Microsoft Entra sign-in lets your organization control authentication, domain restrictions, role mappings, and single sign-on behavior from one central identity system.
Before you start
- you need organization admin access in Divorcepath
- you need a Microsoft Entra admin who can complete the consent flow
- you should know which email domains are approved for your organization
- you should decide whether new users should receive a default role or require explicit group-based role mappings
- you should decide whether sign-in through Entra should be optional or enforced
Step 1: Open your organization’s Entra settings
In Divorcepath, open your organization’s Microsoft Entra settings and start the admin consent flow. Divorcepath will redirect the admin to Microsoft and return them to the organization’s Entra configuration screen once the process is complete.
Step 2: Complete Microsoft admin consent
Sign in with the Microsoft administrator account for the correct tenant and approve the requested permissions. The consent must be completed for the same tenant that was selected when the request began.
Step 3: Confirm tenant verification
After Microsoft returns the admin to Divorcepath, confirm that the tenant was verified successfully. If the tenant does not match the original request, Divorcepath will not finalize the connection.
Step 4: Configure allowed email domains
If your organization wants to limit access to specific work domains, add those domains to the Entra configuration. This helps prevent personal or unapproved accounts from being used for organizational access.
Step 5: Configure role behavior
Choose the default role new Entra users should receive, if any. If your organization wants tighter control, enable role mapping requirements and map Entra groups to Divorcepath roles before inviting broader usage.
Step 6: Decide whether to enforce SSO
When your setup is ready, you can enforce single sign-on so organization members authenticate through Microsoft Entra instead of using separate Divorcepath credentials.
What success looks like
- organization members can authenticate through the correct Microsoft tenant
- users from approved domains are accepted and unexpected domains are blocked
- new users receive the correct default role or mapped role
- if SSO is enforced, the organization signs in through Microsoft consistently
Common issues
- Invalid state: the consent flow was interrupted or restarted from a different session
- Tenant mismatch: Microsoft returned a tenant that does not match the original request
- Missing access after sign-in: the user’s domain is not in the allowlist, or the required role mapping has not been created
- Unexpected role assignment: review the default role and any Entra group mappings
When to contact support
If the consent flow completes but the tenant is not verified, or if users are authenticating successfully but not receiving the expected access, contact Divorcepath support at [email protected].
