Circuit supports single sign-on through Microsoft Entra using Microsoft Graph. Once you’re in touch with us about enabling SSO we will coordinate meetings between technical implementors and work together to exchange configuration details. This page provides a brief overview of the set up.
Microsoft Graph
Application
Circuit works with a single tenant (internal) application that you create and manage for Circuit SSO.
Broadly, these are the steps for registering a new app:
Under App Registrations, create a new single tenant application called “Circuit”.
Set a Web redirect URI with the redirect address provided by Circuit
Assign users or groups to the app.
Adjust other configuration as needed according to your policies.
Note that Circuit does not support SCIM or direct provisioning; users must also be in Circuit’s invite list to access the Circuit CMS. See Single Sign-On (SSO) in Circuit for how to manage CMS users.
Configuration
What you will provide to Circuit:
Application (Client) ID
The client secret value for your app
The expiry for the secret and your preferred update cadence
Tenant ID
What you will need from Circuit:
The redirect URI for the app
List of existing users if applicable
Permissions
You must enable the User.Read API permission (delegated)
User.Read is likely configured by default after app creation as it is the fundamental permission required for enabling SSO and allows Circuit to read the signing-in user’s basic profile information.
Alternative: OpenID Connect
Alternative: OpenID Connect
We recommend using Microsoft Graph since user data is internally powered by Microsoft Graph in either approach. You may prefer OIDC if you have existing similar integrations and want to repeat the same configuration.
For OpenID, please inform us that you wish to used OpenID. You must provide Circuit with the same configuration as Microsoft Graph above, but permissions are provided instead through the openid, email, and profile APIs instead of User.Read.