Skip to main content
This guide walks you through configuring single sign-on (SSO) for Brellium using Microsoft Entra ID (formerly Azure Active Directory). You register an application in your Entra ID tenant, then enter its credentials in the Brellium setup portal to complete the connection.

​
Prerequisites

Before you begin, ensure you have:
  • Administrator access to your Microsoft Entra ID tenant
  • A Brellium account with the can edit sso settings permission, with SSO and SCIM turned on for your organization (see Access the Brellium setup portal)

​
Access the Brellium setup portal

IT administrators can open the SSO and SCIM setup portal on their own. In Brellium, go to Control Center > Settings. The Single sign-on and Directory sync (SCIM) sections each have an Edit configuration button. Each button opens the setup portal for that connection in a new tab, so you can configure and change settings without a support ticket.
Brellium Team Settings page showing the Single sign-on connection with its Client ID, the Directory sync (SCIM) section, and an Edit configuration button for each

Brellium Control Center > Settings — the Single sign-on and Directory sync (SCIM) sections

Before you can use the setup portal, make sure that:
  1. SSO and SCIM are turned on for your organization. If you do not see the Single sign-on and Directory sync (SCIM) sections on the settings page, contact your customer success manager to turn on the feature for your organization. You can open the SSO and SCIM configuration only after the feature is on.
  2. You have the can edit sso settings permission. Your Brellium account must have the can edit sso settings permission under Settings. The can edit org settings permission does not give access to SSO and SCIM. If you do not have the permission, ask a Brellium administrator in your organization to give it to you.
Brellium Settings permissions: can view page, can edit org settings, and can edit sso settings

The can edit sso settings permission under Settings

​
Supported features

The Brellium Microsoft Entra ID integration supports the following features:
  • SP-initiated SSO — Users can sign in to Brellium from the Brellium sign-in page, which redirects to Microsoft Entra ID for authentication.
  • IdP-initiated SSO — Users can sign in to Brellium directly from the Microsoft My Apps portal by clicking the Brellium tile.
  • Just-In-Time (JIT) provisioning — User accounts are automatically created in Brellium on first sign-in through Microsoft Entra ID. The following attributes are provisioned:
    • Email address
    • Full name
  • Federated logout (SLO) — Users who sign out from Brellium also have their Microsoft Entra ID session terminated.
To provision and deprovision users in Brellium using SCIM, see the SCIM Provisioning Configuration guide.

​
Configuration steps

1

Register an application in Microsoft Entra ID

  1. Sign in to the Microsoft Entra admin center.
  2. Go to Identity > Applications > App registrations.
  3. Click New registration.
Microsoft Entra ID App registrations page showing the New registration button

App registrations page with New registration button

  1. Configure the following settings:
Register an application form showing Name and Supported account types fields

Register an application form

  1. Click Register.
On the application’s Overview page, note the Application (client) ID — you will need this later.
Application overview page with Application (client) ID highlighted

Application overview showing the Application (client) ID

Make sure you are in the correct Azure AD directory when registering the application. If you have multiple directories, verify you are in the intended tenant before proceeding.
To get the Redirect URI for your organization, open the setup portal: in Brellium, go to Control Center > Settings and click Edit configuration under Single sign-on. See Access the Brellium setup portal.
If you did not set the Redirect URI during registration, you can add it afterward:
  1. In the registered Brellium application, go to Authentication under Manage.
  2. Click Add a platform and select Web.
Authentication page showing Add a platform with Web option selected

Add a platform — select Web

  1. Enter the Redirect URI from the Brellium setup portal.
  2. Click Configure.
Configure Web platform showing the Redirect URIs field

Configure Web platform with Redirect URI

2

Create a client secret

  1. In the registered Brellium application, go to Certificates & secrets under Manage.
  2. Click New client secret.
  3. Enter a description (e.g., Brellium SSO) and select an expiration period.
Add a client secret dialog with Description and Expires fields

Add a client secret dialog

  1. Click Add.
  2. Copy the Value of the new client secret immediately — it is only shown once.
Certificates and secrets page showing the client secret Value highlighted

Client secret value — copy this immediately

If you configure an expiring secret, record the expiration date. You must renew the secret before it expires to avoid a service interruption. When you renew the secret, enter the new value in the Brellium setup portal (Single sign-on > Edit configuration).
3

Add API permissions

  1. In the registered Brellium application, go to API permissions under Manage.
  2. Click Add a permission > Microsoft Graph > Delegated permissions.
  3. Add the following permissions:
  1. Click Add permissions.
  2. If required by your organization, click Grant admin consent to consent on behalf of all users in the directory.
4

Enter the credentials in the Brellium setup portal

  1. In Brellium, go to Control Center > Settings.
  2. Under Single sign-on, click Edit configuration. The setup portal opens in a new tab.
  3. Enter the following values to complete the connection:
If you cannot open the setup portal, see Access the Brellium setup portal.
5

Grant admin consent

The setup portal asks an administrator in your Azure AD tenant to grant consent for the application.
  1. When the setup portal prompts you, sign in with an Azure AD administrator account.
  2. Review the permissions and click Accept.
If you do not have the Azure AD administrative permissions to grant consent, ask an administrator in your organization to complete this step in the setup portal.
6

Assign users and groups

  1. In the Microsoft Entra admin center, go to Identity > Applications > Enterprise applications.
  2. Select the Brellium application.
  3. Go to Users and groups under Manage.
  4. Click Add user/group.
  5. Select the users or groups to assign and click Assign.
7

Verify the configuration

Verify that SSO is working correctly.Verify IdP-initiated SSO:
  1. Go to the Microsoft My Apps portal.
  2. Click the Brellium tile.
  3. Confirm that you are signed in to Brellium without being prompted for additional credentials.
Verify SP-initiated SSO:
  1. Open a new browser window and go to the Brellium sign-in page.
  2. Click Sign in with Microsoft.
  3. Enter your Microsoft Entra ID credentials.
  4. Confirm that you are signed in to Brellium.

​
SP-initiated SSO

After the integration is configured, users can sign in to Brellium using one of the following methods:
For SP-initiated SSO, users must access Brellium through one of the options below. Direct sign-in at app.brellium.com without a verified domain will not automatically redirect to Microsoft Entra ID.
Option 1: Use your organization’s Brellium domain Navigate directly to your organization’s dedicated Brellium URL (e.g., https://myorganization.brellium.app). You are automatically redirected to Microsoft Entra ID for authentication. Option 2: Sign in with a verified domain If your organization has configured verified domains:
  1. Go to https://app.brellium.com.
  2. Enter your email address.
  3. You are automatically redirected to Microsoft Entra ID for authentication based on your email domain.
If your organization has not yet configured verified domains, contact your customer success manager or Brellium support to set this up.
If your credentials are valid, you are redirected to the Brellium dashboard.

​
Troubleshoot

​
Signing key rollover

Microsoft Entra ID periodically rolls its signing keys for security purposes. You do not need to take any action — Brellium uses the new key automatically.

​
Support

If you have questions or encounter issues not covered in this guide, contact the Brellium support team: