Skip to content
TekStacks

Microsoft Entra ID

Sign in with Microsoft

Last updated October 14, 2026

Let your team sign in to TekStacks with their Microsoft work accounts. Your own Microsoft Entra ID multifactor and Conditional Access policies apply to every sign in, and you decide in Entra who can reach TekStacks at all.

Overview

Once your Microsoft directory is connected, the TekStacks sign in page for your company shows Sign in with Microsoft. Who gets in:

  • People already in TekStacks. Anyone added under Users with their work email (their Microsoft sign in name) signs in with Microsoft, whether or not they also set a password. The first Microsoft sign in links the accounts.
  • People in an Entra group you map to a role (optional). Someone in a mapped group gets a TekStacks account with that role the first time they sign in, without an invitation.
  • People Entra provisions with SCIM (optional, see Provisioning users with SCIM).
  • Anyone else is refused and told to ask their administrator.

Admins are the exception: they link Microsoft from their own Security page, so no account in your directory can take over an Admin's.

Requirements

  • A TekStacks Admin in your company.
  • A Global Administrator of your Microsoft 365 or Entra ID directory, once, to approve TekStacks.
  • Entra ID Free is enough. Assigning groups (rather than individual people) to an enterprise application needs Entra ID P1, which is included in Microsoft 365 Business Premium, E3 and E5.

Step 1: Connect your directory

  1. In TekStacks, open Settings, then Microsoft sign in.
  2. Click Connect.
  3. Sign in as a Global Administrator of your directory and click Accept.
  4. Microsoft asks you to sign in once more. Choose an account that belongs to your directory (not a guest), so TekStacks knows which directory you approved.

You return to TekStacks, which shows Connected and your directory ID. TekStacks now appears in the Microsoft Entra admin center under Enterprise applications as TekStacks.

Note: TekStacks asks to sign people in, and to read your directory's users and groups for the optional employee sync. Nothing is written to your directory. If TekStacks later asks for a new permission, click Approve again at the top of the same page.

If you later limit TekStacks to assigned users and groups (Step 2), the account you use to connect or approve again must be assigned too.

Step 2: Choose who can reach TekStacks in Entra (recommended)

By default anyone in your directory can reach the TekStacks sign in, and TekStacks refuses anyone it does not know. To have Microsoft refuse them first:

  1. In the Microsoft Entra admin center, go to Entra ID, Enterprise applications, and open TekStacks.
  2. Open Properties, set Assignment required? to Yes, and click Save.
  3. Open Users and groups, click Add user/group, select the people or groups who should use TekStacks, and click Assign.

Note: With Assignment required? set to Yes, anyone not assigned here is refused by Microsoft, including people you invited in TekStacks. Assign everyone who uses TekStacks before you turn it on.

Note: On Entra ID Free you can assign individual people but not groups. The error "Groups are not available for assignment due to your Active Directory plan level" means the directory needs P1 for group assignment.

Step 3: Map Entra groups to roles (optional)

Map a group to let its members in without inviting each one. SCIM provisioning uses the same mappings for roles.

  1. In TekStacks, under Settings, Microsoft sign in, click Map groups to roles.
  2. For each role, start typing a group's name and pick it from the list. You can also paste a group's Object ID from the Entra admin center.
  3. Save.

TekStacks asks Microsoft at each sign in whether the person is in a mapped group, nested groups included. Nothing needs setting up in the token, and the groups do not have to be assigned to the TekStacks application.

How mapped groups behave:

  • A member gets the group's role the first time they sign in, and any newly mapped role at later sign ins.
  • Leaving a group never removes a role; change roles under Users.
  • Someone who got in through a mapped group and is no longer in any mapped group is turned off at their next sign in.

Step 4: Test

  1. On your own account, open Security and click Link my Microsoft account.
  2. In a private browser window, open your company's sign in page and click Sign in with Microsoft:
    • as an invited user: signed in and linked;
    • as a member of a mapped group with no account yet: an account is created with the group's role;
    • as someone who is neither: refused.

Step 5: Make Microsoft the only way in (optional)

When Microsoft sign in works for everyone, you can turn off passwords and passkeys for your company. The sign in page then shows only Sign in with Microsoft and Trouble signing in?.

  1. Your own account needs a passkey (Security, Add a passkey) and a linked Microsoft account.
  2. Make sure everyone's TekStacks email is their Microsoft sign in name. Anyone whose email is something else, such as a personal address, cannot sign in once Microsoft is the only way in. Change others' emails under Users; change your own with Use ... as my email under Microsoft account on your Security page.
  3. Under Settings, Microsoft sign in, click Make Microsoft the only way in. A checklist shows whether you and your other Admins are ready, and lists everyone who has not signed in with Microsoft yet. Turn it on stays unavailable until your account passes.
  4. Test in a private window: there are no email or password fields, and a password sign in is refused.

Break glass recovery

If Microsoft sign in ever breaks for your company, any active Admin with a passkey can get back in:

  1. On the sign in page, click Trouble signing in?.
  2. Click Break glass, confirm, and use your passkey.

Microsoft only is turned off, you are signed in on the Microsoft sign in settings, and your other Admins are emailed. Only Admins can use it, and only while Microsoft is the only way in.

Note: Passkeys work on your tekstacks.com address. If your company uses its own domain, Trouble signing in? takes you to the tekstacks.com address first.

Troubleshooting

"Your Microsoft account is not set up for your company." The person has no TekStacks account and is not in a mapped group. Invite them, or check that the group's Object ID in Map groups to roles matches the group in Entra.

A member of a mapped group is refused. Check that they signed in to the right directory (people in several directories pick one at the Microsoft prompt). If Assignment required? is Yes, the person or group must also be assigned under Users and groups. Click Check the connection on Microsoft sign in: it says what Microsoft has granted TekStacks.

Microsoft refuses someone before they reach TekStacks. Assignment required? is Yes and they are not assigned to the TekStacks application.

"There is already an account for this email." The address belongs to an Admin, who is never matched automatically. They sign in the usual way and link Microsoft from their Security page.

"Microsoft did not say which groups you are in." TekStacks could not ask Microsoft about the person's groups. Click Check the connection; if a permission is missing, click Approve again and approve as a Global Administrator.

Searching for a group finds nothing. Click Check the connection and search for the group there. It lists the permissions Microsoft granted and what went wrong. Most often TekStacks was approved before it asked to read groups: click Approve again.

FAQ

Do people need a TekStacks password? No. Invited people can use Microsoft from their first sign in.

Can guests from other directories sign in? Yes, the same rules apply: invited, or in a mapped group in your directory.

What happens when someone leaves? Disable them in Entra and they can no longer sign in with Microsoft. To turn off their TekStacks account automatically as well, use SCIM provisioning, or turn them off under Users.

How do I disconnect? Settings, Microsoft sign in, Disconnect. Turn off Microsoft only first if it is on.

All help guides