[{"data":1,"prerenderedAt":1323},["ShallowReactive",2],{"navigation_docs_en":3,"-en-sign-in-and-directories-microsoft-entra-id":427,"-en-sign-in-and-directories-microsoft-entra-id-surround":1318},[4,31,117,188,238,271,310,369,378],{"title":5,"icon":6,"path":7,"stem":8,"children":9,"page":30},"Getting started","i-hugeicons-rocket-01","\u002Fen\u002Fgetting-started","en\u002F01.getting-started",[10,15,20,25],{"title":11,"path":12,"stem":13,"icon":14},"What is DDM?","\u002Fen\u002Fgetting-started\u002Fwhat-is-ddm","en\u002F01.getting-started\u002F01.what-is-ddm","i-hugeicons-information-circle",{"title":16,"path":17,"stem":18,"icon":19},"Account and sign-in","\u002Fen\u002Fgetting-started\u002Fsign-in","en\u002F01.getting-started\u002F02.sign-in","i-hugeicons-key-01",{"title":21,"path":22,"stem":23,"icon":24},"AI in DDM","\u002Fen\u002Fgetting-started\u002Fai-in-ddm","en\u002F01.getting-started\u002F03.ai-in-ddm","i-hugeicons-ai-magic",{"title":26,"path":27,"stem":28,"icon":29},"System status","\u002Fen\u002Fgetting-started\u002Fsystem-status","en\u002F01.getting-started\u002F04.system-status","i-hugeicons-activity-03",false,{"title":32,"icon":33,"path":34,"stem":35,"children":36,"page":30},"CMS","i-hugeicons-dashboard-square-01","\u002Fen\u002Fcms","en\u002F02.cms",[37,42,47,52,57,62,67,72,77,82,87,92,97,102,107,112],{"title":38,"path":39,"stem":40,"icon":41},"The CMS at a glance","\u002Fen\u002Fcms\u002Foverview","en\u002F02.cms\u002F01.overview","i-hugeicons-compass-01",{"title":43,"path":44,"stem":45,"icon":46},"Uploading documents","\u002Fen\u002Fcms\u002Fupload","en\u002F02.cms\u002F02.upload","i-hugeicons-upload-01",{"title":48,"path":49,"stem":50,"icon":51},"Categories","\u002Fen\u002Fcms\u002Fcategories","en\u002F02.cms\u002F03.categories","i-hugeicons-folder-tree",{"title":53,"path":54,"stem":55,"icon":56},"Editing documents","\u002Fen\u002Fcms\u002Fdocuments","en\u002F02.cms\u002F04.documents","i-hugeicons-file-edit",{"title":58,"path":59,"stem":60,"icon":61},"Searching and filtering","\u002Fen\u002Fcms\u002Fsearch-and-filters","en\u002F02.cms\u002F05.search-and-filters","i-hugeicons-search-01",{"title":63,"path":64,"stem":65,"icon":66},"Groups and permissions","\u002Fen\u002Fcms\u002Fgroups-and-permissions","en\u002F02.cms\u002F06.groups-and-permissions","i-hugeicons-user-multiple",{"title":68,"path":69,"stem":70,"icon":71},"Users","\u002Fen\u002Fcms\u002Fusers","en\u002F02.cms\u002F07.users","i-hugeicons-user-add-01",{"title":73,"path":74,"stem":75,"icon":76},"Approvals","\u002Fen\u002Fcms\u002Fapprovals","en\u002F02.cms\u002F08.approvals","i-hugeicons-checkmark-badge-01",{"title":78,"path":79,"stem":80,"icon":81},"Markets and translations","\u002Fen\u002Fcms\u002Fmarkets-and-translations","en\u002F02.cms\u002F09.markets-and-translations","i-hugeicons-globe-02",{"title":83,"path":84,"stem":85,"icon":86},"Note templates","\u002Fen\u002Fcms\u002Fnote-templates","en\u002F02.cms\u002F10.note-templates","i-hugeicons-layout-01",{"title":88,"path":89,"stem":90,"icon":91},"Usage and audit log","\u002Fen\u002Fcms\u002Fusage-and-audit","en\u002F02.cms\u002F11.usage-and-audit","i-hugeicons-chart-column",{"title":93,"path":94,"stem":95,"icon":96},"AI assistant","\u002Fen\u002Fcms\u002Fassistant","en\u002F02.cms\u002F12.assistant","i-hugeicons-sparkles",{"title":98,"path":99,"stem":100,"icon":101},"Settings","\u002Fen\u002Fcms\u002Fsettings","en\u002F02.cms\u002F13.settings","i-hugeicons-settings-02",{"title":103,"path":104,"stem":105,"icon":106},"Plans","\u002Fen\u002Fcms\u002Fplans","en\u002F02.cms\u002F14.plans","i-hugeicons-package",{"title":108,"path":109,"stem":110,"icon":111},"Feature requests","\u002Fen\u002Fcms\u002Ffeature-requests","en\u002F02.cms\u002F15.feature-requests","i-hugeicons-idea-01",{"title":113,"path":114,"stem":115,"icon":116},"Report a bug","\u002Fen\u002Fcms\u002Fbug-reports","en\u002F02.cms\u002F16.bug-reports","i-hugeicons-bug-01",{"title":118,"icon":119,"path":120,"stem":121,"children":122,"page":30},"App","i-hugeicons-smart-phone-01","\u002Fen\u002Fapp","en\u002F03.app",[123,128,133,138,143,147,152,157,162,167,170,173,176,179,184],{"title":124,"path":125,"stem":126,"icon":127},"Signing