This guide is for IT administrators setting up Frontitude so their organization's users can sign in with their corporate Microsoft accounts via Microsoft Entra ID (formerly Azure AD).
Frontitude is published in the Microsoft Entra application gallery. Adding it to your tenant and granting admin consent is a one-time, ~5-minute task and unlocks Single Sign-On (SSO) for all your team members — with full support for your existing Conditional Access and MFA policies.
Who should follow this guide
- A user with one of the following roles in Microsoft Entra ID: Global Administrator, Cloud Application Administrator, or Application Administrator.
- You should have a Microsoft Entra ID tenant (any tier — including the free tier — works).
💡 If you are an end user trying to sign in to Frontitude with your work account and are seeing a "Need admin approval" message, share this guide with your IT team.
1. Add Frontitude from the Microsoft Entra gallery
- Go to the Microsoft Entra admin center.
- In the left navigation, choose Identity → Applications → Enterprise applications.
- Click + New application.
- In the gallery search, type Frontitude and select it from the results.
- (Optional) Rename the app for your tenant, then click Create.
2. Grant admin consent for your tenant
Granting admin consent is what allows users in your tenant to sign in to Frontitude without each one being prompted to approve permissions individually.
- Open the Frontitude enterprise app you just created.
- Go to Security → Permissions.
- Click Grant admin consent for <your tenant>.
- Review the requested permissions and approve.
Frontitude requests only the minimum permissions required to identify the signing-in user:
openid,profile,email— to identify the user signing in.User.Read— to read the user's basic profile from Microsoft Graph.
💡 Frontitude does not request access to mailboxes, files, calendars, or directory-wide data.
3. (Optional) Restrict who can use Frontitude
By default, any user in your tenant can sign in to Frontitude. If you want to limit access to specific users or groups:
- In the Frontitude enterprise app, go to Properties.
- Set Assignment required? to Yes and click Save.
- Go to Users and groups → + Add user/group and assign the users or security groups that are licensed for Frontitude.
4. (Optional) Add Frontitude to the Microsoft 365 app launcher
To give users a one-click entry point to Frontitude from their Microsoft 365 environment:
- In the Frontitude enterprise app, go to Properties.
- Set Visible to users? to Yes.
Users will then see a Frontitude tile at myapps.microsoft.com and in the Microsoft 365 app launcher.
5. (Optional) Invite your users to Frontitude
Once admin consent is granted, invite your team members to your Frontitude workspace. They will accept the invite and sign in with their corporate Microsoft account — your tenant's normal sign-in flow (including MFA and Conditional Access) applies automatically.
Follow the steps in Invite members to your workspace to send invites from Frontitude.
💡 New users are just-in-time provisioned in Frontitude when they accept the invite, using their Microsoft Entra profile (name, email). No SCIM setup is required.
6. Conditional Access, MFA, and deprovisioning
- Conditional Access: Frontitude honors any Conditional Access policies you target at the app — MFA, device compliance, location restrictions, session controls, etc.
- MFA: If your tenant enforces MFA, users will be challenged as usual during the Frontitude sign-in flow.
- Deprovisioning: To remove a user's access, either remove them from the app's assignments (if assignment is required) or disable their account in Microsoft Entra. They will lose access at their next token refresh.
Troubleshooting
Users see a "Need admin approval" screen on first sign-in.
Admin consent has not been granted. Re-run Step 2.
Error AADSTS50105: "The signed in user is not assigned to a role for the application."
You enabled Assignment required in Step 3 but this user is not in any assigned group. Add the user or their group to the app's Users and groups list.
Can't find Frontitude in the gallery.
Make sure you're searching from Enterprise applications → New application, not from App registrations. The gallery search is case-insensitive and matches partial words.
Need help?
If you run into anything that isn't covered above, contact support@frontitude.com and include your tenant ID and the UPN (user principal name) of the affected user — that gives us everything we need to help quickly.
