With Microsoft Entra ID single sign-on, users authenticate to Spotilla with their organization's Microsoft account. Spotilla's settings also use the feature's former name, Azure AD. Sign-in works in the browser, on Android and on iOS when the customer instance and the platforms in use are configured correctly.

You can use single sign-on solely for authentication and maintain Spotilla content permissions manually. Automatically mapping Spotilla roles based on Entra memberships is optional. Roles maintained manually should have no external references: memberships in externally mapped roles are updated at sign-in.

Permission to sign in and access rights in Spotilla are separate matters. Entra ID identifies the user, but Spotilla roles determine their content permissions. Single sign-on can also create missing user accounts. A new account does not receive content permissions simply because authentication succeeds.

Agree on the setup requirements

Start by contacting the Spotilla helpdesk: helpdesk@spotilla.com. Single sign-on can be enabled quickly without a separate project. If you also want to assign Spotilla access rights automatically based on Entra memberships, more planning of roles and permissions is required on the customer's side.

Spotilla handles the technical configuration of single sign-on. Your organization's Entra administrator approves the required permissions in your Azure/Entra environment; they do not need to configure single sign-on manually. The customer's administrator plans the required Spotilla roles and their permissions, along with any optional external mappings.

Agree on the following details with Spotilla. Items concerning technical settings are configured by Spotilla; they are not a settings checklist for the customer to complete:

  • The Spotilla customer instance and its dedicated browser URL.
  • The restriction on allowed Microsoft sign-in identifiers. The check uses the sign-in identifier returned by Microsoft, which may differ from the email address the user normally uses.
  • The sign-in method: Microsoft Graph or OpenID Connect (OIDC).
  • The Microsoft application ID, Entra directory details, and the application settings and redirect URLs required by the selected method for the browser, Android and iOS.
  • For Graph, the required access to read user and group information and any mandatory sign-in group. For OIDC, the application roles and the values they return for any automatic role mapping.
  • The Spotilla mobile and manager roles required for each user group, whether memberships will be maintained manually or through external mappings, and the test users.

Microsoft sign-in must be enabled for the customer instance, and the sign-in method must be set. Microsoft and Google sign-in should not be enabled simultaneously for the same customer instance: the browser buttons and the retrieval of Microsoft settings on mobile require Google sign-in to be disabled.

The sign-in described here uses Microsoft's Entra service. On-premises Active Directory alone, without Entra sign-in, is not sufficient for this implementation. If your organization uses a hybrid environment with on-premises AD and Entra, confirm its suitability with Spotilla during setup.

Distinguish sign-in requirements from role mapping

With both sign-in methods, the sign-in identifier returned by Microsoft must meet the restriction agreed for the Spotilla customer instance. The implementation compares the contents of the identifier with the configured restriction value; it does not check the Entra directory ID. A role mapping match does not grant permission to sign in.

Graph retrieves the user's group memberships from Microsoft Graph. If a mandatory sign-in group has been configured for the customer instance, its ID must appear in the returned memberships. This check applies to both browser and mobile sign-in. Do not assume that a nested group structure alone is sufficient; verify that the required membership is returned at sign-in.

If no mandatory group is configured, Graph does not require this group membership. Sign-in still requires successful Microsoft authentication, a returned identifier that meets the customer instance's restriction, and the requirements for the relevant application access to be met. The absence of a group requirement therefore does not open Spotilla to all Microsoft users.

Membership in the mandatory group only satisfies the group requirement for sign-in; it does not by itself grant Spotilla content permissions. If the same group should also grant permissions, its ID must be mapped separately to the required Spotilla roles.

OIDC does not use Graph's mandatory group check. It still checks the restriction on the sign-in identifier. Optional role mapping uses the roles values returned at sign-in. The external reference for a Spotilla role must be the exact value returned, rather than the application role's display name or, automatically, its technical ID. An application role match is not required for authentication alone.

If you use automatic mapping, Spotilla mobile roles and manager roles are configured separately. The same external membership can be mapped to both, but the permissions for each role must be planned and saved. Detailed permission options are described in Mobile roles and folder permissions and Configuring manager permissions.

Technical background is available in Microsoft's OpenID Connect protocol documentation and Graph membership documentation. These describe the APIs used; customers do not need to perform technical configuration themselves based on these documents.

Map an external membership to a Spotilla role if needed

Complete this step only if you want to maintain role memberships automatically based on Entra information. For authentication alone, you do not need to add external references to roles. Keep manually maintained roles without external references.

  1. As an administrator, open Manage user accounts → User roles from the browser menu.
  2. Open the role you want to map using the pencil icon on its row. Depending on the role type, the edit form settings are on the Mobile user role or Manager user role tab.
  3. Find the External references section in the form and click Add new external reference.
  4. Fill in Header and Reference. Both are required. Header describes the mapping for people to read; Reference determines the match. For Graph, use the group ID; for OIDC, use the application role value returned at sign-in.
  5. Click Save at the bottom of the form. Reopen the role and verify that the reference was saved correctly.

Create the mapping in the role's own form. The section with the same name in a user's personal details does not replace the role mapping. A role can have multiple references; the user receives the role when any one of them matches a value returned at sign-in.

