Single Sign-On (SSO)

Every ByteHide account can sign in with an email code or with Google, GitHub, Microsoft, GitLab or Bitbucket. Enterprise single sign-on lets the members of your organization sign in to ByteHide with your Microsoft Entra ID tenant instead. You verify the email domains you own, choose whether SSO is optional or required for them, and can let Entra ID create, update and deactivate members for you through SCIM.

Open Settings → Organization → Security.

Sign-in Methods

Every ByteHide account, on any plan, can sign in with:

Each account can also have a password, set or changed in Profile → Security → Change Password. In the same place, turn on Authenticator App to add two-factor authentication: signing in with the password then also asks for a code from your authenticator app. Email-code, social and Enterprise SSO sign-ins do not use it; for SSO, your identity provider handles multi-factor authentication.

Enterprise SSO adds sign-in through your organization's own Microsoft Entra ID tenant, for emails under domains you have verified. The Microsoft social button and Enterprise SSO are different: the social button signs in a single account, while Enterprise SSO is set up by your organization's owner, can be required for your domains, and can provision members with SCIM.

Who Can Configure SSO

Supported Providers and Protocols

Before You Start

You need:

• An Owner role in the ByteHide organization.
• An administrator in your Entra ID tenant who can create app registrations and enterprise apps.
• Access to the DNS of every email domain your members use.

The setup takes about 20 minutes. The recommended order is: create the Entra app, create the connection in ByteHide, verify your domains, test, and only then require SSO.

Step 1: Register ByteHide in Entra ID

1. In Entra ID, open App registrations → New registration.
2. Name it, for example ByteHide. Under Supported account types, choose Accounts in this organizational directory only (single tenant).
3. Set the redirect URI: platform Web, value taken from the Redirect URI field shown in ByteHide after you create the connection.
4. Register the app. From Overview, copy the Application (client) ID and the Directory (tenant) ID.
5. Under Certificates & secrets, create a New client secret and copy its Value. Entra shows it once. Note the expiry date.
6. Under Token configuration, add the optional ID token claims email, given_name and family_name.
7. Under API permissions, make sure openid, profile and email (delegated) are granted, and grant admin consent.
8. Recommended: in Enterprise apps → ByteHide → Properties, set Assignment required to Yes, then assign the users and groups who should sign in.

Step 2: Create the Connection

The Single sign-on (Microsoft Entra ID) card holds the connection.

Click Create connection. The card then shows two read-only values to copy into Entra ID:

• Redirect URI: must match the redirect URI of the app registration exactly.
• Sign-in URL (for the Entra app "Home page URL"): paste it into Branding & properties → Home page URL of the Entra app so people can start from the Entra My Apps portal.

The status chip next to the title shows active or disabled.

Rotate the Client Secret

Create a new secret in Entra, paste it into Client secret, click Save changes, then delete the old secret in Entra. Do this before the old secret expires: sign-in fails once it does.

Step 3: Verify Your Domains

Only email addresses under a verified domain can sign in through SSO or be managed by SCIM. Verify every domain your members use.

1. In the Verified domains card, type the domain (for example example.com) and click Add domain.
2. Publish the DNS record shown in the DNS TXT record column:

3. Click the refresh icon (Check DNS now). DNS changes usually propagate in minutes and can take up to an hour. Until then the check returns "TXT record not found yet".

A domain can belong to only one ByteHide organization. Adding a domain another organization already claimed fails with "This domain is already claimed."

Domain Status

Removing a domain asks you to type the domain name to confirm. Members under it are no longer routed to your identity provider, and Entra ID can no longer manage them.

Step 4: Test

1. Open a private browser window and go to the ByteHide sign-in page.
2. Enter an email under a verified domain.
3. Choose your organization's sign-in button, sign in with Microsoft, and check you land in the console.

Ask a few members to sign in once this way before you require SSO.

