Setting up Single Sign-On (SSO) with Microsoft 365

Applies to: Workspace Admins on the Business and Enterprise plans, or with any license on your own server (on-premise) · Time: about 20 minutes, plus DNS update time

Overview

Single sign-on (SSO) lets your team sign in to Digital Workspace with their Microsoft 365 work accounts instead of a separate password. When someone leaves the company and IT turns off their Microsoft account, they lose access to Digital Workspace too.

The setup has four parts. Do them in this order:

1. Register Digital Workspace as an app in Microsoft Entra (your Microsoft 365 directory).
2. Connect that app in Workspace settings and test it with your own work account.
3. Verify your company's email domain with a DNS record.
4. Choose the rules: require SSO for everyone, and whether new people join automatically.

Who does what

Before you start

• You are a Workspace Admin in Digital Workspace, and your Digital Workspace email is your Microsoft 365 work email (for example you@yourcompany.com).
• You can sign in to the Microsoft Entra admin center (entra.microsoft.com) as a Global Administrator, Application Administrator or Cloud Application Administrator. If you can't, send this article to your IT team.
• You can add a TXT record to your company domain's DNS, or you know who can.
• Your workspace is on the Business or Enterprise plan. On other plans the Single sign-on card shows an upgrade option instead. On your own server (on-premise), SSO is available with any license.

On your own server (on-premise)

SSO works the same way, with four extra points:

• Turn on HTTPS first with a server name (see "Turning on HTTPS" in the On-premise Administrator Guide). Microsoft accepts only https:// redirect URLs.
• The Redirect URL on the Single sign-on card is built from the Web address in Workspace settings › Mail server. Check that it is your HTTPS address before you copy it into Entra.
• The server must reach login.microsoftonline.com on the internet. An offline server can't use Microsoft 365 sign-in.
• Part 3 checks the TXT record through the DNS servers your server uses. If your company's internal DNS answers for your domain, add the record there as well. People added automatically count toward the seats in your license.

Part 1: Register the app in Microsoft Entra

1. In Digital Workspace, open Workspace settings → Security and find the Single sign-on card. Under Connect Microsoft 365, click Copy next to Redirect URL (paste into Entra). Keep this tab open.
2. In a new tab, sign in to entra.microsoft.com.
3. Open App registrations (in the left menu under Entra ID or Identity → Applications, depending on your portal version, or type it in the search box at the top) and click New registration.
4. Fill in the form:
   • Name: Digital Workspace. Your team sees this name on the Microsoft sign-in page.
   • Supported account types: Accounts in this organizational directory only (Single tenant).
   • Redirect URI: choose the platform Web and paste the Redirect URL you copied. It must match exactly.
5. Click Register. The app's Overview page opens.
6. Copy two values from Overview. You'll paste them in Part 2:
   • Application (client) ID
   • Directory (tenant) ID
7. Open Certificates & secrets → Client secrets and click New client secret. Enter a description (for example Digital Workspace SSO), choose an expiry (12 or 24 months is typical) and click Add.
8. Immediately copy the secret's Value and note its Expires date.

   Copy the Value column, not the Secret ID. Microsoft shows the Value only once. If you leave the page without copying it, delete the secret and create a new one.

Recommended: limit who can sign in

By default, anyone in your Microsoft directory can use the app. To allow only the people who should use Digital Workspace:

1. In Entra, open Enterprise applications (next to App registrations) and select Digital Workspace.
2. Under Properties, set Assignment required? to Yes and click Save.
3. Under Users and groups, click Add user/group and assign the people or groups who should have access.

Part 2: Connect and test in Digital Workspace

1. Back in Workspace settings → Security → Single sign-on, fill in Connect Microsoft 365:
   • Directory (tenant) ID
   • Application (client) ID
   • Client secret: paste the secret Value
   • Secret expires on: the Expires date from Entra. Admins are alerted 30 and 7 days before it.
2. Click Save. Digital Workspace checks the secret with Microsoft before saving it. When it's accepted you see Saved. Now test the connection. The secret is stored encrypted and is never shown again.
3. Click Test connection. You are sent to Microsoft. Sign in with your own work account, the same email as your Digital Workspace account.
4. You return to Settings with one of these messages:
   • Connection works — you signed in with Microsoft. Continue to Part 3.
   • Connection works, but you signed in to Microsoft with a different email… The connection is fine, but run the test again with your own work account. You can't require SSO until you do.

Part 3: Verify your email domain

Digital Workspace sends people to Microsoft based on their email domain. You prove that your company owns the domain with a DNS record.

1. Under Your email domains, type your domain (for example yourcompany.com) and click Add domain.
2. The domain appears as Waiting for DNS, with a Name and a Value. At your DNS provider, create a TXT record:

   Type	Name / Host	Value
   TXT	_dw-verify (shown in full as _dw-verify.yourcompany.com)	dw-verify= followed by your code, exactly as shown

3. After saving the record, click Check now. When the record is found the domain shows Verified. If you see The record isn't visible yet, wait a few minutes and check again. DNS changes can take up to an hour.
4. Repeat for every email domain your team uses.

Keep the TXT record in place. Digital Workspace re-checks it every day. If it is missing for two days, the domain stops being verified and all admins are notified. Public email domains such as gmail.com or mail.ru can't be added, and a domain can be verified by only one workspace. A domain that is never verified is removed after 14 days.

From now on, anyone who types an email from a verified domain on the sign-in page sees Continue with Microsoft 365.

Part 4: Choose the rules

1. Require SSO: passwords stop working for this workspace, and everyone signed in with a password (except admins) is signed out. This switch is available only after Test connection passed with your own work account and at least one domain is verified, so you can't lock yourself out. Confirm the prompt to turn it on.
2. Add new people automatically: someone from a verified domain who signs in for the first time joins the workspace without an invite. They can sign in only with SSO, and they count toward your plan's user limit.
3. Give them the role: the access role that automatically added people receive. The Admin role can't be the default.
4. Click Save rules.

People who sign in with SSO are asked to sign in again every 12 hours. Someone turned off in Microsoft therefore loses access within 12 hours at most.

What your team sees

1. On the sign-in page they enter their work email and click Continue.
2. They click Continue with Microsoft 365, sign in on Microsoft's page, and return straight to the workspace.
3. Existing members: the first Microsoft sign-in links their account. From then on they sign in with Microsoft. Their old Digital Workspace password stops working and their other sessions are signed out.

Backup sign-in for admins

If Microsoft sign-in is down while SSO is required, a Workspace Admin can still get in: on the sign-in page, under Workspace admin and Microsoft isn't working?, choose Sign in with password. Each backup sign-in is logged, and the other admins get a bell notification and an email.

Day-to-day administration

• Replacing the client secret: before the secret expires, create a new one in Entra (Part 1, steps 7–8). Paste it in Client secret, update Secret expires on and click Save. SSO keeps working and no new test is needed. Then delete the old secret in Entra.
• Changing the tenant or app: if you change the Directory (tenant) ID or the Application (client) ID, run Test connection again. Until you do, SSO isn't required and current SSO sessions are signed out.
• Activity: Recent single sign-on activity at the bottom of the card shows connections, tests, domain changes, sign-ins and backup sign-ins.
• Turning SSO off: click Turn off SSO and confirm. People sign in with passwords again. Anyone who only ever used SSO sets a password with Forgot password? on the sign-in page.

Troubleshooting