Configure SSO | eConnect

With Single Sign-On (SSO), users can log in to the eConnect platform using their existing company account, without a separate password. The connection works via OpenID Connect and is most commonly used with Microsoft Azure AD (Entra ID). After configuration, users log in with their familiar Microsoft account and are automatically recognised by eConnect.

In brief: you register an app in Azure AD, enter the details on the eConnect platform and test the login. The entire process takes about 15 minutes if you have the right permissions.

What do you need?

An active Azure subscription with Azure AD (Entra ID)
Administrator rights on the Azure AD tenant
An eConnect account with the Administrator role (Administration > Users)
The IDP configuration option must be active on your account (contact eConnect if it is missing)

Configure Azure AD

Step 1: Register an app in Azure AD

Open Azure AD and go to App registrations. Click New registration and fill in the form:

Name: eConnect
Supported account types: choose the type that suits your organisation
Redirect URI's (Web):

Environment

URI's

Production

https://platform.econnect.eu/openid and https://identity.econnect.eu/signin-oidc

Pilot

https://pilot-platform.econnect.eu/openid and https://accp-identity.econnect.eu/signin-oidc

Click Register. Copy the Application (client) ID from the overview and save it.

Step 2: Create a client secret

Go to Certificates & secrets and click New client secret. Set the expiry to a maximum of 24 months. Copy the Value of the created secret immediately (it will not be visible later).

Step 3: Authentication settings

Go to Authentication and enable ID tokens under Implicit grant and hybrid flows. You can also add extra redirect URI's here if you want to connect both production and pilot.

Step 4: Set API permissions

Go to API permissions and click Add a permission:

Select Microsoft Graph
Choose Delegated permissions
Select the permissions: email, openid and profile
Click Add permissions

Note: Ask an Azure administrator to grant Admin consent for these permissions if this has not been done yet.

Step 5: Retrieve OpenID Connect metadata

Return to the app overview and click Endpoints. Copy the URL of the OpenID Connect metadata document. You will need this for the configuration in eConnect.

Configure the eConnect platform

Step 1: Open IDP configuration

Log in to the eConnect platform as an administrator. Go to Administration > IDP configuration. If this option is not available, eConnect needs to activate it for your account first.

Step 2: Add an IDP

Click the + button to add a new IDP. Select Microsoft as the type and accept the suggested settings.

Step 3: Fill in the details

Complete the following fields:

Field

Value

Name

For example Microsoft AD – [your organisation name]

Description

Short description of the connection

Discovery Document URL

The OpenID Connect metadata URL from Azure AD

OAuth Client ID

The Application (client) ID from Azure AD

OAuth Client SecretKey

The client secret you created

Note: OAuth Client ID and OAuth Client SecretKey are always the Application (client) ID and Secret Value from your own app registration in Azure AD (steps 1–2 above). Do you see an app or enterprise application in Azure named something like "eConnect external login" that you did not register yourself? That does not replace your own app registration: approving that app instead of entering your own Client ID/Secret will not work.

Click Fetch details to retrieve the configuration automatically from the metadata document. Then click Save.

Step 4: Test

Log out and test the SSO login. The login screen now shows the option to log in via Microsoft.

Do you want users to skip the standard login screen and be redirected directly via SSO? This is possible with a direct login URL. The URL has the following format:

https://platform.econnect.eu/login/{domain}/
https://pilot-platform.econnect.eu/login/{domain}/

Hosts: production platform.econnect.eu and pilot pilot-platform.econnect.eu. The path segment /login/ is required in the direct SSO deep link.

Via this link, users go directly to the Azure AD login page without seeing the eConnect login screen. This direct login URL is available by default once the IDP configuration is set up — you do not need to request it separately from Support. Only for a custom subdomain or other custom setup should you contact eConnect.

Note: a URL without /login/ (for example https://pilot-platform.econnect.eu/{domain}/) does not trigger an automatic SSO redirect. Host + domain slug alone is not sufficient.

Tip: The direct login URL is ideal for placing on your company intranet or in a bookmark bar, so that employees can access the eConnect platform with a single click.

Synchronise on-premise AD

Are you using an on-premise Active Directory? Azure AD supports synchronisation via Azure AD Connect, so your existing users become automatically available in Azure AD. Read more on the Microsoft documentation on directory integration.

Frequently asked questions

Can I combine SSO with regular logins?

Yes. After adding an IDP, the standard eConnect login remains available. On the login screen, users choose whether to log in with their Microsoft account or with an eConnect password. If you want only SSO login to be possible (IdP restriction), contact eConnect.

Does SSO also work with other identity providers?

The eConnect platform supports any OpenID Connect-compatible identity provider. The most commonly used is Azure AD, but Google Workspace and Apple ID are also supported as standard login methods. Contact eConnect to connect a different provider.

What if my Azure AD tenant uses a different domain?

That does not matter. The connection works based on the OpenID Connect metadata URL and does not depend on a specific domain name. As long as the redirect URI's are configured correctly, SSO login works.

Want eConnect to set up SSO for you? Contact our support team.