Connect Microsoft Entra sign-in and directory

Before you start

You need the Owner or Admin portal role, the enabled Sign-in & directory feature, an organization linked to AUTARQ ID, and a Microsoft administrator who can grant the required consent and configure the enterprise application. To assign Chat access, choose an existing Chat contract line with capacity.

Company sign-in is separate from connecting Outlook or SharePoint inside Chat. For those apps, use Apps and connections.

Connect the organization

Owners and admins of an organization can connect the company’s Microsoft Entra to AUTARQ ID under Organization → Sign-in & directory. The section appears only while the feature is enabled for your environment. After connecting, people who type an address on one of your verified domains and have no AUTARQ ID credential of their own are sent to your Entra.

1. Grant admin consent. Sign in to AUTARQ’s connect app with a Microsoft account of your company and approve read access to your verified domains. Use an administrator authorized to grant tenant-wide consent. AUTARQ takes the tenant from Microsoft’s signed confirmation, never from anything you type.
2. Read your verified domains. Only domains your tenant has verified can be routed.
3. Create the enterprise application in Entra with SAML single sign-on, using the Identifier (Entity ID), Reply URL and Name ID (user.objectid, persistent) shown in the wizard, and assign the people who may sign in.
4. Paste the App Federation Metadata URL. It must belong to the tenant you consented for; otherwise nothing is connected.
5. Routing domains. Each verified domain is listed as attached, awaiting operator or collision. AUTARQ staff domains wait for an AUTARQ administrator to approve them once. A domain that is already routed for another organization is never moved automatically; contact support.
6. Choose the default Autarq Chat contract line and create the provisioning token. People provisioned from Entra receive the plain User role on that line; your directory never grants Chat administration. The token is shown exactly once, so copy it immediately. You can create a new one at any time, which invalidates the old one.

Disconnecting stops sign-in through your Entra, ends its sessions, detaches your routing domains and revokes the provisioning token.

Reconnecting the same organization later keeps everyone your directory provisioned. Connecting the same Entra tenant to a different organization does not move people: those the first organization provisioned keep their AUTARQ ID there and appear as Conflict in the new one. Contact AUTARQ support to resolve them.

Provisioning people from Entra

In the enterprise application, open Provisioning, set the mode to automatic, and enter the Tenant URL and the Secret Token shown in step 6. Under the attribute mappings, map the Entra attribute objectId to externalId; without it no one is provisioned. Assign the people or groups who should get access. Then click Start provisioning; until you do, Entra sends nothing. Entra sends the assigned people to AUTARQ in regular cycles, or immediately with Provision on demand.

• A person whose email address is on one of your routing domains gets an AUTARQ ID with no password and no email from AUTARQ, becomes a member of your organization and receives a seat with the User role on the default line. They open Autarq Chat with their company login on the first click.
• Fill in the first name and last name of each person in Entra. A person without them is asked for their name once, at their first sign-in.
• An address outside your routing domains is refused, and the reason appears in Entra’s provisioning log. Nothing is created.
• When the default line has no free seat, the person is still added but waits without a seat.
• Someone who already has an AUTARQ ID and is already a member of your organization keeps that account, their roles and their seat, and simply gains sign-in through Entra.
• Someone who has an AUTARQ ID but is not a member is never linked silently. They are recorded as a conflict; once they join your organization through an invitation, the next provisioning pass links them without further action.

When people leave or return

• Removed or disabled in Entra. The person leaves your organization in AUTARQ ID and their seat is released; Autarq Chat refuses them on their next request. A person AUTARQ provisioned loses their AUTARQ ID access in every session, including offline ones. Someone who already had their own AUTARQ ID keeps it, with their password, for their other organizations; only the link to your Entra is removed. The freed seat goes to the person who has been waiting without a seat the longest.
• Portal members. A member who is not an owner is also removed from the organization through the normal member removal. An owner is never removed automatically: the organization is flagged “owner left the directory”, your owners and admins get a notification, and ownership has to be transferred by a person.
• Assigned again. Re-enabling the person in Entra restores their membership of the AUTARQ ID organization and a seat if one is free. It never restores portal membership and never lifts a deactivation made by an administrator in AUTARQ.
• Deleted in Entra. A person AUTARQ provisioned is erased through the verified deletion workflow, and they are refused if Entra provisions them again: Entra’s provisioning log shows a conflict until an AUTARQ administrator clears the deletion record. Someone who had their own AUTARQ ID is only unlinked, never erased.

Sign-in requirement

The switch Require sign-in through Entra is on by default. While it is on, people whose address is on one of your routing domains can act in your organization, and in its Autarq Chat, only in a session that came through your Entra. If they signed in with an AUTARQ ID password instead, they are sent once to your Entra and can continue after that. Their other organizations are not affected, and neither are members whose address is not on a routing domain. Sessions that came through your Entra end 12 hours after the sign-in, so removing a person in Entra takes effect the same day.

You cannot invite an address on a routing domain with Add person: assign the person in Entra instead. The one exception is Give portal access on a person Entra provisioned, in People. Switching the requirement off, or disconnecting, lifts it for the organization and for Autarq Chat.

Verify the connection

Check that the connection is shown as connected and the intended domains are attached. Provision one authorized test person using Entra’s on-demand action. Confirm their entry under People, their seat and their company sign-in. A connected badge alone does not prove provisioning or Chat access.

The organization page also reports a stalled provisioning feed or a routing-domain warning when applicable. Inspect Entra’s provisioning logs and contact support with the error and timestamp; do not share the provisioning token.