Single Sign-On (SSO): Technical Overview

Systam's platform supports single sign-on (SSO) through Microsoft Entra ID, using OpenID Connect. Sign-in policies such as MFA and Conditional Access are managed in the customer's own Entra tenant.

Protocol

SSO uses OpenID Connect with the Authorization Code Flow and PKCE. Systam maintains a single multi-tenant Entra app registration, so the customer has nothing to set up or maintain in Entra beyond granting admin consent.

Scopes used are openid profile email. Claims read by the platform: tid, oid, preferred_username/upn/email, given_name, and family_name.

The ID token is validated according to the OIDC specification: signature (Microsoft JWKS, RS256), issuer, audience, nonce, validity period, and tenant match.

Customer-side setup

1. Provide your Entra tenant ID to Systam.
2. A Global Administrator grants tenant-wide admin consent to the Systam application. The consent request starts from the platform's admin view.
3. Test the connection from the admin view.

Sign-in flow

The user enters their email address on the platform's login page. The platform resolves the organization and redirects to Entra ID if SSO is enabled for that organization. After successful authentication, the platform issues its own session (access and refresh token). Signing out ends the platform session.

User accounts

SSO does not create user accounts. Accounts must exist in advance, either created in the admin view or provisioned through SCIM 2.0 from Entra ID.

On first sign-in, the Entra identity is linked to the existing account. After that, a name or email change in Entra doesn't affect sign-in.

Sign-in policy

Configured per organization: SSO can be optional (password sign-in remains available) or enforced (password sign-in disabled). Enforcement requires a successful connection test and verified admin consent.

That covers the technical core of SSO. Reach out if any part needs more detail for a specific customer setup.