DQC Logo
|

Setting up Microsoft SSO (Single Sign-On)

The DQC Platform supports Single Sign-On via Microsoft Entra ID (formerly Azure Active Directory) using the OpenID Connect (OIDC) standard. Your team can sign in to the DQC Platform with their existing Microsoft work accounts — no separate DQC password required.

DQC runs as a multi-tenant application. You do not need to register an app or share any secrets with us. Enabling SSO for your organization only requires a one-time approval (“admin consent”) of the DQC enterprise application in your own Microsoft Entra tenant.

How it works

  • DQC operates a single multi-tenant Microsoft Entra application.

  • When the first user from your organization signs in, Microsoft creates an Enterprise Application (a service principal of the DQC app) in your tenant.

  • Your organization stays in control: you grant consent, can restrict access to specific users or groups, and can revoke it at any time.

  • On first successful login, a DQC Platform account is created automatically (just-in-time provisioning).

Prerequisites

  • A Microsoft Entra ID (Azure AD) tenant.

  • An account with the Global Administrator (or Privileged Role Administrator) role — required to grant tenant-wide admin consent.

  • The DQC application (client) ID: d21a0df6-05ee-4d57-b917-52aaaa14ecdd

Step 1 — Grant admin consent

Option A — Use the admin consent URL (recommended)

  1. Find your tenant ID in the Azure portal under Microsoft Entra ID → Overview.

  2. While signed in as an administrator, open the following URL in a browser, replacing {tenant-id} with your tenant ID:

https://login.microsoftonline.com/{tenant-id}/adminconsent?client_id=d21a0df6-05ee-4d57-b917-52aaaa14ecdd

Tip: You can use common instead of your tenant ID, but using your explicit tenant ID is clearer and recommended.

  1. Review the requested permissions — these are the standard OpenID scopes (openid, profile, email): sign in and read the user’s basic profile (name and email).

  2. Confirm the consent. The DQC application now appears in your tenant under Microsoft Entra ID → Enterprise applications.

Option B — Consent during first login

Alternatively, an administrator can open the DQC sign-in page, choose Sign in with Microsoft, and approve the consent prompt on behalf of the organization. If your tenant allows user consent, the first regular user can approve it themselves.

Step 2 — (Optional) Restrict and harden access

Once the enterprise application exists in your tenant, manage it under Microsoft Entra ID → Enterprise applications → DQC:

  • Assignment required: enable “Assignment required?” so only assigned users or groups can sign in to DQC.

  • User / group assignment: assign the specific users or groups that should have access.

  • Conditional Access: apply policies such as multi-factor authentication (MFA) or device compliance.

  • Revoke access: remove the assignment or delete the enterprise application to immediately stop SSO for your organization.

Step 3 — Signing in

  1. Go to your DQC Platform sign-in page (for example https://shared.app.dqc.ai/signin).

  2. Click Sign in with Microsoft.

  3. Authenticate with the Microsoft work account.

  4. On first login, the DQC Platform account is created automatically.

Linking an existing account

If a user already has a DQC Platform account with email and password, they can link it to their Microsoft SSO identity. See Linking an SSO account to an existing username/password account.

Troubleshooting

  • “Need admin approval” / consent error: your tenant requires admin consent — have a Global Administrator complete Step 1, Option A.

  • User cannot sign in after consent: check whether “Assignment required” is enabled and the user/group is assigned.

  • Wrong account: ensure the user signs in with the Microsoft work account that matches their DQC email.

Need help?

Contact the DQC team at support@dqc.ai and we’ll help you get SSO configured.