in and finding your way","\u002Fen\u002Fapp\u002Foverview","en\u002F03.app\u002F01.overview","i-hugeicons-login-03",{"title":129,"path":130,"stem":131,"icon":132},"Tabs and split view","\u002Fen\u002Fapp\u002Ftabs","en\u002F03.app\u002F02.tabs","i-hugeicons-layout-2-column",{"title":134,"path":135,"stem":136,"icon":137},"Finding and reading documents","\u002Fen\u002Fapp\u002Fdocuments","en\u002F03.app\u002F03.documents","i-hugeicons-file-01",{"title":139,"path":140,"stem":141,"icon":142},"Favorites","\u002Fen\u002Fapp\u002Ffavorites","en\u002F03.app\u002F04.favorites","i-hugeicons-favourite",{"title":144,"path":145,"stem":146,"icon":61},"Searching","\u002Fen\u002Fapp\u002Fsearch","en\u002F03.app\u002F05.search",{"title":148,"path":149,"stem":150,"icon":151},"Notes","\u002Fen\u002Fapp\u002Fnotes","en\u002F03.app\u002F06.notes","i-hugeicons-note-edit",{"title":153,"path":154,"stem":155,"icon":156},"Calendar and appointments","\u002Fen\u002Fapp\u002Fcalendar","en\u002F03.app\u002F07.calendar","i-hugeicons-calendar-03",{"title":158,"path":159,"stem":160,"icon":161},"Sending to customers","\u002Fen\u002Fapp\u002Foutbox","en\u002F03.app\u002F08.outbox","i-hugeicons-sent",{"title":163,"path":164,"stem":165,"icon":166},"Working offline","\u002Fen\u002Fapp\u002Foffline","en\u002F03.app\u002F09.offline","i-hugeicons-wifi-off-01",{"title":93,"path":168,"stem":169,"icon":96},"\u002Fen\u002Fapp\u002Fassistant","en\u002F03.app\u002F10.assistant",{"title":98,"path":171,"stem":172,"icon":101},"\u002Fen\u002Fapp\u002Fsettings","en\u002F03.app\u002F11.settings",{"title":108,"path":174,"stem":175,"icon":111},"\u002Fen\u002Fapp\u002Ffeature-requests","en\u002F03.app\u002F12.feature-requests",{"title":113,"path":177,"stem":178,"icon":116},"\u002Fen\u002Fapp\u002Fbug-reports","en\u002F03.app\u002F13.bug-reports",{"title":180,"path":181,"stem":182,"icon":183},"Desktop app","\u002Fen\u002Fapp\u002Fdesktop-app","en\u002F03.app\u002F14.desktop-app","i-hugeicons-computer",{"title":185,"path":186,"stem":187,"icon":119},"Mobile app","\u002Fen\u002Fapp\u002Fmobile-app","en\u002F03.app\u002F15.mobile-app",{"title":189,"icon":190,"path":191,"stem":192,"children":193,"page":30},"Sign-in & directories","i-hugeicons-security-check","\u002Fen\u002Fsign-in-and-directories","en\u002F04.sign-in-and-directories",[194,198,202,207,212,217,222,226,230,234],{"title":195,"path":196,"stem":197,"icon":19},"Sign-in methods","\u002Fen\u002Fsign-in-and-directories\u002Fsign-in-methods","en\u002F04.sign-in-and-directories\u002F01.sign-in-methods",{"title":199,"path":200,"stem":201,"icon":190},"Single sign-on","\u002Fen\u002Fsign-in-and-directories\u002Fsingle-sign-on","en\u002F04.sign-in-and-directories\u002F02.single-sign-on",{"title":203,"path":204,"stem":205,"icon":206},"Directory services (LDAP)","\u002Fen\u002Fsign-in-and-directories\u002Fdirectory-services","en\u002F04.sign-in-and-directories\u002F03.directory-services","i-hugeicons-hierarchy",{"title":208,"path":209,"stem":210,"icon":211},"Synchronisation and sign-in","\u002Fen\u002Fsign-in-and-directories\u002Fdirectory-sync","en\u002F04.sign-in-and-directories\u002F04.directory-sync","i-hugeicons-refresh",{"title":213,"path":214,"stem":215,"icon":216},"Microsoft Entra ID","\u002Fen\u002Fsign-in-and-directories\u002Fmicrosoft-entra-id","en\u002F04.sign-in-and-directories\u002F05.microsoft-entra-id","i-hugeicons-building-03",{"title":218,"path":219,"stem":220,"icon":221},"Okta","\u002Fen\u002Fsign-in-and-directories\u002Fokta","en\u002F04.sign-in-and-directories\u002F06.okta","i-hugeicons-finger-print",{"title":223,"path":224,"stem":225,"icon":81},"Google Workspace","\u002Fen\u002Fsign-in-and-directories\u002Fgoogle-workspace","en\u002F04.sign-in-and-directories\u002F07.google-workspace",{"title":227,"path":228,"stem":229,"icon":119},"Two-factor