Articles on: Settings & configurations

Securing domain name with Microsoft SSO

Maglr can protect a published domain with Microsoft Single Sign-On (SSO), so only people who sign in with their Microsoft account and match the domain's access filter, such as your organization's email domain, can view the publications on that domain. SSO is available with an Enterprise license.


A domain protected with SSO is not visible to search engines. Other ways to secure a domain are Secure with manual password, Secure using an auto-login URL, and, depending on your account, Secure with email login and Secure with IP filter.


Where Microsoft SSO applies


Maglr uses one Microsoft connection, the Maglr app, for two separate uses:


  • Published domains: SSO protects a domain such as internal.companyname.com. Only users who sign in with Microsoft and match the access filter Maglr sets for that domain (for example, your email domain or a security group) can view its publications.
  • Dashboard access: editors and designers sign in to the Maglr dashboard with their Microsoft account. This requires an existing Maglr user account linked to their Microsoft account; by default, both must use the same email address. The access filter for domains does not apply to dashboard sign-in. To set up dashboard SSO, see Enable single sign-on for your account.


The Maglr app and its consent in Microsoft Entra are shared by both uses. The rest of this article covers SSO for published domains.


Example: internal publications for employees


SSO suits publications meant for employees only. If your organization uses Microsoft 365 or Microsoft Entra ID (formerly Azure AD), employees can open a domain such as internal.companyname.com with the Microsoft account they already use. This article uses Microsoft as the example because many organizations use it. Maglr can set up similar integrations with other identity providers, such as Google or Okta.


Authentication protocol


Maglr's Microsoft SSO uses the OpenID Connect (OIDC) protocol on top of OAuth 2.0. It does not use SAML. Sign-in runs against the Microsoft identity platform (v2.0 endpoints).


  • Identity: after sign-in, Microsoft returns a signed OIDC token. This token proves who the user is.
  • Access: the same sign-in gives Maglr the user's profile and, if your administrator sets it up, their group membership. Maglr uses this information to apply the access filter.
  • No app registration needed: the Maglr app is a shared, pre-registered Enterprise application. Your organization does not need to create its own app registration, redirect URIs or client secret. At most, a one-time admin consent is required.


Sign-in flow for an SSO-protected domain


When someone opens a domain protected with Microsoft SSO, the sign-in goes through these stages:


  1. The user opens the secured domain, for example internal.companyname.com, and is redirected to Microsoft's sign-in page.
  2. If the user is not yet signed in to Microsoft, they sign in with their Microsoft account.
  3. The first time, the user is asked to consent to connecting their account with the Maglr app. This lets Maglr read basic profile information, such as the email address. Maglr never receives the user's password. An administrator can give this consent for the whole organization instead (see Granting consent for your organization).
  4. Microsoft sends the user back to Maglr. Maglr checks the user's details against the domain's access filter, for example their email domain or group ID.
  5. If the user matches the filter, the publications on the domain open.


When the user comes back later, they don't need to sign in again as long as they are still signed in to Microsoft.


The Maglr app in Microsoft Entra


Maglr's SSO works through one shared, multi-tenant Enterprise application called Maglr. After consent has been given, you can find it in the Microsoft Entra admin center under Identity → Applications → Enterprise applications.



  • Name: Maglr
  • Application ID: 6a93cafe-ced9-4730-9c36-2ae21c39ea07
  • Object ID: db5e6f6d-6318-48b5-b174-8d6b6bf11fbe


The Maglr app requests the permissions openid, profile and User.Read. These are the standard permissions to sign a user in and read their basic profile.



An administrator can approve the Maglr app's permissions for the whole organization, so employees are not asked for consent one by one. To grant consent for your organization:


  1. In the Microsoft Entra admin center, go to Identity → Applications → Enterprise applications.
  2. Open Maglr.
  3. Open Permissions (under Security in the app's menu).
  4. Grant admin consent for your organization.


Consent is a one-time step for the Maglr app. It covers every domain secured with Microsoft SSO and dashboard sign-in.


Profile data Maglr receives


With the User.Read permission, Maglr receives the user's basic profile from Microsoft. Maglr uses it to grant access, for example based on the email domain. This is an example of the profile data:


{
  "id": "XXXXXXX-9ac9-4d7a-8c19-XXXXXXXX",
  "mail": "berry@maglr.com",
  "surname": "van Elk",
  "jobTitle": "CEO",
  "givenName": "Berry",
  "department": "Digital Communication",
  "employeeId": "12345",
  "displayName": "van Elk, Berry",
  "mobilePhone": null,
  "@odata.context": "https://graph.microsoft.com/v1.0/$metadata#users(id,displayName,businessPhones,givenName,jobTitle,department,mail,mobilePhone,officeLocation,preferredLanguage,surname,userPrincipalName,employeeId)/$entity",
  "businessPhones": [],
  "officeLocation": "Breda",
  "preferredLanguage": null,
  "userPrincipalName": "berry@maglr.com"
}


Setting up group-based access in Microsoft Entra


Group-based access lets only members of specific security groups open an SSO-protected domain. Maglr reads the user's group membership from the OIDC token Microsoft returns at sign-in. Maglr does not query your Microsoft directory, so it needs no broad directory permissions such as Group.Read.All or Directory.Read.All. Only groups that are assigned to the Maglr app are sent in the token, never your full directory.


