Set up Entra ID single sign-on (SSO) for TrackTik

Learn how to set up Entra ID SSO sign-in for TrackTik.

Overview

Microsoft Entra ID is the new name for Azure Active Directory (Azure AD), acting as the comprehensive cloud-based identity and access management solution for Microsoft 365, Azure, and external applications. It provides single sign-on (SSO), multi-factor authentication (MFA), and conditional access, seamlessly integrating with Azure resources to secure users, devices, and applications. 

You can use Entra ID with OpenID to sign into TrackTik through a web or mobile device, so you and any related employees and colleagues can log in conveniently to TrackTik.

Until we update the terminology throughout this document including new screenshots, please assume that references to Azure Active Directory mean Entra ID.

Before you start

Here are some things you must do before you start:

• You must have Azure admin credentials.

• If you want to use provisioning and SSO at the same time for Azure, you must complete the provisioning process first.

  To learn more about the provisioning process for Azure, check out Set up and use provisioning for Azure.

• If you completed the provisioning process and want to use SSO for Azure, you can go to Step 1b: Authenticate your application.
• If you don’t want to set up provisioning and only want to use SSO for Azure, go to Step 1a: Register your application. 

Set up Azure SSO for TrackTik

There are two steps to get Azure SSO set up for TrackTik:

Step 1a: Register your application

Important note

• If you want to use provisioning and SSO, you must:
  1. Complete the steps in Set up and use provisioning for Azure.
  2. Skip to Step 1b: Authenticate your application.
• If you only want SSO, you can continue.

To start the setup for Azure SSO, you need to create an app registration using your TrackTik Portal domain.

To create an app registration:

1. Log into your Azure Active Directory admin center.
2. Go to Azure Active Directory, and in Manage, choose App registrations.
   
3. Select + New registration.
   
4. In the Name box, enter a name for the app registration.
5. In Supported account type, leave it as the default Accounts in this organizational directory only (MSFT only – Single tenant).
6. Move down to Redirect URI:
   • In the Select a platform drop-down menu, select Web.
   • In the redirect URI box, enter https://<portaldomain>/auth/open-id
     • <portaldomain> is where you enter your TrackTik Portal domain.
7. Select Register.

Your TrackTik Portal is now registered, and you can now find and send the app details to your solution specialist.

Step 1b: Authenticate your application

Important note

• If you only want to set up SSO without provisioning:
  1. Complete Step 1a: Register your application.
  2. Skip this step (Step 1b: Authenticate your application) and go to Step 2: Send details to your solution specialist.

If you want to use provisioning with SSO and you completed all the steps in Set up and use provisioning for Azure, you can skip the registration process and authenticate your app.

To authenticate your app:

1. Log into your Azure Active Directory admin center.
2. Go to Azure Active Directory, and in Manage, choose App registrations.
   
3. Choose All applications.
   
4. Select the app.
5. In Manage, choose Authentication.
   
6. In Platform configurations, select + Add a platform.
7. Move down to Redirect URI:
   • In the Select a platform drop-down menu, select Web.
   • In the redirect URI box, enter https://<portaldomain>/auth/open-id
     • <portaldomain> is where you enter your TrackTik Portal domain.
8. Select Register.

Your app is now authenticated, and you can now send the app details to your solution specialist.

Step 2: Send details to your solution specialist

When you finish Step 1: Register your application, you can now find and send your client ID, client secret value, and OpenID discovery URL to your solution specialist:

Client ID

To find your client ID:

1. Log into Azure as an admin.
2. Select Azure Active Directory.
3. Choose App registrations.
   
4. Choose All applications.
5. Select the application from the list.
6. You’re taken to the Overview by default, and in the Essentials collapsible panel, copy the Application (client) ID.
   

You can now give the client ID to your solution specialist.

Client secret value

Important note

You can only get your client secret value when you first create it; make sure save it somewhere private and secure the first time you create one.

If you or other admins don’t remember or lost the client secret value, create a new one.

To create a client secret value:

1. Log into Azure as an admin.
2. Go to Azure Active Directory.
3. Choose App registrations.
   
4. Choose All applications.
5. Select your application from the list.
6. Choose Certificates & secrets.
7. Select Client secrets.
8. Select + New client secret.

You can now copy and give the client secret value to your solution specialist.

Important note

For security reasons, we highly recommend not sharing your client ID and client secret value in the same email or communication channel.

OpenID Connect URL

To find your OpenID Connect URL:

1. Log into Azure as an admin.
2. Select Azure Active Directory.
3. Choose App registrations.
   
4. Choose All applications.
5. Select the application from the list.
6. Choose Endpoints.
7. Copy the OpenID Connect metadata document URL.

You can now give the copied information to your solution specialist.

Troubleshoot unexpected sign-outs or outages

If your organization uses Microsoft Entra ID (formerly Azure Active Directory) for SSO, session and credential expiration settings can cause unexpected sign-outs or outages. Work with your IT/Azure admin to review the following areas in the Azure portal.

Session and sign-in frequency (Conditional Access)

Path: Entra ID (Azure AD) > Security > Conditional Access > (Select or create a policy) > Access controls > Session.

• Review policies that set:
  • Sign-in frequency: How often users must re-authenticate. Short intervals can trigger frequent logouts in integrated apps.
  • Persistent browser session: Whether sessions persist across browser restarts.
• Scope carefully: Apply session controls only to the intended users/apps to avoid broad impact.

Enterprise app/SSO configuration

Path: Entra ID > Enterprise applications > [Your enterprise app for TrackTik] > Single sign-on.

• Confirm that the app is targeted by the intended Conditional Access policies and that there are no conflicting session settings.

Credential expirations for app integrations

Path: Entra ID > App registrations > [Relevant app/service principal] > Certificates & secrets.

• Check certificate/secret expiration dates and rotate well before they expire to avoid outages that can be perceived as sign-in failures.
• Implement alerts and a rotation calendar for secrets/certs.

User and tenant hygiene

• Verify affected users are enabled and licensed, and that password or account policies aren’t forcing unexpected sign-outs.
• Ensure device time synchronization and compliant device posture if Conditional Access requires it.

Change management tips

• Test policy changes in a pilot group before broad rollout.
• Coordinate timing with end users to avoid disrupting active sessions.
• Document the final sign-in frequency and session posture so your help desk can triage timeout reports quickly.