authentication","\u002Fen\u002Fsign-in-and-directories\u002Ftwo-factor-authentication","en\u002F04.sign-in-and-directories\u002F08.two-factor-authentication",{"title":231,"path":232,"stem":233,"icon":221},"Passkeys","\u002Fen\u002Fsign-in-and-directories\u002Fpasskeys","en\u002F04.sign-in-and-directories\u002F09.passkeys",{"title":235,"path":236,"stem":237,"icon":156},"Calendar access","\u002Fen\u002Fsign-in-and-directories\u002Fcalendar-access","en\u002F04.sign-in-and-directories\u002F10.calendar-access",{"title":239,"icon":240,"path":241,"stem":242,"children":243,"page":30},"MCP server","i-hugeicons-ai-network","\u002Fen\u002Fmcp-server","en\u002F05.mcp-server",[244,248,253,257,262,266],{"title":245,"path":246,"stem":247,"icon":240},"Overview","\u002Fen\u002Fmcp-server\u002Foverview","en\u002F05.mcp-server\u002F01.overview",{"title":249,"path":250,"stem":251,"icon":252},"Setup","\u002Fen\u002Fmcp-server\u002Fsetup","en\u002F05.mcp-server\u002F02.setup","i-hugeicons-plug-socket",{"title":254,"path":255,"stem":256,"icon":111},"What you can do with it","\u002Fen\u002Fmcp-server\u002Fuse-cases","en\u002F05.mcp-server\u002F03.use-cases",{"title":258,"path":259,"stem":260,"icon":261},"Tools","\u002Fen\u002Fmcp-server\u002Ftools","en\u002F05.mcp-server\u002F04.tools","i-hugeicons-wrench-01",{"title":263,"path":264,"stem":265,"icon":76},"Approving changes","\u002Fen\u002Fmcp-server\u002Fapproving-changes","en\u002F05.mcp-server\u002F05.approving-changes",{"title":267,"path":268,"stem":269,"icon":270},"Administration & security","\u002Fen\u002Fmcp-server\u002Fadmin-and-security","en\u002F05.mcp-server\u002F06.admin-and-security","i-hugeicons-shield-key",{"title":272,"icon":273,"path":274,"stem":275,"children":276,"page":30},"External sources","i-hugeicons-database-sync","\u002Fen\u002Fexternal-sources","en\u002F06.external-sources",[277,280,285,290,295,300,305],{"title":245,"path":278,"stem":279,"icon":273},"\u002Fen\u002Fexternal-sources\u002Foverview","en\u002F06.external-sources\u002F01.overview",{"title":281,"path":282,"stem":283,"icon":284},"SharePoint","\u002Fen\u002Fexternal-sources\u002Fsharepoint","en\u002F06.external-sources\u002F02.sharepoint","i-hugeicons-microsoft",{"title":286,"path":287,"stem":288,"icon":289},"OneDrive","\u002Fen\u002Fexternal-sources\u002Fonedrive","en\u002F06.external-sources\u002F03.onedrive","i-hugeicons-folder-cloud",{"title":291,"path":292,"stem":293,"icon":294},"Google Drive","\u002Fen\u002Fexternal-sources\u002Fgoogle-drive","en\u002F06.external-sources\u002F04.google-drive","i-hugeicons-google-drive",{"title":296,"path":297,"stem":298,"icon":299},"FTP \u002F SFTP","\u002Fen\u002Fexternal-sources\u002Fftp-sftp","en\u002F06.external-sources\u002F05.ftp-sftp","i-hugeicons-server-stack-01",{"title":301,"path":302,"stem":303,"icon":304},"REST interface","\u002Fen\u002Fexternal-sources\u002Frest","en\u002F06.external-sources\u002F06.rest","i-hugeicons-api",{"title":306,"path":307,"stem":308,"icon":309},"SOAP interface","\u002Fen\u002Fexternal-sources\u002Fsoap","en\u002F06.external-sources\u002F07.soap","i-hugeicons-source-code",{"title":311,"icon":304,"path":312,"stem":313,"children":314,"page":30},"Integration API","\u002Fen\u002Fintegration-api","en\u002F07.integration-api",[315,318,322,327,332,337,341,346,350,354,359,364],{"title":245,"path":316,"stem":317,"icon":14},"\u002Fen\u002Fintegration-api\u002Foverview","en\u002F07.integration-api\u002F01.overview",{"title":319,"path":320,"stem":321,"icon":19},"Authentication","\u002Fen\u002Fintegration-api\u002Fauthentication","en\u002F07.integration-api\u002F02.authentication",{"title":323,"path":324,"stem":325,"icon":326},"Conventions","\u002Fen\u002Fintegration-api\u002Fconventions","en\u002F07.integration-api\u002F03.conventions","i-hugeicons-book-open-01",{"title":328,"path":329,"stem":330,"icon":331},"Pushing documents","\u002Fen\u002Fintegration-api\u002Fpushing-documents","en\u002F07.integration-api\u002F04.pushing-documents","i-hugeicons-upload-02",{"title":333,"path":334,"stem":335,"icon":336},"Consuming content","\u002Fen\u002Fintegration-api\u002Fconsuming-content","en\u002F07.integration-api\u002F05.consuming-content","i-hugeicons-download-02",{"title":338,"path":339,"stem":340,"icon":137},"Reference: