Important: to be able to follow this guide, you'll need a user account for Microsoft Azure with sufficient permissions to create and edit Entra ID App registrations.
Step-by-step configuration guide
1/6 - Open the Entra ID portal
Go to portal.azure.com and sign in to the Azure portal.
Navigate to 'Microsoft Entra ID'.
Select 'App registrations' in the side menu.
2/6 - Create a new App registration
Click the 'New registration' button at the top of the App registrations overview.
Provide the required app information:
Name: Enter a meaningful application name (e.g. 'Spencer SSO')
Supported account types: Select 'Single tenant only'
Redirect URI: Select 'Web' and fill in the following redirect URI: https://spencerlogin.b2clogin.com/spencerlogin.onmicrosoft.com/oauth2/authresp
Click 'Register' at the bottom of the page to create the App registration.
3/6 - Take note of the App registration identifiers
Note down these identifiers from the newly created App registration:
Application (client) ID
Directory (tenant) ID
4/6 - Add the UPN attribute
Navigate to 'Token configuration' in the sidebar.
Click 'Add optional claim', select token type 'ID', check 'upn' and click 'Add'.
5/6 - Create a client secret
Navigate to 'Certificates & secrets' in the sidebar.
Click 'New client secret'. Provide the necessary details:
Description: e.g. "Spencer SSO secret 2026"
Expiry date: we recommed to select 365 days (i.e. 1 year)
The click 'Add'. Immediately note down the new secret's Value and Expiry date.
Warning: you can only view and copy the client secret right after the initial creation.
6/6 - Grant the necessary permissions
Navigate to 'API permissions' in the sidebar.
Click 'Add a permission', then 'Microsoft Graph', then 'Delegated permissions'.
Select 'email', 'openid' and 'profile', then click 'Add permissions'.
Again click 'Add a permission', then 'Microsoft Graph', then 'Application permissions'.
Select 'User.Read.All' and 'User.ReadBasic.All', then click 'Add permissions'.
Finally click 'Grant admin consent for Spencer' and confirm.
Share credentials with Spencer
Send over these parameters to Spencer, as they are needed for finalizing the SSO configuration on our end:
Parameter | Example |
Application (client) ID | 92f82a25-9ad6-426c-87c2-ced41dc47bf2 |
Directory (tenant) ID | 1dcd0d57-3cdc-450f-87e9-4ad46e61bfee |
Secret value | BvM8Q~SZvctD9d2ZBOU7qhqhsBCJnH_2yVJ-Ucv |
Secret expiration date | 10/03/2027 |
Note: as these are sensitive secrets, please do not send them directly via email. Instead, use e.g. your password manager or a website like https://onetimesecret.com to deliver them to us in a secure way.
Questions? Need help?
Please contact Spencer Support. We're happy to assist you with these steps via mail, phone or video call!