/

Sign in with Microsoft (single sign-on)

Let your team sign in with their Microsoft 365 accounts, and optionally require it.

With single sign-on, people choose Sign in with Microsoft on the sign-in page and use their Microsoft 365 (Entra ID) account. Microsoft checks their password and multi-factor authentication, so your Conditional Access policies apply to Knowpoint too.

Set it up in Admin → Single sign-on. You need the Manage users, roles and teams permission.

1. Choose the app

  • Use the Knowpoint app (when offered): nothing to register. The first time someone signs in, a Microsoft admin in your organization approves it.
  • Use your own app registration: full control in your Entra admin center.
    1. In the Entra admin center, go to App registrations → New registration.
    2. Name it Knowpoint and choose Accounts in this organizational directory only.
    3. Under Redirect URI, choose Web and paste the address shown on the Single sign-on page. It's always https://knowpoint.io/auth/microsoft/callback, whatever your workspace address is.
    4. Register, then copy the Application (client) ID and Directory (tenant) ID.
    5. Go to Certificates & secrets → New client secret and copy the secret's Value. Set a reminder to replace it before it expires.

Knowpoint only asks for openid, profile and email. It can't read mail, files or anything else in Microsoft 365.

2. Fill in the settings

Setting What it does
Tenant ID or domain Your Entra directory, e.g. contoso.onmicrosoft.com or the tenant ID. Only accounts in this directory can sign in.
Allowed email domains Optional. Only accept accounts with these email domains.
Create accounts automatically Someone without a Knowpoint account gets one the first time they sign in, with the role and organization access you choose. Admin rights are never given automatically.
Require Microsoft sign-in Turns off email-and-password sign-in.
Admins can still sign in with a password Recommended with Require, so you can't be locked out if something goes wrong with Microsoft.

Tick Turn on Microsoft sign-in and save. To test it, sign out, or open a private window, and choose Sign in with Microsoft.

How accounts are matched

  • The first time someone signs in, Knowpoint finds the account with the same email address, or creates one if that's turned on.
  • After that, the account is linked to their Microsoft account ID, so it keeps working if their email changes.
  • People from other Microsoft organizations can never sign in to your workspace, even if their email address matches.

Good to know

  • Disabling someone in Admin → Users blocks them, even if their Microsoft account is still active.
  • Two-factor: people who sign in with Microsoft use Microsoft's multi-factor authentication instead of Knowpoint's codes.
  • The API: API keys aren't affected by single sign-on.
  • If there's an IP allowlist, Microsoft sign-in only works from allowed addresses, like everything else. See IP allowlist.
← PreviousAudit log Next →IP allowlist
Didn't find what you needed? Email us about this page