Setting up Microsoft sign-in

Microsoft sign-in lets your team sign in to PayMidWare with their Microsoft 365 (Microsoft Entra ID) work account instead of typing a PayMidWare password. People still have to be invited to PayMidWare first; Microsoft sign-in only replaces the password. The account owner (or a PayMidWare full administrator) sets it up once.

1. Register an app in Microsoft. In the Microsoft Entra admin center create an App registration for PayMidWare and choose single tenant (accounts in this organizational directory only). Add a Web redirect address. The exact address is shown at the top of the Microsoft sign-in page in PayMidWare; it ends in /Account/Sso/Callback.

2. Add the claims. Under Token configuration add the optional claims email, xms_edov and amr for ID tokens. They let PayMidWare see the address, whether Microsoft has verified its domain, and whether the person used multi-factor.

3. Create a client secret. Under Certificates and secrets create a secret and copy its VALUE straight away, because Microsoft shows it once. Paste it into the secret box on the PayMidWare page. PayMidWare keeps it encrypted and can never show it again, so nobody else needs to see it. Note the expiry date you give; PayMidWare emails the account owner 30 days before it ends so you can replace it.

4. Enter the details in PayMidWare. Copy the Application (client) ID and the Directory (tenant) ID from the app registration into the page, turn Microsoft sign-in on and save. The directory cannot be changed afterwards; to use a different one, remove the connection and set it up again.

5. Prove your email domain (companies). People are matched to their PayMidWare user by email address, and only for domains you have proved you control. Add your domain on the page, publish the TXT record it shows at _paymidware-verification.yourdomain.com and choose Verify. Free mail domains such as gmail.com cannot be used.

6. Try it. Choose Test sign-in with Microsoft. A successful test is what allows you to make Microsoft sign-in required.

What changes for people.

• On the sign-in page they choose Sign in with Microsoft. The first time, PayMidWare links their Microsoft account to their PayMidWare user. After that the link follows their account, so a renamed email address still works.
• If Microsoft says the person used multi-factor and you left Accept Microsoft''s multi-factor ticked, PayMidWare asks for no second code. If not, your PayMidWare two-factor rules apply as usual.
• Guest accounts invited from other organizations are refused unless you tick the guest option.
• Nobody is created by signing in. Deactivating a user in PayMidWare ends their access straight away.

Making it required. Once a test has worked you can require Microsoft sign-in, which turns off the PayMidWare password for everyone covered. Before you can, name up to five people who may still use a password in an emergency (the break-glass list). Choose people you can reach, such as the account owner, and keep the list short. If Microsoft is ever unavailable, they can still get in.

Where to find it. Providers: Users, then Microsoft sign-in. Merchants: Users, then Microsoft sign-in. PayMidWare does not read your mailbox, calendar or directory: it asks Microsoft only who the person is.