documents","\u002Fen\u002Fintegration-api\u002Freference-documents","en\u002F07.integration-api\u002F06.reference-documents",{"title":342,"path":343,"stem":344,"icon":345},"Reference: categories, tags, markets","\u002Fen\u002Fintegration-api\u002Freference-categories-tags","en\u002F07.integration-api\u002F07.reference-categories-tags","i-hugeicons-folder-01",{"title":347,"path":348,"stem":349,"icon":211},"Reference: sync manifest","\u002Fen\u002Fintegration-api\u002Freference-sync","en\u002F07.integration-api\u002F08.reference-sync",{"title":351,"path":352,"stem":353,"icon":309},"OpenAPI","\u002Fen\u002Fintegration-api\u002Fopenapi","en\u002F07.integration-api\u002F09.openapi",{"title":355,"path":356,"stem":357,"icon":358},"Changelog","\u002Fen\u002Fintegration-api\u002Fchangelog","en\u002F07.integration-api\u002F10.changelog","i-hugeicons-time-schedule",{"title":360,"path":361,"stem":362,"icon":363},"Reference: groups, markets, access","\u002Fen\u002Fintegration-api\u002Freference-groups-access","en\u002F07.integration-api\u002F11.reference-groups-access","i-hugeicons-user-lock-01",{"title":365,"path":366,"stem":367,"icon":368},"Moving from CMWS","\u002Fen\u002Fintegration-api\u002Fcmws","en\u002F07.integration-api\u002F12.cmws","i-hugeicons-arrow-reload-horizontal",{"title":370,"icon":371,"path":372,"stem":373,"children":374,"page":30},"What's new","i-hugeicons-gift","\u002Fen\u002Fwhats-new","en\u002F08.whats-new",[375],{"title":355,"path":376,"stem":377,"icon":358},"\u002Fen\u002Fwhats-new\u002Fchangelog","en\u002F08.whats-new\u002F01.changelog",{"title":379,"icon":299,"path":380,"stem":381,"children":382,"page":30},"Self-hosting","\u002Fen\u002Fself-hosting","en\u002F09.self-hosting",[383,386,390,395,399,404,408,413,418,422],{"title":245,"path":384,"stem":385,"icon":14},"\u002Fen\u002Fself-hosting\u002Foverview","en\u002F09.self-hosting\u002F01.overview",{"title":387,"path":388,"stem":389,"icon":106},"Docker Compose","\u002Fen\u002Fself-hosting\u002Fdocker-compose","en\u002F09.self-hosting\u002F02.docker-compose",{"title":391,"path":392,"stem":393,"icon":394},"Kubernetes","\u002Fen\u002Fself-hosting\u002Fkubernetes","en\u002F09.self-hosting\u002F03.kubernetes","i-hugeicons-cloud",{"title":396,"path":397,"stem":398,"icon":101},"Configuration","\u002Fen\u002Fself-hosting\u002Fconfiguration","en\u002F09.self-hosting\u002F04.configuration",{"title":400,"path":401,"stem":402,"icon":403},"Licence","\u002Fen\u002Fself-hosting\u002Flicence","en\u002F09.self-hosting\u002F05.licence","i-hugeicons-license",{"title":405,"path":406,"stem":407,"icon":211},"Updates","\u002Fen\u002Fself-hosting\u002Fupdates","en\u002F09.self-hosting\u002F06.updates",{"title":409,"path":410,"stem":411,"icon":412},"Postgres","\u002Fen\u002Fself-hosting\u002Fpostgres","en\u002F09.self-hosting\u002F07.postgres","i-hugeicons-database",{"title":414,"path":415,"stem":416,"icon":417},"Backups","\u002Fen\u002Fself-hosting\u002Fbackups","en\u002F09.self-hosting\u002F08.backups","i-hugeicons-database-restore",{"title":419,"path":420,"stem":421,"icon":261},"Troubleshooting","\u002Fen\u002Fself-hosting\u002Ftroubleshooting","en\u002F09.self-hosting\u002F09.troubleshooting",{"title":423,"path":424,"stem":425,"icon":426},"Firewall","\u002Fen\u002Fself-hosting\u002Ffirewall","en\u002F09.self-hosting\u002F10.firewall","i-hugeicons-firewall",{"id":428,"title":213,"body":429,"description":1311,"extension":1312,"links":1313,"meta":1314,"navigation":1315,"path":214,"seo":1316,"stem":215,"__hash__":1317},"docs_en\u002Fen\u002F04.sign-in-and-directories\u002F05.microsoft-entra-id.md",{"type":430,"value":431,"toc":1292},"minimark",[432,441,454,465,470,575,579,607,617,621,657,674,698,702,713,796,813,827,831,856,862,866,869,921,927,931,938,966,972,976,979,1081,1087,1091,1263,1267],[433,434,435,436,440],"p",{},"With Entra ID (formerly ",[437,438,439],"strong",{},"Azure Active Directory","), your people sign in with the Microsoft account they use for Outlook and Teams – including your multi-factor