Spotlight can use SSO from your Azure Active Directory, you just need to walk through a simple process to set this up.
Before you can start the setup, you’ll need your SSO configuration details from a member of the Spotlight team. These will include two urls:
- The callback URL - used for setting Stax Spotlight up in Azure AD and telling it where to send the response. As an example here, we’ll use https://app.stax.io/auth/azure_ad/my-token-here/callback
- The trigger / initiation URL - Use an example here, we’ll use https://app.stax.io/auth/azure_ad/my-token-here
Next, you’ll need access to the Azure console as someone with permissions to configure everything. Whilst logged into the console, you must then:
- From the header, search for “App registrations”
- Click “New registration”
- For name, enter “Stax Spotlight”
- For “Supported account types”, Ensure “Accounts in this organizational directory only” is selected
- Choose “Client Application” for the Platform configuration.
- Press “Register” to create the application.
- Press “Add a platform” to add a new platform
- Choose “Web” for the type of the application.
- In the redirect field above, provide your callback URL, e.g. https://app.stax.io/auth/azure_ad/my-token-here/callback
- Press “Configure”
- On the left, press “Certificates & Secrets”
- Hit “New client secret”.
- Give the secret a description of “Stax Spotlight SSO”, and choose “Never” for expires.
- Capture the value of the newly-added Client Secret, to send to us.
- Go back to overview, and capture the value of “Application (client) ID”, to send to us.
Now, once you have those values, please send us the “Application (client) ID” value and the Client Secret value so that we can then configure it from our side. We will also need your Azure AD "Tenant ID", which is the final bit of information. Once set up, we’ll work with you to test that your SSO is correct and then enable it.
From then on, you can either directly hit your Trigger URL to login, or alternatively, if provide us an email domain, will automatically trigger all logins for that domain to go via your connection.