You can change a reference value in the same form. The trash icon on a reference row marks a saved reference for deletion, and the deletion takes effect when the role is saved. Deleting a reference does not itself delete the role or remove its current members. Check existing memberships separately: once a role has no external references, its memberships remain as manually maintained memberships at the next sign-in.

Sign in in the browser and on mobile

In the browser, open your organization's dedicated Spotilla sign-in page. Select the Sign in button marked with the Microsoft logo and authenticate with your organization's Microsoft account. Spotilla uses the Graph or OIDC method configured for the customer instance.

On Android and iOS, select LOGIN WITH MICROSOFT on the sign-in screen. In the prompt that opens, enter your Spotilla customer instance identifier in the Customer Instance field and tap Apply (on iOS, SAVE). The customer instance identifier selects the Spotilla environment; do not enter the Entra directory ID here. The app retrieves the customer instance settings and starts Microsoft sign-in accordingly.

If you do not know the customer instance identifier or your dedicated browser URL, ask your organization's Spotilla administrator. General sign-in and sign-out instructions are available in Signing in and resetting your password.

What does the first sign-in create?

Spotilla looks for a user account whose email address matches the sign-in identifier returned by Microsoft. An account with the same address is reused; if none is found, sign-in may create a new account. Before setup, therefore, make sure that the existing account's email address matches the identifier returned by Microsoft.

  • Graph in the browser: manager browser access is created for an existing account if needed. For an entirely new account, both manager browser access and mobile access are created. Missing mobile access is not added to an existing account through this sign-in path.
  • OIDC in the browser: manager browser access is created for the account if needed. Missing mobile access is not created.
  • Graph or OIDC on mobile: mobile access is created for the account if needed. Missing manager browser access is not created.

Automatically created application access is active, but its content permissions depend on roles. Entra sign-in does not grant administrator rights. Graph browser sign-in is intended for manager users; separate sign-in for administrators must be ensured during setup.

How does sign-in change permissions and work responsibilities?

At sign-in, Spotilla removes the user's previous memberships in roles that have an external reference and adds memberships matching the current external values. This also applies to manually added memberships if the role has an external reference. Manually assigned roles without an external reference are retained.

The update can affect both mobile and manager roles on the same user account, regardless of which application the user signs in to. For example, mobile sign-in can also change the roles associated with existing browser access. A missing match can therefore remove previously available permissions even when sign-in succeeds.

A change in Entra membership takes effect in this mapping at the next Microsoft sign-in. This is not continuous synchronization, and the change does not establish that all sessions already open have ended.

A role change can update, in the background, the workers assigned to tasks and group tasks that follow the role's members, operating-hour maintenance templates, quotation settings, and resource allocations for tasks, task templates and contracts. Changes to workers can also affect completed tasks. A default resource allocation is created for a newly assigned task worker, and time reservations for a departing worker may be removed. Therefore, check work responsibilities and planned working hours after a role change. Responsibilities assigned directly to a person must be handled separately.

Removing a role membership does not delete the user account or disable access. A deleted account or missing application access can also be recreated during an approved Microsoft sign-in. Permanently ending access must be coordinated with the access granted in Entra; see Disabling and deleting a user's access.

Password and standard sign-in

The Microsoft password is managed in your organization's Microsoft service. Resetting a Spotilla password does not change the Microsoft password.

In the browser, Other login credentials opens the standard sign-in fields, but does not bypass the organization's sign-in restriction. An existing manager account covered by the Entra restriction is redirected to Microsoft sign-in. Administrators are excluded from this redirection.

Standard password sign-in is blocked for an account linked to a Microsoft account through Graph mobile sign-in. This cannot be generalized to all OIDC mobile accounts: OIDC sign-in does not create the same link.

Test the setup and subsequent changes

  1. Sign in with the agreed test user separately in the browser, on Android and on iOS, on the platforms your organization uses. Check that the customer instance and Microsoft account are correct.
  2. As an administrator, check the expected memberships on the Manage user accounts → User roles page. Verify mobile and manager roles separately. If you use single sign-on solely for authentication, verify that manually assigned memberships in roles without external references are retained.
  3. While online, retrieve the required Spots and work, and try an action that should be allowed. Successful authentication alone does not verify content permissions.
  4. If you use automatic role mapping, change the test user's external membership, sign in again, and verify that permissions are both added and removed as expected. After the background update, also check the workers and resource allocations for work that follows the role.

If the Microsoft button is missing or the mobile customer instance prompt does not proceed to authentication, ask the Spotilla helpdesk to check that the customer instance is enabled and that the sign-in method and platform-specific settings are configured. If Microsoft authentication succeeds but Spotilla rejects sign-in, check the returned sign-in identifier, its restriction and, for Graph, any mandatory group.

If sign-in succeeds but content is missing, check the role's permissions and the status of the relevant application access. For manually maintained roles, check the user's membership. For automatic mapping, also check that the external value matches the role's Reference field. Do not assume that Spotilla access is configured correctly simply because Microsoft sign-in succeeds.