authentication and conditional access policies.",[433,442,443,444,447,448,450,451,453],{},"You register DDM ",[437,445,446],{},"in your own Entra tenant"," and enter the result in DDM under ",[437,449,98],{}," › ",[437,452,199],{},". Nobody else is involved, and no other company's tenant can sign in to your organisation.",[433,455,456,457,460,461,464],{},"You need an account that may register applications in Entra ID – e.g. ",[437,458,459],{},"Application Developer"," or ",[437,462,463],{},"Cloud Application Administrator"," – and, for the consent in step 3, an administrator.",[466,467,469],"h2",{"id":468},"_1-register-ddm","1. Register DDM",[471,472,474,479,500,504,527,531,545,555,559],"steps",{"level":473},"3",[475,476,478],"h3",{"id":477},"open-the-app-registrations","Open the app registrations",[433,480,481,482,489,490,450,493,450,496,499],{},"In the ",[483,484,488],"a",{"href":485,"rel":486},"https:\u002F\u002Fentra.microsoft.com",[487],"nofollow","Microsoft Entra admin center",", go to ",[437,491,492],{},"Entra ID",[437,494,495],{},"App registrations",[437,497,498],{},"New registration",".",[475,501,503],{"id":502},"name-and-account-types","Name and account types",[505,506,507,519],"ul",{},[508,509,510,513,514,518],"li",{},[437,511,512],{},"Name:"," ",[515,516,517],"code",{},"DDM"," – your people may see it when they sign in for the first time.",[508,520,521,513,524,499],{},[437,522,523],{},"Supported account types:",[437,525,526],{},"Accounts in this organizational directory only (Single tenant)",[475,528,530],{"id":529},"redirect-uri","Redirect URI",[433,532,533,534,537,538,450,540,450,542,544],{},"Platform ",[437,535,536],{},"Web",". Copy the address from DDM, ",[437,539,98],{},[437,541,199],{},[437,543,530],{}," – it looks like:",[546,547,553],"pre",{"className":548,"code":550,"language":551,"meta":552},[549],"language-text","https:\u002F\u002Fcms.documentdistributionmanager.com\u002Fapi\u002Fauth\u002Fsso\u002Fcallback\n","text","",[515,554,550],{"__ignoreMap":552},[475,556,558],{"id":557},"register","Register",[433,560,561,562,564,565,567,568,571,572,499],{},"Click ",[437,563,558],{},". On the ",[437,566,245],{}," page, note two values: the ",[437,569,570],{},"Application (client) ID"," and the ",[437,573,574],{},"Directory (tenant) ID",[466,576,578],{"id":577},"_2-create-a-client-secret","2. Create a client secret",[580,581,582,594,600],"ol",{},[508,583,584,585,450,588,450,591,499],{},"Open ",[437,586,587],{},"Certificates & secrets",[437,589,590],{},"Client secrets",[437,592,593],{},"New client secret",[508,595,596,597,599],{},"Enter a description (e.g. ",[515,598,517],{},") and choose how long it is valid – at most 24 months.",[508,601,602,603,606],{},"Copy the ",[437,604,605],{},"Value"," straight away. It is shown only once.",[608,609,602,610,612,613,616],"warning",{},[437,611,605],{},", not the ",[437,614,615],{},"Secret ID",". And put the expiry date in your calendar: when the secret expires, nobody can sign in with Entra ID until you create a new one and enter it in DDM.",[466,618,620],{"id":619},"_3-permissions-and-the-e-mail-claim","3. Permissions and the e-mail claim",[433,622,623,626,627,630,631,634,635,638,639,642,643,450,646,450,649,652,653,656],{},[437,624,625],{},"API permissions"," – the app needs the delegated Microsoft Graph permissions ",[515,628,629],{},"openid",", ",[515,632,633],{},"email"," and ",[515,636,637],{},"profile"," (",[515,640,641],{},"User.Read"," is already there and may stay). Click ",[437,644,645],{},"Add a permission",[437,647,648],{},"Microsoft Graph",[437,650,651],{},"Delegated permissions",", tick the three, then ",[437,654,655],{},"Grant admin consent for …"," – so your people are not asked themselves.",[433,658,659,662,663,666,667,670,671,673],{},[437,660,661],{},"Token configuration"," – click ",[437,664,665],{},"Add optional claim",", token type ",[437,668,669],{},"ID",", and tick ",[515,672,633],{},". Entra ID then puts your people's e-mail address into the sign-in, which DDM matches against your domains.",[675,676,677,678,681,682,685,686,689,690,693,694,697],"note",{},"The