Set Up Microsoft Entra ID Single Sign-On (OIDC) for SparkToro

SparkToro supports Single Sign-On using OpenID Connect (OIDC) with Microsoft Entra ID (formerly Azure Active Directory). Once configured, your team signs in to SparkToro with their Entra credentials, and new users are provisioned automatically on first sign-in up to your account's seat limit.

Supported Features

This integration supports the following features:

• SP-Initiated SSO: users start at SparkToro's sign-in page (https://sparktoro.com/account/login/sso) and authenticate with Entra ID.
• IdP-Initiated SSO: users launch SparkToro from the Microsoft My Apps portal.
• Just-In-Time (JIT) Provisioning: new users are created in SparkToro automatically on their first successful sign-in, up to the account's seat limit.

Prerequisites

• A SparkToro account on an Agency plan with Single Sign-On included.
• Microsoft Entra ID administrator access.
• You are the owner of the SparkToro account. Single Sign-On is configured by the account owner.
• Each user has an email address on their Entra ID profile. SparkToro requires an email address from your identity provider to sign a user in. Entra ID only sends the email claim when the user's profile has a mail attribute, so confirm your users have one before enabling SSO. See Step 3.

Step 1: Register an application in Entra ID

1. In the Microsoft Entra admin center, go to Identity > Applications > App registrations.
2. Click New registration and give it a name, for example SparkToro.
3. Under Redirect URI, select platform Web and enter: https://sparktoro.com/account/entra/callback
4. Click Register.
5. On the application Overview page, copy the Application (client) ID and the Directory (tenant) ID.

Step 2: Create a client secret

1. In the application, go to Certificates & secrets.
2. Click New client secret, add a description and expiry, then click Add.
3. Copy the secret Value immediately. You will not be able to view it again after you leave the page.

Step 3: Ensure the email claim is sent

SparkToro identifies users by email, so Entra ID must include an email address in the token.

1. In the application, go to Token configuration.
2. Click Add optional claim, choose token type ID, select email, and save.
3. Confirm each assigned user has a mail attribute on their Entra profile. Users without one will not be able to sign in.

Step 4: Assign users

1. In the Microsoft Entra admin center, go to Identity > Applications > Enterprise applications and open the SparkToro application.
2. Under Users and groups, assign the people or groups who should have access. Only assigned users can sign in.

Step 5: Enter the credentials in SparkToro

1. In SparkToro, go to Account > Settings > Single Sign-On.
2. Select Microsoft Entra ID as your identity provider.
3. Enter the following:
   • Issuer URL: https://login.microsoftonline.com/<tenant-id>/v2.0, replacing <tenant-id> with your Directory (tenant) ID from Step 1.
   • Client ID and Client Secret from Steps 1 and 2.
4. Add your organization's email domain (for example yourcompany.com).
5. Click Test Connection. SparkToro validates the issuer's discovery document.
6. Click Save and Enable SSO.

After you enable SSO, SparkToro enforces it for users on your verified email domain. The account owner keeps password access as a fallback so you are never locked out of billing.

Signing in

• SP-initiated: users go to https://sparktoro.com/account/login/sso, enter their work email, and authenticate with Entra ID.
• IdP-initiated: users open the SparkToro tile in the Microsoft My Apps portal.

Either way, new users are provisioned automatically on first sign-in (just-in-time), up to your account's seat limit.

Troubleshoot

• "Your identity provider did not share an email address": the signed-in user has no mail attribute on their Entra profile, or the email optional claim is not configured. Complete Step 3, confirm the user has an email address, then try again.

Reference

• Sign-in redirect URI: https://sparktoro.com/account/entra/callback
• Issuer URL: https://login.microsoftonline.com/<tenant-id>/v2.0
• Scopes: openid, email, profile

Support

If you have questions or need to enforce SSO across more than one email domain, email support@sparktoro.com.