How do I enable SSO in Nightingale

These are the steps you need to follow to set up your Microsoft Entra to connect to Nightingale for the SSO integration.

note

If you will be using the SharePoint integration alongside the SSO integration, please make sure to read the additional instructions in the article below:

Microsoft Entra Integrations

If you will be using the SharePoint integration alongside the SSO integration, please make sure to read the additional instructions in the article below:

Microsoft Entra Integrations

Azure Configuration

For this section, you will need someone with admin-level access to your Azure tenant.

In Microsoft Azure, open Microsoft Entra ID. Then perform the following:

Domain

1. In the left-side panel, under “Manage”, select “Custom domain names”
2. One of the domains here should be of the form “{sometext}.onmicrosoft.com”
3. Note down this onmicrosoft.com domain for later.

App Registration

1. In the left-side panel, select “App registrations”, in the “Manage” section
2. Select “New registration” up the top of the page to create a new app registration
3. In the “Overview” page for your new app registration, note down the following values for later:
   1. Application (client) ID
   2. Directory (tenant) ID

Authentication

1. In the new app registration, go to the “Authentication”, found in the “Manage” section of the left-side panel
2. Click on “Add a platform”. This will open a panel on the right of the screen where you can set up the following:
   1. Select “Web”
   2. 
   3. Add your Nightingale site’s login URL in the “Redirect URIs” section, and as the “Front-Channel logout URL”.
      1. e.g. https//ng-{your app code}.azurewebsites.net/Default
      2. Don’t forget the /Default - it is necessary for the login flow to work
   4. Under “Implicit grant and hybrid flows”, check the box for ID tokens (used for implicit and hybrid flows)

   5. Once you’re done, it should look like this:

      

   6. If so, click “Configure” to save these values and close the panel
3. Under “Supported account types”, choose Accounts in this organizational directory only
4. At the bottom of the page, click Save

API permissions

1. Still in the new app registration, go to API permissions, also in the “Manage” section of the left-side panel
2. You should see the “User.Read” permission has already been added, this happens automatically when you create a new app registration
   1. If the permission is not present, click on “Add a permission”. This will open a panel on the right where you can do the following:
      1. Select “Microsoft Graph”
      2. Choose “Delegated permissions”

      3. Scroll all the way down to the section “User”, and tick “User.Read”, then click “Add permissions” at the bottom of the panel.

         

   2. Depending on your security settings, you may need to grant admin consent for this application to use this permission. If so, there is a button for that next to the “Add a permission” button, just above the table of permissions:

      

3. If you had to make any changes to enable the “User.Read” permission, scroll down and click “Save”.

What to Send to Nightingale

To enable the SSO integration, we need the three pieces of information which you have noted down in the previous sections.

• onmicrosoft.com domain
  • alternatively, your http://sharepoint.com domain will also work
  • The part before .sharepoint.com in your SharePoint domain will likely match the part before .onmicrosoft.com in your Microsoft domain
• Application/Client ID
• Tenant ID

Notes

• To log in via SSO, a staff member’s email address in Nightingale must match the email they use to log in to Microsoft
• Enabling SSO does not prevent users from logging in with their Nightingale accounts using the normal login form
  • Staff who do not have logins for your Microsoft tenant can log in to Nightingale this way