Frill
Single Sign-On (SSO)

Configuring Microsoft Entra ID SSO

Connect Microsoft Entra ID (formerly Azure AD) to Frill using OpenID Connect (OIDC) authentication. Team members can sign in to Frill using their Microsoft work accounts.

You'll need admin access to both Microsoft Entra ID and Frill (company admin role) to complete this setup.

Step 1: Register an app in Entra ID

  1. Sign in to the Azure Portal

  2. Go to Microsoft Entra ID → App registrations

  3. Click New registration

  4. Enter a name (e.g., "Frill SSO")

  5. Under Supported account types, choose Accounts in this organizational directory only

  6. Leave Redirect URI blank for now—you'll add it in the next step

  7. Click Register

Step 2: Copy IDs from Entra ID

After registration, you'll see the app overview page. Copy these values:

  • Application (client) ID

  • Directory (tenant) ID

Step 3: Create a client secret

  1. In your Entra ID app, go to Certificates & secrets

  2. Click New client secret

  3. Add a description (e.g., "Frill integration") and set an expiration

  4. Click Add

  5. Copy the Value immediately—it won't be shown again

Save the client secret value now. You can't retrieve it later. If lost, you'll need to create a new secret.

Step 4: Configure Frill SSO settings

  1. In Frill, go to Settings → Single Sign-On

  2. Select Microsoft Entra ID as your provider

  3. Enter the values from Entra ID:

    • Client ID: Your Application (client) ID

    • Client Secret: The secret value you copied

    • Tenant ID: Your Directory (tenant) ID

  4. Click Save

  5. Copy the Redirect URI displayed in Frill's SSO settings

Step 5: Add redirect URI in Entra ID

  1. Return to your Entra ID app registration

  2. Go to Authentication

  3. Click Add a platform → Web

  4. Paste the Redirect URI from Frill

  5. Under Implicit grant and hybrid flows, check ID tokens

  6. Click Configure, then Save

Step 6: Test the connection

  1. Open a private/incognito browser window

  2. Go to your Frill login page

  3. Click the Microsoft Entra ID SSO option

  4. Sign in with a Microsoft work account

  5. Confirm you're successfully redirected to Frill

Once SSO is working, you can disable password-based logins in Frill to enforce Microsoft authentication for all team members.

Additional settings

Expand Additional settings on the Microsoft Entra ID setup page to configure options shared across SSO providers.

  • Logout redirect URL — Users are redirected here after logging out of Frill.

  • Email/password login options — Choose whether people can still sign in with email and password as well as SSO: No, SSO only, Yes, have both, or SSO for team only. Frill shows a team login link when SSO for team only is selected.

  • SSO secret key — Sign Frill JWTs with this key to identify users in the Frill Script.

  • Sync user profiles — When on, Frill updates each existing user's name and avatar from the SSO token on sign-in and overwrites profile changes made in Frill. When off, Frill leaves existing names unchanged and only fills in a missing avatar when SSO provides one.

Microsoft's User.Read permission includes access to profile photos. This permission is granted by default when users first sign in via SSO.

Troubleshooting

If SSO isn't working:

  • Verify the Redirect URI in Entra ID exactly matches the one shown in Frill

  • Confirm ID tokens are enabled in Entra ID's Authentication settings

  • Check that the client secret hasn't expired

  • Ensure users exist in the same Entra ID tenant

For additional help, see Frill's SSO developer documentation.

Was this helpful?
Was this helpful?