Book a Demo
Skip to main content
How can we help?
← Back to LocoDELEGATIONS Help
Print

Microsoft Entra ID SSO troubleshooting and FAQs

Posted
Updated
ByAdrian Sole

Find concise answers to common Microsoft Entra ID SSO questions below. For detailed configuration guidance, use the setup, access-control, testing and client-secret renewal guides in this section.

Microsoft Entra ID SSO FAQs

Contact support@locosoft.co.nz. Agree on a secure method before transferring a client-secret value.

The council should select an expiry period that complies with its own security policy. Record the expiry date and coordinate renewal with LocoSOFT before it expires.

Set "groupMembershipClaims": "SecurityGroup" in the app registration manifest. This allows LocoDELEGATIONS to read the user’s security-group memberships during SSO authentication.

No. Group memberships are used for authorisation and role checking; the groups themselves are not provisioned into the application.

Yes. The council can assign selected users or groups to the Microsoft Entra enterprise application and require assignment for access. LocoDELEGATIONS also checks nominated security-group memberships for application roles.

No. SCIM provisioning is not currently supported.

Yes. When an authorised user signs in through SSO for the first time, LocoDELEGATIONS automatically creates their account if it does not already exist.

Troubleshooting

The user cannot authenticate

  • Confirm the user is assigned to the enterprise application where assignment is required.
  • Confirm the app registration uses the correct council-specific sign-in redirect address.
  • Check that the client secret has not expired.
  • Confirm the user is signing in with an account from the correct Microsoft Entra tenant.

The user signs in but has the wrong permissions

  • Confirm membership of the intended Administrator or Editor security group.
  • Check that the correct group Object IDs were supplied to LocoSOFT.
  • Confirm the manifest includes "groupMembershipClaims": "SecurityGroup".
  • Allow time for a recent Microsoft Entra group-membership change to take effect, then sign out and test again.

What should be sent to support?

Provide the council name, environment address, affected user’s email address, approximate time of the test, expected role and the exact non-sensitive error message. Never send a password, authentication token or client secret in an ordinary support request.

Table of Contents