This guide explains how to configure Microsoft Entra ID Single Sign-On (SSO) for the jtel Portal.

Once configured, users can sign in to the jtel Portal using their Microsoft organizational accounts.

Requirements:

  • Access to Microsoft Entra ID with permission to register applications.

  • Administrator access to the jtel Portal.

  • An existing jtel Portal user account for testing.

  • An HTTPS-enabled jtel Portal domain.

1. Register an Application in Microsoft Entra ID

  1. Open the Microsoft Entra admin center and sign in.

  2. Navigate to Entra ID → App registrations → New registration.

  3. Enter a name for the application, for example, jtel Portal SSO.

  4. Under Supported account types, select Accounts in this organizational directory only (Single tenant).

  5. Under Redirect URI, select the Web platform and enter: https://<portal-domain>/CarrierPortal/azurelogin

  6. Click Register.

After registration, copy the following values from the application's Overview page:

  • Application (client) ID

  • Directory (tenant) ID

These values are required for the jtel Portal configuration.

Important: The redirect URI must use the actual jtel Portal domain and must match the URI used during authentication.

2. Create a Client Secret

  1. Open the registered application in Microsoft Entra ID.

  2. Navigate to Certificates & secrets → Client secrets.

  3. Click New client secret.

  4. Enter a description and select an expiration period.

  5. Click Add.

  6. Copy the generated Value.

Important: Copy the secret Value, not the Secret ID. The value is only visible immediately after creation.

Store the secret securely and ensure it is renewed before expiration.

3. Configure API Permissions

  1. In the registered application, navigate to API permissions.

  2. Ensure the following Microsoft Graph delegated permissions are configured:

    PermissionTypeDescription
    openidDelegatedSign users in
    User.ReadDelegatedSign in and read the user's profile
  3. To avoid individual consent prompts during login, an authorized administrator can click Grant admin consent for your organization.

  4. Verify that the permissions have been granted successfully.

These permissions are sufficient for basic jtel Portal SSO login.

For further information, see Microsoft documentation: Grant admin consent.

4. Configure Microsoft Entra ID in the jtel Portal

Log in to the jtel Portal as an administrator.

Navigate to the appropriate Client (Mandant) → Parameters and configure the following parameters:

ParameterValue
User.Authentication.Azure.ClientsIDApplication (client) ID from Microsoft Entra ID
User.Authentication.Azure.Authorityhttps://login.microsoftonline.com/<tenant-id>
User.Authentication.Azure.SecretClient secret Value

Replace <tenant-id> with the Directory (tenant) ID copied in step 1.

For example, the authority has the following format:

https://login.microsoftonline.com/xxxxxxxx-xxxx-xxxx-xxxx-xxxxxxxxxxxx

Save the configuration.

Optional: Enforce Microsoft Entra ID Login

By default, Microsoft Entra ID login can be used without disabling the standard jtel Portal login.

The following options are available:

Parameter / ResourceDescription
User.Authentication.Azure.ForceEnforces Microsoft Entra ID login for the configured client
portal.Login.Azure.ForcePortal resource for enforcing Microsoft Entra ID login

Recommendation: Leave forced login disabled until Microsoft Entra ID authentication has been successfully tested. This preserves the standard login as a fallback.

5. Test Microsoft Entra ID Login

  1. In the jtel Portal, ensure that the user has the correct email address configured under User → Communications → Email. The email address must match the user's Microsoft Entra ID account.

  2. Open the jtel Portal login page.

  3. Enter the correct Reseller and Client names.

  4. Click the Microsoft Entra ID login button.

  5. You will be redirected to the Microsoft login page. Sign in with your Microsoft account.

  6. After successful authentication, you will be redirected back to the jtel Portal.

Note: If multiple jtel Portal users have the same email address configured, a user selection page will appear after successful authentication, allowing you to choose which jtel user account to continue with.

6. Optional: Microsoft Teams SSO Integration

The jtel Portal can also be integrated into Microsoft Teams as a custom application with Microsoft Entra ID Single Sign-On (SSO).

To enable this integration, additional configuration is required in Microsoft Entra ID, including an exposed API with the access_as_user scope and authorization of the Microsoft Teams client applications.

A Microsoft Teams application must also be configured and deployed.

For the complete setup instructions, see Teams – Configure Jtel Portal in Microsoft Teams.

This configuration is not required for standard jtel Portal login.

  • No labels