Skip to content

Microsoft Entra ID (Azure Active Directory)

Microsoft Entra ID (formerly Azure Active Directory) is the identity and access management service used across the Tokenise platform.

All users, applications, and services authenticate through Entra ID, providing centralized control over:

  • User accounts and credentials
  • Application registrations
  • Role-based access control (RBAC)
  • Single Sign-On (SSO)
  • Multi-factor authentication (MFA)

Access Microsoft Entra ID

You can access Microsoft Entra ID through two different methods:

Option 1: Direct Entra ID Portal

https://entra.microsoft.com

This is the dedicated portal for Microsoft Entra ID with a modern interface focused specifically on identity and access management.

Login Process:

  1. Navigate to entra.microsoft.com
  2. Enter your email address
  3. Important: If you're signing in with an organizational account (not a personal Microsoft account):
  4. After entering your email, you may see a prompt asking how you want to sign in
  5. Select "Sign in with an organization"
  6. This ensures you authenticate against your organization's directory (e.g., tokenise.io)
  7. Complete authentication (password + MFA if enabled)
  8. You'll have access to all Entra ID features

Option 2: Azure Portal

https://portal.azure.com

You can also access Entra ID through the main Azure Portal:

  1. Navigate to portal.azure.com
  2. Sign in with your organizational credentials
  3. In the Azure Portal search bar (top), type "Entra ID" or "Azure Active Directory"
  4. Select Microsoft Entra ID from the search results
  5. You'll be taken to the Entra ID management interface

Both portals provide the same functionality - use whichever you prefer. The dedicated Entra portal (entra.microsoft.com) offers a more streamlined experience for identity management tasks.

Understanding Organization Sign-In

When logging in to Microsoft services with a work/school account:

  • Personal Microsoft Account: Used for personal services (Xbox, Outlook.com, OneDrive personal)
  • Organizational Account (Work/School): Managed by your organization's Entra ID (e.g., user@tokenise.io)

Why "Sign in with an organization" matters:

  • Your email might exist in multiple directories (personal Microsoft account + organizational account)
  • Selecting "Sign in with an organization" ensures you authenticate against the correct directory
  • This gives you access to your organization's resources, apps, and permissions
  • Without this, you might accidentally sign in with a personal account that doesn't have the required access

Tip: If you're always signing in with the same organizational account, your browser will remember this preference for future logins.

Add Entra ID Account

To grant team members access to Azure DevOps and enterprise applications, you need to add them to Microsoft Entra ID and assign appropriate roles.

Step 1: Invite External User

Add New User

  1. Navigate to Entra ID → Users in the Azure Portal
  2. Click New user dropdown → Select Invite external user

Define User Details

  1. Fill in the user details:
  2. Email: Enter the user's email address (e.g., dev1@tokenise.io)
  3. Display name: Enter a display name (e.g., dev 1)
  4. Optionally configure:
  5. Invitation message: Customize the welcome email
  6. Cc recipient: Add additional recipients to the invitation
  7. Click Review + invite to send the invitation

The user will receive an invitation email to collaborate with your organization.

Step 2: Assign User to Enterprise Application

After the user accepts the invitation, you need to grant them access to specific applications.

Microsoft Entra ID Users and Groups

  1. Go to Entra ID → Enterprise applications
  2. Find and select the application (e.g., tokenise-web-api-admin-panel)
  3. Navigate to Users and groups in the left menu
  4. Click Add user/group

Select User

  1. In the Add Assignment dialog:
  2. Click None Selected under Users
  3. Search for the user (e.g., dev1)
  4. Select the user from the results
  5. Click Select

Step 3: Assign Role to User

Assign Role

  1. After selecting the user, click None Selected under Select a role
  2. Choose the appropriate role from the available options:
  3. Tokenise-Admin: Full administrative access
  4. tokenise-developer: Developer access with limited permissions
  5. Click Select to confirm the role
  6. Click Assign to complete the assignment

Step 4: Verify Assignment

After assignment, you can verify the user has been granted access:

  1. Go to Enterprise applications → Your application → Users and groups
  2. You should see the user listed with their assigned role in the Role assigned column
  3. The user can now access the application with the permissions associated with their role

Important Notes

  • Groups are not available for assignment if your Active Directory is on a lower plan level. In such cases, you can only assign individual users.
  • Users must accept the invitation before they can be assigned to applications
  • Role assignments are immediate and do not require the user to log out and back in
  • You can modify or remove user assignments at any time from the Users and groups section

Entra ID in Tokenise Architecture

Within the Tokenise ecosystem, Entra ID serves as the central authentication authority for:

  • Admin Panel: Administrative access control
  • Backend-Core: API authentication and authorization
  • CMS: Content management access
  • Azure DevOps: Source control and pipeline access
  • Other enterprise applications: Unified identity across all services

This centralized approach ensures:

  • Consistent security policies across all services
  • Simplified user management
  • Audit trail for all access and authentication events
  • Support for compliance requirements

Security Best Practices

When managing Entra ID accounts for Tokenise:

  1. Use Multi-Factor Authentication (MFA) for all users with administrative access
  2. Apply the principle of least privilege - grant only the minimum required permissions
  3. Regularly review user access and remove inactive accounts
  4. Use Conditional Access policies to enforce security requirements based on context
  5. Enable audit logging to track all authentication and authorization events
  • Admin Panel - Administrative console using Entra ID authentication
  • DevOps - CI/CD platform access management
  • Backend-Core - API authentication flows