Configure Azure OAuth OIDC SSO for MVP One

 

Step 1: Register your application

1. Sign in to the Microsoft Entra admin center with at least Cloud Application Administrator permissions.
2. Navigate to Entra ID > App registrations > New registration.
3. Name the application: MVP One - OAuth SSO
4. Under Supported account types, select Single tenant (your organization only).
5. Click Register.

 

Step 2: Configure authentication settings

1. In the app registration, go to Manage > Authentication.
2. Click Add a platform and select Web.
3. Log into MVP One as an administrator.
4. Navigate to Administration > Settings > Company.
5. Set Single Sign On Authentication Type to OAuth2.
6. Copy the Website Redirect URL, for example:
7. https://{SiteName}.mvpplant.com/v2/Login/LoginOAuth
8. Paste this into Azure under Redirect URI.

9. Configure Settings > Check ID tokens (used for implicit and hybrid flows)

10. Save.

 

Step 3: Configure client credentials 

1. Go to Certificates & secrets.
2. Click New client secret.
3. Enter Description: OAuth.
4. Set expiration (recommended 12 to 24 months).
5. Copy the Value and store it securely.

 

Step 4: Configure API permissions

1. Navigate to API permissions > Add a permission.
2. Select ‘Microsoft Graph’ > Delegated Permissions.
3. Add  ‘email’
4. Click ‘Grant admin consent for your organization.

 

Step 5: Configure optional claims

1. Go to Token Configuration > Add optional claims.
2. Select ‘ID’ token.
3. Add email.
4. Save.

 

Step 6: Define scopes Exposed API

1. Go to Expose an API.
2. Set Application ID URI to api://{Client ID}.
3. Click Add a scope.
4. Configure:

1. • Scope name: mvp
   • Who can consent: Admins and users
   • Display name: Log into MVP
   • Description: Allow this application to log into MVP
   • State: Enabled

5. Save.

 

Step 7: Configure Token Version

This step is required for OAuth login to function correctly.

1. Go to App registration > Manifest.
2. Locate or add the property requestedAccessTokenVersion in the api section.
3. Set its value to 2.
4. Save the manifest.

Important: If this setting is not configured, Microsoft authentication may succeed but MVP One login will fail after redirect. Errors may appear unrelated, such as null key or database errors.

 

Step 8: Assign Users and Groups

1. Navigate to Entra ID > Enterprise Applications.
2. Select your application: MVP One OAuth SSO.
3. Go to Users and groups > Add user/group.
4. Assign users or groups as needed.

 

Step 9: Configure MVP One

1. Go to Microsoft Entra admin center > App Registrations > All applications.
2. Search for ‘MVP One OAuth SSO’.
3. In Overview > Essentials.

4. Log into your MVP One Site with an administrator account.
5. Go to Administration > Settings > Company > OAuth2

1. • Click ‘Use Microsoft Defaults’
   • Instance URL will be ‘https://login.microsoftonline.com/’
   • Copy the ‘Application (client) ID from the App registration.
   • Paste it in ‘Client ID’ in MVP One.
   • In ‘Scope’ type ‘api://{Paste in Client ID}/mvp
   • In ‘Client Secret’ paste secret from step 3.5
   • Claim to Username ‘email’

6. In MVP One OAuth SSO, Overview > Essentials > Endpoints.

7. Copy the ‘OpenID Connect metadata document’ URL.
8. Paste in the ‘Metadata URL’ in MVP One.
9. Save.

 

As a note, if you are using the new MVP One Mobile App you will need to add the following URLs to the Reply URL List:

• https://swordfish-api.mvpplant.com:3004/samlconsume 
• https://swordfish-api.mvpplant.com/samlconsume