Require SSO

Turn on Require SSO for verified domains and click Save changes. From then on:

• Email-code, password and social sign-in (Google, GitHub, Microsoft, GitLab, Bitbucket) are refused for every email under your verified domains.
• Owners keep a break-glass login. Active owners of the organization are exempt: they can still sign in with an email code (the sign-in page offers a link for it) or a social login, so a broken connection never locks you out.
• Members whose email is not under a verified domain, such as contractors on a personal address, are not affected.

Turning Route verified domains to Microsoft at sign-in off also turns Require SSO off. Members then sign in as usual and can still use SSO through the sign-in URL.

How Members Sign In

The sign-in page asks for an email first and decides what to show:

People who look for SSO directly can click Sign in with SSO under the sign-in options, enter their Work email and click Continue. If no connection exists for that domain, the page says "No single sign-on is configured for {domain}" and offers an email code.

If someone tries another method after SSO became required, ByteHide refuses it and takes them back to this screen with the notice "{organization} requires single sign-on. Use Microsoft to sign in."

Identity Matching and Sessions

• People are identified by their Entra object ID, not their email. Renaming a user in Entra keeps their ByteHide account.
• On first SSO sign-in, an existing ByteHide account with the same email is linked to the Entra identity, but only if the email is under one of your verified domains.
• Multi-factor authentication is handled by your tenant (for example with Conditional Access). ByteHide does not add its own two-factor step to SSO sign-ins.
• SSO sessions last 24 hours. After that, people sign in through Entra again.

Automatic Provisioning (SCIM 2.0)

With SCIM, Entra ID creates, updates and deactivates members and syncs Entra groups to ByteHide teams. SCIM needs at least one verified domain. Set up the SSO connection first so provisioned members can sign in and get the connection's default role (without a connection they get Member).

Create a SCIM Token

1. In the Automatic provisioning (SCIM 2.0) card, click Create token.
2. Give it a Name and click Create token.
3. Copy the token. It is shown once. Confirm I have copied my token and stored it securely and click Done.

Copy the Tenant URL (paste into Entra ID → Provisioning) from the same card.

The token list shows each token's name, prefix, Last used and Created dates. Revoke a token with the trash icon; you type the token name to confirm and Entra stops syncing with it immediately.

Configure Entra ID

1. In Enterprise apps → ByteHide → Provisioning, create a configuration with the Tenant URL and the token as Secret Token, then Test Connection.
2. Keep these user attribute mappings and remove the rest:

3. For groups, map displayName (matching), objectId to externalId, and members.
4. Set the scope to Sync only assigned users and groups, assign them, and Start provisioning.

userName must be an email under a verified domain. Any other value is rejected. If your user principal names are not real email addresses, map mail instead.

Roles From Entra (Optional)

To set ByteHide roles from Entra, create app roles on the app registration whose values are exactly member, manager, billing or owner, assign users to them directly (not through groups), and add the mapping SingleAppRoleAssignment([appRoleAssignments]) → roles[primary eq "True"].value. People without an app role get the connection's default role.

What Provisioning Does

ByteHide always keeps at least one active owner: Entra cannot remove, deactivate or demote the last one.

Directory-Managed Members

Members created or adopted by SCIM show a Directory chip in Teams & Members. While at least one SCIM token is active, their role, status and membership can only be changed in Entra ID; the console disables those controls. Revoking every SCIM token makes them editable from the console again.

Existing Members

• Setting up SSO does not remove anyone. Memberships, roles and teams stay as they are.
• Existing members under a verified domain can keep signing in with an email code until you require SSO. On their first SSO sign-in their account is linked to Entra.
• Members outside your verified domains (for example a personal email) cannot use SSO and are not affected by Require SSO or SCIM. Invite them as usual.
• With SCIM on, an existing member under a verified domain that Entra provisions is adopted and becomes Directory-managed.

Remove the Connection

Click Remove connection and type remove to confirm. Single sign-on is disabled for the organization and every member's SSO identity link is deleted. Memberships are kept, and members sign in with the other methods again.

Troubleshooting

Next Steps