Authentication using Microsoft Entra ID is designed to enhance security and simplify the login process for CDESK. You can connect CDESK to Microsoft Entra ID in under 15 minutes. To use this feature, you must have your own CDESK / CM Server domain.
You can configure authentication either for users from your MS Entra tenant only (single-tenant) or for external users from other tenants (multi-tenant). Login for external users (multi-tenant) is supported starting with CDESK version 3.2.6.
For authentication to work, the organization must have an Office 365 tenant with user accounts set up. The accounts do not need to have an Office 365 license. For verification, it is sufficient for the user to have a valid email address registered in the tenant that they actually use (for the activation link). This address does not have to be part of Office 365; it can also be an external email service. In that case, however, the domain of this service must be configured in the Office 365 environment, which you should coordinate with your IT department.
The procedure for setting up the connection is described below.
Adding the MS Entra ID Authentication API connector in CDESK
The first step in setting up the connection is to add the MS Entra ID Authentication API connector in CDESK. Go to CDESK → Global settings → Connectors, API. A list of connectors and APIs currently configured on your CDESK Server will open. To add the MS Entra ID connector, click the “+ Add connector” button, located in the upper-right corner.
Clicking this will open a new window where you can select the connector type. Select the Microsoft Entra ID Authentication option, then click the Continue button.
A form for configuring the MS Entra ID connector will then open. Fields marked with the symbol • are required. Description of individual fields:
Connector type • – The connector you selected in the previous step is automatically pre-filled.
Title• – The name under which the connector will appear in the list of connectors.
Enabled – Enables or disables the connector. If you do not want to use the connector, turn this switch off.
More detailed logging – Used in case of authentication issues. Enable only after consulting with a CDESK support representative.
Application (client) ID• – You can find this value in the MS Entra ID settings. The procedure is described below in the section Connecting the CDESK environment to an MS Entra ID tenant.
Secret value • – You can find this value in the MS Entra ID settings. The procedure is described below in the section Linking the CDESK environment with the MS Entra ID tenant.
Directory (tenant) ID • – You can find this value in the MS Entra ID settings. The procedure is described below in the section Linking the CDESK environment with the MS Entra ID tenant. Required only for single-tenant configurations.
Multi-Tenant – Enable if you want to authenticate users from other Office 365 tenant environments. Setup instructions are provided in the documentation section Authentication via MS Entra ID Multi-Tenant.
Redirect URI – an address automatically generated by CDESK. Used during registration of the MS Entra ID connector. Specifies the address that will be accessed via MS Entra ID after successful authorization. You will enter this address into the registered application in MS Entra ID.
Automatic login from the login screen (True SSO) – If enabled, the user will be logged in immediately after entering the CDESK / CM Portal address without having to click the Office 365 / Entra ID button.
Allow new customer accounts to be created in CDESK – If enabled, users from allowed domains who do not yet have a CDESK account will be able to create a user account after successful authentication via MS Entra ID. The setup for this feature is described in the article Creating customer accounts using MS Entra ID.
Registering the CDESK app in Microsoft Entra ID
To obtain the Application (client) ID and the Secret value, you must register CDESK in Microsoft Azure AD. Go to office.com and sign in with an Office 365 account that has permissions to administer Microsoft Azure AD. In the list of applications on the left side of the window, locate the Admin application.
Clicking this will open the administrator’s home screen. In the menu on the left, select Show all. In the expanded menu, click Identity. Once the application has loaded, an overview will appear; in the left menu, select App registrations.
A new window will open. Then select the + New registration option to register a new application.
Clicking this opens a window for registering a new application with the following fields:
Name – a text field for entering the name under which the registration will appear in the list of registered connections.
Supported account types – a setting to determine whether authorization will also be performed for other tenants. If you are using an account registered under your company, select the option “s accounts in this organizational directory only” (your company only – Single tenant). If you have an Office 365 account created under a different company, select the option “s Accounts in any organizational directory (Any Microsoft Entra ID tenant – Multitenant).”
Redirect URI – select the option “Web” and copy the Redirect URI from the MS Entra ID API connector settings in CDESK into the text field (see the following image).
To register the application, click the Register button located in the lower-left corner below the list.
Integrating the CDESK environment with an MS Entra ID tenant
After registering the application, you will be redirected to the Overview section, where the registration details will be available. Copy the following information into the form for configuring the API connector for MS Entra ID in CDESK: Application (client) ID and Directory (tenant) ID (only for single-tenant).
To complete the connector configuration, you must also enter the Secret value. Go to the Certificates & secrets section located in the left-hand menu. Click the +New client secret button and select the code’s expiration period. We recommend two years. You can enter a description in the Description field. To generate the code, click the Add button.
After clicking the button, the generated code will appear in the Client secrets list. Click Copy to clipboard, go to CDESK, and paste it into the Secret value field in the MS Entra ID connector form.
Once all the necessary information has been entered into the form, save your settings by clicking the Create button in the lower right corner.
Linking a CDESK user account with Microsoft Entra ID
Go to Users and groups → Users. In the list, open the user account you want to link, and on the General settings tab scroll down.
After completing the configuration of the MS Entra ID connector, the Logging in via MS Entra ID – use the contact email toggle is enabled by default in all accounts, meaning the configured contact email will be used for authentication.
However, if you need to use a different email address, turn off the toggle and enter the desired email address in the Entra ID account e-mail for sync field. In both cases, the email address used must be the one the user has in MS Entra ID. Save the settings by clicking the Save button in the lower-right corner.
Sign in to CDESK using Microsoft Entra ID
After configuring the MS Entra ID connector, a button for logging in with Microsoft Entra ID will appear on the CDESK login screen.
Clicking this button will redirect you to the Office 365 login page, where you will authenticate using your login credentials. If you are already logged in to your browser, authentication will occur automatically, and you will be immediately redirected to CDESK without needing to re-enter your login credentials.
Granting app permissions upon first login
If you have registered a new app in this way, users will be prompted to grant permissions to the app when they log in for the first time. The administrator of each tenant from which users will log in can check the box “Consent on behalf of your organization” () during the first login, thereby granting Admin Consent for the entire organization. This ensures that the application will work for that tenant without further consent prompts for other users in the organization. Without the administrator’s consent, each user will have to grant these permissions themselves.
You can also grant Admin Consent via the Microsoft Entra ID portal, under Enterprise applications. Select the relevant application, go to Permissions, and click Grant admin consent for your company.
