# Setting Up SSO with Microsoft / Azure AD

**Category:** [Security & Access](https://help.totalctrl.app/hc/totalctrl/totalctrl-help-center/en-US/categories/security-access)
**Updated:** 2026-08-19

## Overview

Allow your team to sign in with their Microsoft 365 or Azure AD accounts. TotalCtrl uses the Microsoft Identity Platform (OAuth 2.0 / OpenID Connect).

## Step 1 — Register an app in Azure AD

  
- Go to the Azure Portal → **Azure Active Directory → App registrations → New registration**.
  
- Redirect URI: **Web** → `https://app.totalctrl.com/auth/login/sso/[your-account-uuid]/callback`
  
- Go to **Certificates & secrets → New client secret**. Copy the secret value immediately.
  
- Note your **Application (client) ID** and **Directory (tenant) ID**.

## Step 2 — Configure SSO in TotalCtrl

  
- Go to **Settings → Security → SSO → New SSO configuration**.
  
- Select **Microsoft** as the provider.
  
- Paste the Application (client) ID, client secret, and Azure AD tenant ID.
  
- Toggle **Active** and save.

---

## Related Articles

- [Single Sign-On (SSO)](https://help.totalctrl.app/en-US/articles/single-sign-on-sso)
- [Setting Up SSO with Okta or a Custom OIDC Provider](https://help.totalctrl.app/en-US/articles/setting-up-sso-with-okta-or-a-custom-oidc-provider)
- [Two-Factor Authentication (2FA)](https://help.totalctrl.app/en-US/articles/two-factor-authentication-2fa)
- [Setting Up SSO with Google Workspace](https://help.totalctrl.app/en-US/articles/setting-up-sso-with-google-workspace)
- [API Tokens](https://help.totalctrl.app/en-US/articles/api-tokens)

---
[← Back to TotalCtrl Help Center](https://help.totalctrl.app/en-US/)