address comes from the ",[437,679,680],{},"Email"," field of the user in Entra ID (the ",[515,683,684],{},"mail"," attribute). If your users have no mailbox and the field is empty, but their sign-in name (",[515,687,688],{},"anna@company.com",") is their e-mail address, enter ",[515,691,692],{},"preferred_username"," as the ",[437,695,696],{},"E-mail claim"," in DDM instead.",[466,699,701],{"id":700},"_4-enter-it-in-ddm","4. Enter it in DDM",[433,703,704,705,450,707,450,709,712],{},"Under ",[437,706,98],{},[437,708,199],{},[437,710,711],{},"Identity provider",":",[714,715,716,728],"table",{},[717,718,719],"thead",{},[720,721,722,726],"tr",{},[723,724,725],"th",{},"Field",[723,727,605],{},[729,730,731,746,758,770,782],"tbody",{},[720,732,733,739],{},[734,735,736],"td",{},[437,737,738],{},"Button label",[734,740,741,742,745],{},"e.g. ",[515,743,744],{},"Microsoft"," or your company's name",[720,747,748,753],{},[734,749,750],{},[437,751,752],{},"Issuer",[734,754,755],{},[515,756,757],{},"https:\u002F\u002Flogin.microsoftonline.com\u002F\u003CDirectory (tenant) ID>\u002Fv2.0",[720,759,760,765],{},[734,761,762],{},[437,763,764],{},"Client ID",[734,766,767,768],{},"the ",[437,769,570],{},[720,771,772,777],{},[734,773,774],{},[437,775,776],{},"Client secret",[734,778,779,780],{},"the secret's ",[437,781,605],{},[720,783,784,788],{},[734,785,786],{},[437,787,696],{},[734,789,790,792,793,795],{},[515,791,633],{}," (or ",[515,794,692],{},", see the note above)",[433,797,561,798,801,802,805,806,809,810,499],{},[437,799,800],{},"Save",", then ",[437,803,804],{},"Test connection",", and switch on ",[437,807,808],{},"Single sign-on active"," – see ",[483,811,199],{"href":812},"\u002Fen\u002Fsign-in-and-directories\u002Fsingle-sign-on#_4-switch-it-on",[608,814,815,816,819,820,460,823,826],{},"Use the issuer ",[437,817,818],{},"with your tenant ID",". The shared address with ",[515,821,822],{},"common",[515,824,825],{},"organizations"," is refused – it would accept accounts from any Microsoft tenant.",[466,828,830],{"id":829},"_5-optional-only-certain-people","5. Optional: only certain people",[433,832,833,834,450,836,450,839,450,841,844,845,848,849,852,853,499],{},"By default, everybody in your tenant may use the app. To limit it to certain people or groups, go to ",[437,835,492],{},[437,837,838],{},"Enterprise applications",[515,840,517],{},[437,842,843],{},"Properties",", set ",[437,846,847],{},"Assignment required?"," to ",[437,850,851],{},"Yes",", and add the people or groups under ",[437,854,855],{},"Users and groups",[433,857,858,859,499],{},"That is a second gate in front of DDM's own: whether somebody gets in at all is still decided by your confirmed domains and ",[437,860,861],{},"Create accounts on first sign-in",[466,863,865],{"id":864},"_6-map-groups","6. Map groups",[433,867,868],{},"To have DDM put people into groups by their Entra ID groups:",[580,870,871,879,897],{},[508,872,873,874,450,876,499],{},"In the app registration, open ",[437,875,661],{},[437,877,878],{},"Add groups claim",[508,880,881,882,792,885,888,889,450,891,893,894,499],{},"Tick ",[437,883,884],{},"Security groups",[437,886,887],{},"Groups assigned to the application",", if you assign groups under ",[437,890,838],{},[437,892,855],{}," – recommended, it keeps the token small). Leave the ID token's format at ",[437,895,896],{},"Group ID",[508,898,899,900,903,904,693,907,910,911,914,915,917,918,920],{},"In DDM, under ",[437,901,902],{},"Groups",", enter ",[515,905,906],{},"groups",[437,908,909],{},"Group claim"," and add a mapping for each group: the group's ",[437,912,913],{},"Object ID"," – in Entra ID under ",[437,916,902],{}," › the group › ",[437,919,245],{}," – and the DDM group.",[675,922,923,924,926],{},"Entra ID sends at most 200 groups in a token. For somebody in more groups it sends only a reference, and DDM then leaves their groups as they are. ",[437,925,887],{}," avoids that.",[466,928,930],{"id":929},"_7-optional-bring-the-calendar-along","7. Optional: bring the calendar