If you haven't already, it's worth reading Single sign-on (SSO): an introduction first for an overview of why your organisation might want this.

How AdviceAid's single sign-on works

AdviceAid signs users in with Microsoft Entra ID (formerly Azure AD), using the standard OpenID Connect protocol. There's nothing to install, and no software to run on your side.

  • AdviceAid is a single, multi-tenant cloud application. You don't create your own app registration, upload a manifest, or manage certificates. You approve AdviceAid's existing application once, and it then works for everyone in your tenant.

  • When a user signs in, AdviceAid opens a Microsoft sign-in window. The user authenticates against your tenant, including any conditional access, MFA, or device policies you already enforce. Microsoft returns a signed identity token to AdviceAid, which checks it and starts its own short-lived session.

  • AdviceAid keeps the user list and roles inside AdviceAid itself. Entra decides who is allowed to sign in. AdviceAid decides what each person can do once they're in. This split is intentional - see "Controlling who can use AdviceAid" below.

Your organisation is identified by its tenant ID. AdviceAid records this the first time you approve the app, and from then on only accepts sign-ins from that tenant for your team. A token from any other tenant is rejected, so nobody outside your organisation can sign in as one of your users.

Permissions AdviceAid requests

When a Global Administrator approves AdviceAid, the Microsoft consent screen shows the full list of permissions being granted. That screen is the source of truth. This is what it shows:

  • openid — delegated, used every time someone signs in. Signs the user in. This is a core part of OpenID Connect.

  • profile — delegated, used every time someone signs in. Reads the user's name, so AdviceAid shows the right display name and keeps it up to date.

  • email — delegated, used every time someone signs in. Reads the user's email address, to match the user to their AdviceAid account.

  • Domain.Read.All — application permission, used once when you connect. Reads the list of verified domains on your tenant, so AdviceAid can show a recognisable label for your organisation (for example, yourcouncil.gov.uk) in its admin screens.

The three delegated permissions are the standard "sign in and read basic profile" set. They don't give AdviceAid access to mail, files, calendars, Teams, or any other content. The one application permission is read-only and limited to domain names.

AdviceAid deliberately doesn't ask for:

  • Any permission to read group membership

  • Any permission to create, change, or delete anything in your directory

This is the complete list. If AdviceAid ever needs anything else, it would need fresh consent, so the Microsoft consent screen will always show exactly what's been granted.

Connecting AdviceAid to your tenant

The connection is approved once, by an administrator with rights to grant tenant-wide consent. Because AdviceAid requests one Microsoft Graph application permission (Domain.Read.All), this has to be a Global Administrator or a Privileged Role Administrator.

To connect:

  1. A team administrator (or AdviceAid support) opens the SSO setup panel in AdviceAid and generates a consent link.

  2. Send the link to a Global Administrator or Privileged Role Administrator, or open it yourself if you hold one of those roles.

  3. The link opens the standard Microsoft admin consent page. Sign in as that administrator and select Accept. The permissions listed above are shown for review at this point.

  4. Microsoft redirects back to AdviceAid, which records your tenant ID and confirms the connection. AdviceAid then looks up your primary verified domain and shows it as your organisation's label. This can take up to a minute.

A few things worth knowing:

  • The consent link grants organisation-wide admin consent in one action. Individual users aren't prompted to consent again.

  • Application Administrator and Cloud Application Administrator roles can normally grant app consent, but Microsoft doesn't let them consent to Graph application permissions. They can't complete AdviceAid's consent on their own.

  • A tenant can only be linked to one AdviceAid team, and a team can only be linked to one tenant. Once connected, this link is fixed. Re-pointing it, for example after a tenant migration, goes through AdviceAid support.

Controlling who can use AdviceAid

AdviceAid is a standard Entra enterprise application, so you control access to it the same way as any other SaaS app. We recommend setting Assignment required:

  1. In the Entra admin centre, go to Enterprise applications and find AdviceAid.

  2. Open Properties and set Assignment required? to Yes.

  3. Under Users and groups, assign the specific users or security groups who are allowed to use AdviceAid.

With this in place, Entra only issues a sign-in token for assigned users. Everyone else is stopped by Microsoft at sign-in and never reaches AdviceAid. This is enforced by your own directory, follows your conditional access and MFA policies, and is auditable in your Entra sign-in logs.

This works alongside AdviceAid's automatic account creation, covered in Setting up single sign-on: for team administrators. Entra controls who gets in, and AdviceAid creates the account on first sign-in.

Keeping access up to date

Once a team turns on enforced SSO (see the team administrators article), AdviceAid keeps sessions in step with your directory:

  • AdviceAid sessions for teams with enforced SSO are short-lived and renew automatically using Microsoft's silent token refresh.

  • If you disable a user, force a password change, revoke their session, or a conditional access policy starts blocking them, their next silent refresh fails and they're sent back to the sign-in screen. You don't need to tell AdviceAid - removing access in Entra is enough.

One thing to be aware of: silent refresh relies on a hidden call to Microsoft. Browsers that block third-party cookies may not be able to refresh silently, and will ask the user to sign in again. This is a usability point, not a security gap - the user just signs in again.

Neatlines support access

AdviceAid's vendor, Neatlines, occasionally needs to work inside your team to help with setup or support. This is done through an audited, time-limited "work in this team" session, not a shared login and not an account in your directory.

  • Only a Neatlines site administrator can start a session, for a fixed window.

  • Every action taken during that window is recorded against the real Neatlines person, the team they were working in, and the time.

  • The session doesn't create or use any account in your Entra tenant, and doesn't give Neatlines any standing access. It simply expires.

This replaces the older practice of adding a Neatlines email address as a member of your team.

Troubleshooting

A user can't sign in after their email was changed in your directory

In rare cases, changing someone's email in Entra can stop AdviceAid matching them to their existing account. An administrator can fix this by clearing the saved Entra link for that user in the AdviceAid user panel. Their next Microsoft sign-in then re-establishes the link. If that doesn't fix it, contact AdviceAid support.

What to read next