Enterprise Single Sign-On (SSO) Entra ID Implementation

Enterprise Single Sign-On (SSO) Entra ID Implementation

For secure access to the Mondra platform, we will configure Single Sign-On (SSO) with your Microsoft Entra ID.
These steps must be carried out by a Global Administrator.

Hands On Method


You will need to complete the following steps to link our authentication platform (Auth0) with your Entra ID (Formally AAD):
  1. Navigate to your Entra ID portal.
  2. Select App Registrations.
  3. Select + New Registration to create a new application.



  4. Give the application a name such as 'Mondra SSO'



  5. Click on Authentication and insert the Redirect URI https://sso.mondra.com/login/callback
  6. Click Register 
  7. Open the application you have just created and copy the Directory (Tenant) ID and the Client ID and email the IDs to sso@mondra.com



  8. Click Certificates & Secrets
  9. Click + New Secret



  10. Give the secret a name such as 'Mondra SSO' and set the expiry to align with your security policies.



  11. Copy the new secret Value and send with the expiry date, in a separate email to the Client ID and Directory ID, to sso@mondra.com



  12. Select API Permissions in the blade and Grant admin consent for the application ensuring that green ticks are against the permission values.



  13. Head to the Enterprise Application that was created and add the required users or predefined Entra ID Security Group containing the Mondra Platform users.



Once we have received this information we will configure the SSO connection in Auth0 and confirm the connection is working. We will then send you a confirmation email. All users registered with the Mondra platform will receive email notification confirming access.

Advanced - PowerShell Method


If you would like, you can use use the below PowerShell script to create the App Registration automatically.

  2. #Connect-AzAccount -tenant <tenantID>
  3. $uiAppDisplayName = "PowerShell Test"
  4. $uri = "https://sso.mondra.com/login/callback"
  5. $uiApp = New-AzADApplication    -DisplayName $uiAppDisplayName `
  6.                                 -AvailableToOtherTenants $false `
  7.                                 -ReplyUrls $uri 

  9. #Create the client secret
  10. $startDate = Get-Date
  11. $endDate = $startDate.AddYears(1)
  12. $secret = New-AzADAppCredential -ApplicationId $uiApp.AppID -StartDate $startDate -EndDate $endDate

  14. #Create the app permissions
  15. Add-AzADAppPermission -ApplicationId $uiApp.AppID -Api "00000003-0000-0000-c000-000000000000" -PermissionId "e1fe6dd8-ba31-4d61-89e7-88639da4683d"


  18. #Retrieve the tenant ID
  19. #$tenantId = (Get-AzTenantDetail).ObjectId

  21. #Print the App-ID, tenant ID, and client secret
  22. Write-Host "App-ID: $($app.AppId)"
  23. Write-Host "Tenant ID: $tenantId"
  24. Write-Host "Client Secret: $($secret.SecretText)"

PowerShell Script and its outputPowerShell Script and its output