➤ Product: OfficeRnD Flex
➤ Who: Admins with access to Settings
➤ Where: On the Admin Portal, under Settings > Authentication & SSO, and in the Microsoft Entra admin center
➤ Availability: Included on Scale. Paid add-on on Grow. Essentials and Start do not include it.

If your company uses Microsoft 365, each admin and member keeps one more password only for OfficeRnD Flex. When someone leaves, that password keeps working until an admin removes the account. With single sign-on (SSO) through Microsoft Entra ID, people log in with the Microsoft account your company already manages, and you control access in Microsoft Entra ID.

Microsoft Entra ID is the new name for Azure Active Directory (Azure AD). The setup connects 1 app registration in Microsoft Entra ID to 1 or both SSO integrations in OfficeRnD Flex: Members SSO Authentication for the Member Portal and the Members app, and Admins SSO Authentication for the Admin Portal.

Which setup fits your space: your team, your members, or both
Which people must exist in OfficeRnD Flex before they log in
Give external members SSO access as guests in your directory
What to do before the client secret expires
Not covered here: members without a Microsoft account. Single sign-on (SSO) with Azure AD B2C →

Before you start

Collect the following before you start. Each item blocks the setup if it is missing.

A Microsoft Entra ID user with permission to register applications. You copy 3 values from the app registration later.
Access to Settings on the Admin Portal.
The same email address for each person in OfficeRnD Flex and in Microsoft Entra ID. SSO does not create members or admins. A person who exists in only 1 of the 2 places cannot log in.
A test account that exists in both places. Test SSO before you turn off password login, so a wrong setting does not lock anyone out.

Choose the setup for your space

Each setup in the following table starts with 1 app registration in Microsoft Entra ID. The setups differ in which OfficeRnD Flex integration you connect and which settings you turn on afterward. Register the app in Microsoft Entra ID ↓

What you want	Who logs in with Microsoft	What you connect in OfficeRnD Flex	What completes the setup
Your team logs in to the Admin Portal with their work accounts. When a teammate leaves, you remove access in Microsoft Entra ID.	Your admins	Admins SSO Authentication Connect the Admin Portal ↓	Turn on Enforcing SSO after a test login. Without Enforcing SSO, a removed teammate can still log in with the OfficeRnD password. Enforce SSO for admins ↓
Your members are employees in your Microsoft directory, for example, in a corporate or in-house space.	Your members	Members SSO Authentication Connect the Member Portal ↓	Turn on Account Activation, so existing members log in without an invitation. Turn on Turn Off Password Login to make Microsoft the only way in. Choose the member login settings →
External members log in through your directory without a full account there.	Members you invite as guest users	Members SSO Authentication Connect the Member Portal ↓	Invite each member as a guest with the same email address as on their member profile. Invite members as guest users ↓
Only some people in your directory can use OfficeRnD Flex, for example, your community team.	The people you assign	Connect Members SSO Authentication, Admins SSO Authentication, or both.	Set Assignment required? to "Yes" in Microsoft Entra ID, and assign the people. Limit SSO to selected people ↓
Your team and your members both log in with Microsoft.	Admins and members	Connect both integrations to 1 app registration. Start with the Member Portal. Connect the Member Portal ↓	Add 2 redirect URIs to the app registration, 1 for each integration. Connect the Admin Portal ↓

The article Set up single sign-on (SSO) explains what each setting in OfficeRnD Flex changes for your members and admins.

Register OfficeRnD Flex in Microsoft Entra ID

The app registration is the record in Microsoft Entra ID that trusts OfficeRnD Flex. It gives OfficeRnD Flex 3 values: a client ID, a client secret, and your tenant ID. Keep 2 browser tabs open, because you copy values in both directions.

Important: Copy the client secret Value immediately after you click Add. Microsoft Entra ID shows the Value only once. Login fails if you copy the Secret ID instead.

Do the following steps in order.

In OfficeRnD Flex, go to Settings > Authentication & SSO.
Click Activate next to Members SSO Authentication. If you set up SSO for admins only, click Activate next to Admins SSO Authentication instead.
Click Configure and copy the Return URL. Microsoft Entra ID sends people back to this address after they log in.
In a second tab, open the Microsoft Entra admin center ↗︎, and go to App registrations.
Click New registration. Enter a name that your team recognizes, for example, OfficeRnD Flex.
Under Redirect URI, select Web, and paste the Return URL.
Click Register. The Overview page of the app opens.
Copy the Application (client) ID and the Directory (tenant) ID.
Go to Certificates & secrets, and click New client secret.
Enter a description, select an expiry period, and click Add. Note the expiry date, because SSO stops on that date.
Copy the text in the Value column.

Connect SSO for the Member Portal

Microsoft Entra ID now trusts OfficeRnD Flex, but the integration in OfficeRnD Flex is still empty. Return to the OfficeRnD Flex tab, where the Edit Authentication Integration dialog is still open.