along",[433,932,933,934,937],{},"With ",[437,935,936],{},"Connect the calendar at sign-in"," (OpenID Connect only), the sign-in also asks for the calendar, and the Outlook calendar is connected in DDM as soon as somebody signs in:",[580,939,940,960],{},[508,941,942,943,450,945,450,947,949,950,634,953,634,956,959],{},"In Entra ID, under ",[437,944,625],{},[437,946,648],{},[437,948,651],{},", add ",[515,951,952],{},"Calendars.ReadWrite",[515,954,955],{},"offline_access",[437,957,958],{},"Grant admin consent"," – otherwise Microsoft asks every person once.",[508,961,962,963,965],{},"In DDM, switch on ",[437,964,936],{}," for the Microsoft sign-in.",[433,967,968,969,971],{},"Anybody already signed in gets the calendar at their next sign-in. ",[483,970,235],{"href":236}," comes first: if it already connects the calendar, that stays. This does not work with SAML – SAML brings no tokens.",[466,973,975],{"id":974},"with-saml-instead","With SAML instead",[433,977,978],{},"Entra ID can also connect DDM by SAML – for example if your security team requires it.",[580,980,981,994,1016,1034,1059,1076],{},[508,982,704,983,450,985,987,988,634,990,993],{},[437,984,98],{},[437,986,199],{},", add a provider with ",[437,989,213],{},[437,991,992],{},"SAML 2.0",". DDM shows three values for it.",[508,995,481,996,489,999,450,1001,450,1003,450,1006,1009,1010,1012,1013,499],{},[483,997,488],{"href":485,"rel":998},[487],[437,1000,492],{},[437,1002,838],{},[437,1004,1005],{},"New application",[437,1007,1008],{},"Create your own application",", name it ",[515,1011,517],{}," and choose ",[437,1014,1015],{},"Integrate any other application you don't find in the gallery (Non-gallery)",[508,1017,584,1018,450,1020,1023,1024,1027,1028,634,1031,499],{},[437,1019,199],{},[437,1021,1022],{},"SAML",". Under ",[437,1025,1026],{},"Basic SAML Configuration",", enter DDM's ",[437,1029,1030],{},"Identifier (Entity ID)",[437,1032,1033],{},"Reply URL (ACS URL)",[508,1035,704,1036,1039,1040,1043,1044,1047,1048,1051,1052,1055,1056,1058],{},[437,1037,1038],{},"Attributes & Claims",", the e-mail address is sent by default as ",[515,1041,1042],{},"http:\u002F\u002Fschemas.xmlsoap.org\u002Fws\u002F2005\u002F05\u002Fidentity\u002Fclaims\u002Femailaddress"," – exactly what DDM suggests as the ",[437,1045,1046],{},"E-mail attribute",". For groups, click ",[437,1049,1050],{},"Add a group claim","; they arrive as ",[515,1053,1054],{},"http:\u002F\u002Fschemas.microsoft.com\u002Fws\u002F2008\u002F06\u002Fidentity\u002Fclaims\u002Fgroups"," – enter that as the ",[437,1057,909],{}," in DDM.",[508,1060,704,1061,1064,1065,1068,1069,450,1072,1075],{},[437,1062,1063],{},"SAML Certificates",", copy the ",[437,1066,1067],{},"App Federation Metadata Url"," and enter it in DDM under ",[437,1070,1071],{},"Your provider's metadata",[437,1073,1074],{},"Metadata URL",". Save.",[508,1077,1078,1079,499],{},"Assign the people or groups who may use DDM under ",[437,1080,855],{},[433,1082,1083,1084,1058],{},"When the certificate approaches its expiry, Entra ID creates a new one; activate it there, then click ",[437,1085,1086],{},"Reload metadata",[466,1088,1090],{"id":1089},"common-errors","Common errors",[714,1092,1093,1106],{},[717,1094,1095],{},[720,1096,1097,1100,1103],{},[723,1098,1099],{},"Message",[723,1101,1102],{},"Cause",[723,1104,1105],{},"Solution",[729,1107,1108,1130,1152,1169,1185,1201,1221,1243],{},[720,1109,1110,1116,1119],{},[734,1111,1112,1115],{},[515,1113,1114],{},"AADSTS50011"," – redirect URI does not match",[734,1117,1118],{},"The redirect URI in Entra ID differs from the one DDM shows",[734,1120,1121,1122,1125,1126,1129],{},"Copy it from DDM again – watch for ",[515,1123,1124],{},"http","\u002F",[515,1127,1128],{},"https"," and a trailing slash.",[720,1131,1132,1138,1147],{},[734,1133,1134,1137],{},[515,1135,1136],{},"AADSTS7000215"," – invalid client secret",[734,1139,1140,1141,1143,1144,1146],{},"The ",[437,1142,615],{}," was entered instead of the ",[437,1145,605],{},", or the secret has expired",[734,1148,1149,1150,1058],{},"Create a new secret and enter its ",[437,1151,605],{},[720,1153,1154,1160,1163],{},[734,1155,1156,1159],{},[515,1157,1158],{},"AADSTS700016"," – application not found in the directory",[734,1161,1162],{},"Client ID and tenant ID do not belong together",[734,1164,1165,1166,1168],{},"Compare both with the app's ",[437,1167,245],{}," page.",[720,1170,1171,1177,1182],{},[734,1172,1173,1176],{},[515,1174,1175],{},"AADSTS50105"," – not assigned to the application",[734,1178,1179,1181],{},[437,1180,847],{}," is on and the person is not assigned",[734,1183,1184],{},"Assign the person or their group.",[720,1186,1187,1192,1195],{},[734,1188,1189],{},[437,1190,1191],{},"Need admin approval",[734,1193,1194],{},"Admin consent was not granted",[734,1196,1197,450,1199,499],{},[437,1198,625],{},[437,1200,655],{},[720,1202,1203,1209,1215],{},[734,1204,1205,1208],{},[437,1206,1207],{},"The document belongs to another issuer"," (in DDM, on saving)",[734,1210,1211,1212,1214],{},"The issuer contains ",[515,1213,822],{}," or a wrong tenant ID",[734,1216,1217,1218,499],{},"Use ",[515,1219,1220],{},"https:\u002F\u002Flogin.microsoftonline.com\u002F\u003Ctenant ID>\u002Fv2.0",[720,1222,1223,1228,1234],{},[734,1224,1225],{},[437,1226,1227],{},"Your e-mail address is not on one of your organisation's confirmed domains",[734,1229,1230,1231],{},"Entra ID sent no address or one on another domain – often ",[515,1232,1233],{},"…@company.onmicrosoft.com",[734,1235,1236,1237,1239,1240,1242],{},"Add the optional claim ",[515,1238,633],{}," and fill in the users' ",[437,1241,680],{},"; or confirm the domain in DDM.",[720,1244,1245,1250,1253],{},[734,1246,1247],{},[437,1248,1249],{},"Single sign-on did not work",[734,1251,1252],{},"Usually no e-mail address in the sign-in",[734,1254,1255,1256,1258,1259,693,1261,499],{},"As above: optional claim ",[515,1257,633],{},", or ",[515,1260,692],{},[437,1262,696],{},[466,1264,1266],{"id":1265},"microsoft-sign-in-for-the-whole-installation","Microsoft sign-in for the whole installation",[433,1268,1269,1270,1273,1274,630,1277,630,1280,1283,1284,1287,1288,1291],{},"Independently of the above, whoever runs a DDM installation can offer ",[437,1271,1272],{},"Sign in with Entra ID"," to every organisation on it – with one app registration for all of them, set up on the server (",[515,1275,1276],{},"MICROSOFT_CLIENT_ID",[515,1278,1279],{},"MICROSOFT_CLIENT_SECRET",[515,1281,1282],{},"NUXT_PUBLIC_SSO_PROVIDERS=\"microsoft\"",", redirect URI ",[515,1285,1286],{},"\u003CBETTER_AUTH_URL>\u002Fapi\u002Fauth\u002Fcallback\u002Fmicrosoft",", a ",[437,1289,1290],{},"multitenant"," registration). It does not create accounts and is the same for everybody; an organisation that wants its own tenant, its own rules or Okta uses single sign-on as described above.",{"title":552,"searchDepth":1293,"depth":1293,"links":1294},2,[1295,1302,1303,1304,1305,1306,1307,1308,1309,1310],{"id":468,"depth":1293,"text":469,"children":1296},[1297,1299,1300,1301],{"id":477,"depth":1298,"text":478},3,{"id":502,"depth":1298,"text":503},{"id":529,"depth":1298,"text":530},{"id":557,"depth":1298,"text":558},{"id":577,"depth":1293,"text":578},{"id":619,"depth":1293,"text":620},{"id":700,"depth":1293,"text":701},{"id":829,"depth":1293,"text":830},{"id":864,"depth":1293,"text":865},{"id":929,"depth":1293,"text":930},{"id":974,"depth":1293,"text":975},{"id":1089,"depth":1293,"text":1090},{"id":1265,"depth":1293,"text":1266},"Connect your organisation's Entra ID (formerly Azure AD) – register DDM in your own tenant and enter it in DDM.","md",null,{},{"icon":216},{"title":213,"description":1311},"IVg8RPp18Pz50bNB_YAA-Kg0KxMlPfWgbzmmaTIC-vI",[1319,1321],{"title":208,"path":209,"stem":210,"description":1320,"icon":211,"children":-1},"When DDM synchronises with the directory, what it changes and what it never does, how the company password works – and what to do when something goes wrong.",{"title":218,"path":219,"stem":220,"description":1322,"icon":221,"children":-1},"Connect your organisation's Okta – create an OpenID Connect app integration and enter it in DDM.",1793617719425]