To set up group-based access, your IT administrator follows these steps:


  1. In the Microsoft Entra admin center, go to Identity → Applications → Enterprise applications → Maglr.
  2. Open Users and groups and assign the security groups that should get access.
  3. Configure the groups claim to include Groups assigned to the application, not all groups. You can do this in the app's token configuration, or with a claims-mapping policy on the Maglr service principal if you prefer to keep the setting within your own tenant.
  4. Send Maglr the object ID (GUID) of each group that should get access, for example 7f3a1b20-9ac9-4d7a-8c19-2f4e8b1c9d10. Maglr then sets up the filter for the domain.


Keep in mind:


  • Only groups assigned to the Maglr app appear in the token. A group that is not assigned is not considered for access, even if the user is a member of it.
  • Because only assigned groups are sent, the token stays small, and Microsoft's group-overage limit (which cuts off very long group lists) is not reached in normal use.
  • Access by email domain does not need any of these steps. That filter uses the email address from the user's profile.


Access filters for SSO-protected domains


Maglr sets the access filter for each SSO-protected domain, based on what you ask for. The filter decides which signed-in Microsoft users can view the domain's publications. There is no setting in the dashboard to enter a filter yourself.


  • Email domain: the most common filter. Users whose email address ends in your organization's domain, for example @companyname.com, get access.
  • Security group: users who are members of one of the groups you named get access. This uses the group IDs from the token (see Setting up group-based access in Microsoft Entra).


If you give more than one email domain, a user who matches any one of them gets access. The same applies to more than one group. If the filter uses both an email domain and groups, a user must match both. To set up or change a filter, contact Maglr with the email domains or group IDs that should get access.


Checking SSO on a domain in the dashboard


Maglr sets up the Microsoft SSO connection and the access filter for a domain on request. Once Maglr has enabled SSO for your account, a user with the Super admin role can see whether a domain uses SSO in the dashboard:


  1. Go to Settings → Domain names.
  2. Click the pencil icon next to the domain. The Edit domain window opens.
  3. Under Secure domain name, check that Activate Single Sign-On is switched on, with Single Sign-On as the SSO type.


Secure using an auto-login URL cannot be used on a domain while SSO is switched on.


Frequently asked questions


Which authentication protocol does Maglr use for Microsoft SSO?


Maglr's Microsoft SSO uses OpenID Connect (OIDC) on top of OAuth 2.0, against the Microsoft identity platform (v2.0 endpoints). It does not use SAML.


Does Maglr need permission to read our directory or all our groups?


No. The Maglr app requests only the openid, profile and User.Read permissions. Maglr reads group membership from the sign-in token, and only for the groups your administrator assigns to the Maglr app in Microsoft Entra. Broad permissions such as Group.Read.All or Directory.Read.All are not required.


Can I set the group ID filter for a domain myself in the dashboard?


No. The dashboard has no setting to enter an email domain or group IDs as an SSO filter. Maglr sets the access filter for each SSO-protected domain on request. Send Maglr the email domains or group IDs that should get access.


Does Microsoft group membership set a user's role in the Maglr dashboard?


No. Microsoft group membership is not linked to a user's rights or roles in the Maglr dashboard. Group IDs are used only in the access filter for SSO-protected domains.


Can I use Microsoft SSO on more than one domain?


Yes. Once the Maglr app is connected to your Microsoft organization, Maglr can set up SSO with its own access filter on multiple domains. Consent does not need to be given again; it is a one-time step for the Maglr app.


Can people outside my organization view publications on an SSO-protected domain?


With SSO alone, only Microsoft users who match the domain's access filter can view the publications. To also let other people in, a domain can have Activate login security switched on next to SSO, with Secure with manual password or Secure with email login. Visitors then see a login page where they choose how to sign in.


Can external agencies or freelancers sign in to the dashboard without being in our Microsoft organization?


Yes, as long as Single Sign-on is not required for them in your account settings. External collaborators, such as design agencies and freelancers, can then sign in to the dashboard with their own Maglr user account and password instead of SSO. They don't need to be added to your Microsoft tenant. If two-factor authentication (2FA) is available for your account, they can turn it on in their profile to secure this login.


Can I secure the Maglr dashboard itself with Microsoft SSO?


Yes. Dashboard SSO uses the same Maglr app in Microsoft Entra, but it is set up within the dashboard. It links each editor's Microsoft account to their existing Maglr user account. See Enable single sign-on for your account.

Updated on: 19/10/2026