Paste the Application (client) ID into Client ID.
Paste the secret Value into Client Secret.
In Discovery URL, enter the following address. Replace {Tenant ID} with your Directory (tenant) ID.
https://login.microsoftonline.com/{Tenant ID}/v2.0/.well-known/openid-configuration
In Title, enter the button text, for example Log in with Microsoft. Then set Account Activation and Turn Off Password Login for your setup. Decide how your members log in →
Click Update.
Open the Member Portal in a private browser window, and log in with SSO with your test account. The test confirms the setup while password login still works as a fallback.

Connect SSO for the Admin Portal

Admin SSO Authentication connects the Admin Portal to the same app registration as the Member Portal. It has its own Return URL, and Microsoft Entra ID rejects any redirect URI that it does not have on file.

If you set up SSO for admins only, you added the Return URL of Admins SSO Authentication when you registered the app. Start at step 6.

In OfficeRnD Flex, go to Settings > Authentication & SSO, and click Activate next to Admins SSO Authentication.
Click Configure, and copy the Return URL.
In Microsoft Entra ID, open the app registration and go to Authentication.
Under Web, click Add URI, and paste the Return URL. Keep the first redirect URI, because Member Portal login stops working without it.
Click Save.
In OfficeRnD Flex, enter the Client ID, Client Secret, and Discovery URL. If you connected the Member Portal first, use the same 3 values.
Click Update, and log in to the Admin Portal with SSO in a private browser window.

If you turn on Enforcing SSO with the wrong setting, every admin loses access to the Admin Portal. Complete the checks first. Enforce SSO for your admin teammates →

Choose who in your directory can log in

Your integrations now accept logins. By default, each person in your Microsoft Entra directory who also exists in OfficeRnD Flex can log in with SSO.

Limit SSO to selected people

Use this setting when only part of your directory needs OfficeRnD Flex. A person without an assignment sees a Microsoft error with the code AADSTS50105 and cannot log in.

In Microsoft Entra ID, go to Enterprise applications and open the app that you registered.
Go to Properties, and set Assignment required? to "Yes".
Click Save.
Go to Users and groups, click Add user/group, and select the people or groups that can log in.

Add external members as guest users

Members from outside your organization can log in through your directory as guest users. A guest logs in with their own email address, so you do not create a full account for them in your directory.

OfficeRnD Flex matches each guest by email address. The email address on the guest invitation must be the same as the email address on the member profile in OfficeRnD Flex. To invite a guest, go to Users in Microsoft Entra ID, click New user, and select Invite external user.

Replace the client secret before it expires

Each client secret in Microsoft Entra ID has an expiry date. After the secret expires, nobody can log in to OfficeRnD Flex with SSO until you enter a new secret. Replace the secret before the expiry date that you noted.

In Microsoft Entra ID, open the app registration and go to Certificates & secrets.
Click New client secret, and copy the new Value.
In OfficeRnD Flex, go to Settings > Authentication & SSO, and click Configure on each SSO integration that you connected.
Paste the new Value into Client Secret, and click Update.
Log in with SSO in a private browser window. After the login works, delete the old secret in Microsoft Entra ID.

FAQ

Does SSO add my Microsoft Entra users to OfficeRnD Flex?
SSO does not add people from Microsoft Entra ID to OfficeRnD Flex. SSO only confirms the login of a person who exists in both places with the same email address. Add each member or admin in OfficeRnD Flex first. Invite a member to the Member Portal and the Members app →

Why does OfficeRnD Flex say the user does not exist after a successful Microsoft login?
OfficeRnD Flex shows this message when it finds no member or admin with the email address that Microsoft Entra ID sent. Microsoft Entra ID accepted the login, but OfficeRnD Flex has no profile with that email address. Compare the email address in Microsoft Entra ID with the email address on the profile in OfficeRnD Flex.

Can each member company log in with its own Microsoft Entra ID?
Members SSO Authentication connects to 1 app registration, so all members log in through 1 Microsoft Entra directory. Employees of a member company can log in through your directory as guest users. Invite each employee as a guest with the email address on their member profile.

Does admin SSO also log admins in to the Member Portal?
Admin SSO Authentication covers only the Admin Portal. On the Member Portal, an admin logs in with Members SSO Authentication if you connected it, or with the email and password.

Can we require MFA for OfficeRnD Flex logins?
You require multi-factor authentication (MFA) for SSO logins in Microsoft Entra ID. Microsoft Entra ID applies its sign-in rules, such as MFA and Conditional Access, each time a person logs in with SSO. A person who logs in with the OfficeRnD email and password skips those rules. To close that path, turn on Turn Off Password Login for members and Enforcing SSO for admins.

Can I keep 1 admin account outside Enforcing SSO as a backup?
Enforcing SSO applies to every admin in the organization, and you cannot exclude 1 admin account. If you lose access after you turn on Enforcing SSO, contact OfficeRnD support.

What if the client secret expired and no admin can log in?
When the client secret expires and Enforcing SSO is turned on, contact OfficeRnD support to turn off Enforcing SSO. You can then log in with the OfficeRnD email and password and enter a new secret. When Enforcing SSO is turned off, admins can log in with the email and password and replace the secret immediately.

Set up SSO with Microsoft Entra ID

In this article: