Microsoft sign-in

What you’ll do: switch on single sign-on with Microsoft Entra ID, prove you own your email domain, and optionally sync people from Entra ID.

Who can do this: org admins, with your IT team, who need admin access to your Microsoft Entra tenant.

You need a Microsoft Entra ID (Azure AD) tenant and an app registration in it. The same card works for Okta and Google Workspace.

Steps

In Dexta Hub, open Organisation and the Sign-in and security tab.
On Single sign-on (OIDC), tick Enabled and fill in the Provider display name (for example, Microsoft), your Corporate email domain, the Issuer URL, the Client ID and the Client secret from your Entra app registration.
Give your IT team the redirect address shown on the card to add to the app registration. Click Save.
Under Prove you own your domain, add the TXT record shown (use Copy) to your domain’s DNS, then click Check now.
People with that email domain now see Continue with Microsoft on the sign-in page.
If you want only Microsoft sign-in, tick Single sign-on only: nobody signs in with a Dexta password, choose one or two break-glass org admins who keep a password, and click Save single sign-on only.

On the Microsoft Entra ID sync card, open How to set this up in Entra ID (about 10 minutes) and follow it. The app registration needs the Graph permissions User.Read.All and GroupMember.Read.All, with admin consent.
Fill in the Directory (tenant) ID, Application (client) ID and Client secret (its Value). Click Save, then Test connection.
Click Preview sync to see who would be added or changed, then Sync now. Tick Enabled (sync by itself once a day) to keep it running.

You can choose to switch off people who are removed or disabled in Entra ID, and to bring in only people in certain groups.
An office Active Directory can sync too, from the Active Directory sync card on the same tab.
Keep at least one break-glass admin, for the day single sign-on doesn’t work.