Microsoft Entra directory
Connecting Microsoft Entra ID gives you sign-in with Microsoft and subject autocomplete from your directory, so technicians pick the right person instead of typing an email. For: Admins and Owners.
No app registration needed
Section titled “No app registration needed”SafeHanded runs a single multi-tenant Entra application. You connect by signing in with Microsoft and approving it once, not by creating an app registration or copying IDs. (Bring-your-own-app is available as an advanced option if you require it.)
Before you start
Section titled “Before you start”- Connect as a Global Administrator or Privileged Role Administrator of the tenant if you can. People search uses SafeHanded’s shared Microsoft app, which can read any tenant that has approved it, so SafeHanded only searches a tenant for an organisation that has proven it belongs to them. Signing in as one of these administrators is that proof, and people search works straight away.
- Anyone else can connect too, but your email domain then needs verifying under
Settings → Verification (for example
contoso.com), before or after you connect. - An administrator approves SafeHanded in the tenant once. After that, anyone can reconnect, but people search still needs one of those administrators or a verified domain.
- When an administrator’s sign-in is used this way, SafeHanded emails that account to say which organisation it was connected to and by whom.
Connect
Section titled “Connect”- Go to Settings → Integrations.
- Choose Connect → Microsoft 365. For your organisation, choose Sign-in and people search, or People search only to leave sign-in as it is. In MSP mode, choosing a client sets up people search for that client.
- Select Connect with Microsoft and sign in with your work account.
- If SafeHanded hasn’t been approved in your tenant yet, Microsoft asks an administrator to approve it. Approve it and you’re returned to SafeHanded.
- That’s it. SafeHanded reads your tenant from the sign-in, pins sign-in to it, and checks people search works. The connection shows Connected when it’s done.
Sign-in starts invite-only. To let people from your verified domains join automatically, turn on Provision new members on first sign-in when you connect, or later on the connection’s Sign-in tab, and add at least one verified email domain for it to use.
If you’re not one of those administrators and sign in with an account on a domain your organisation
hasn’t verified yet, the connection is saved and SafeHanded takes you to Settings → Verification
with the domain filled in. People search switches on by itself as soon as the domain is verified;
there’s nothing to reconnect. (Nobody can verify an onmicrosoft.com domain, so an onmicrosoft.com
account works only for a Global Administrator or Privileged Role Administrator.)
If your administrator role is eligible rather than active in Privileged Identity Management, activate it before you connect.
In MSP mode, connect each client’s tenant with Connect → Microsoft 365, choosing the client under Who is this for? and signing in as that client’s Global Administrator. If you sign in as anyone else, your organisation must verify the client’s domain.
Advanced: type the tenant ID, or use your own app
Section titled “Advanced: type the tenant ID, or use your own app”Under Advanced you can enter the Directory (tenant) ID yourself and then open the admin consent link signed in to Microsoft as a tenant administrator, or use your own app registration (application ID and secret, with the Microsoft Graph User.ReadBasic.All application permission and admin consent). Directories on your own app registration don’t need the verified-domain step.
Open the consent link from the SafeHanded browser session that shows it. It works once and lasts 15 minutes; if it has expired, reload Integrations for a new one. It only appears while the connection is waiting for consent.
See who hasn’t signed in yet
Section titled “See who hasn’t signed in yet”- With Joining groups listed, people in those groups who haven’t signed in yet show on Members.
- The list refreshes every 15 minutes.
- Sync now, at the top of the connection’s page, refreshes it straight away.
- More about the list.
Subject autocomplete
Section titled “Subject autocomplete”Once connected, typing a subject on a request or share autocompletes from your directory. In MSP mode you connect a directory per client.
Autocomplete can also draw on your PSA contacts instead of, or as well as, the directory — useful when the PSA is your source of truth for who a client’s people are. This is one setting for the whole organisation and isn’t in the app’s settings yet; email support@safehanded.com if you’d like it changed.
Sign-in options
Section titled “Sign-in options”Anyone can use Sign in with Microsoft and email + passkey on every plan. Connecting your own tenant here (pinning sign-in to it, joining automatically, Require single sign-on, people search) is on Team and above, as are OpenID Connect, SAML and SCIM.