account from your tenant that we provisioned in track B.
- You land in OnePoint, signed in.
Always start from the OnePoint page. Deal Engine builds the sign-in request with the parameters Microsoft requires; a hand-made or bookmarked
login.microsoftonline.comlink will be missing them and will fail.
If your tenant enforces Conditional Access (MFA, compliant device, location), those policies are evaluated during sign-in.
6. Troubleshooting
a. AADSTS900144: The request body must contain the following parameter: 'scope'.
AADSTS900144: The request body must contain the following parameter: 'scope'.- Cause: The consent URL was opened without the required
scopeparameter. Links published in earlier versions of this guide were missing it. - Fix: Use the consent link in step 3 above. Discard any older link you saved or were sent — the parameter has to be present in the URL you open, we cannot add it after the fact.
b. AADSTS50011: The redirect URI specified in the request does not match…
AADSTS50011: The redirect URI specified in the request does not match…- Cause: The consent link points at an environment whose address is not registered for the application — usually the wrong environment’s link.
- Fix: Confirm with your Deal Engine contact which environment you are onboarding to and use that link.
c. “Need admin approval” when a user signs in
- Cause: The application has not been approved for your tenant (track A incomplete), or User assignment required is on with no users assigned, or Conditional Access is blocking the sign-in.
- Fix: Complete step 3, then assign the users or adjust the Conditional Access policy.
d. The user authenticates with Microsoft, then OnePoint rejects them
- Cause: Track B is incomplete or the identifier doesn’t match. Either we have no account for that person, or the account we created uses a different address than the UPN the person signs in with.
- Fix: Share the exact UPN shown in Entra admin center → Users for that person. See the warning in step 2.
e. A specific person is rejected while their colleagues sign in fine
- Almost always the UPN mismatch in (d), or the person’s OnePoint account has been deactivated. Share their UPN with us and we’ll check.
7. Security & privacy notes
- Deal Engine receives standard OpenID Connect claims: name, email address, and tenant ID.
- Your passwords never pass through Deal Engine — authentication happens entirely on Microsoft’s servers.
- You keep full control from your tenant: revoke access, require MFA, and review sign-in logs in the Entra admin center at any time.
- Revoking the Enterprise application in your tenant immediately blocks new sign-ins.
8. Contact
If something isn’t working, share the following with us:
- A screenshot of the error page, including the Request Id, Correlation Id, and Timestamp.
- The UPN of the affected user and your Tenant ID.
- Which environment you were using.
We’ll review the server-side logs and get you unblocked.
Updated 3 days ago