Skip to content
TapPass

Microsoft (Entra ID)

TapPass Cloud supports Single Sign-On with Microsoft Entra ID (formerly Azure AD). TapPass is registered as a single, multi-tenant application — you do not create an app registration. To let your organization’s users sign in, an administrator grants the TapPass application admin consent in your tenant one time.

You only need this if your tenant requires admin consent for new applications (a common policy where user self-consent is disabled). If your tenant permits user consent, your users can sign in with no admin action.

Section titled “Grant admin consent”

  1. Open the admin-consent link:

    Grant admin consent to TapPass

    https://login.microsoftonline.com/organizations/v2.0/adminconsent?client_id=6685440e-7720-4662-99d7-efc52062bb7d&redirect_uri=https%3A%2F%2Fapp.tappass.ai&scope=openid+profile+email

  2. Sign in with a Global Administrator or Privileged Role Administrator account for your tenant.

  3. Review the requested permissions and click Accept. TapPass requests only openid, profile, and email — enough to verify who is signing in. It does not request access to your mailbox, files, or directory.

  4. On success you are redirected to https://app.tappass.ai. Consent now applies to your whole tenant, and your users can sign in with Sign in with Microsoft.

Troubleshooting

Section titled “Troubleshooting”

Users still cannot log in after consent — “Assignment Required”

Section titled “Users still cannot log in after consent — “Assignment Required””

If your tenant requires user assignment, add the users after granting consent:

  1. Sign in to the Microsoft Entra admin center.
  2. Go to Enterprise applications.
  3. Search for and select the TapPass application.
  4. Under Manage, click Users and groups.
  5. Click Add user/group and assign the users or groups who need access.

A regular user sees “Need admin approval”

Section titled “A regular user sees “Need admin approval””

Your tenant requires admin consent (user consent is disabled). Have a Global Administrator or Privileged Role Administrator open the admin-consent link above; once granted, the prompt disappears for everyone.

AADSTS50011 redirect/reply-URL mismatch

Section titled “AADSTS50011 redirect/reply-URL mismatch”

The redirect_uri in the link isn’t a registered reply URL on the TapPass application. Use the exact link on this page rather than a hand-built one. If it persists, contact your TapPass representative.