Azure AD (Microsoft Entra ID) Setup Guide

!Prerequisites

• Access to the Azure Portal (portal.azure.com) with sufficient permissions to register applications (Application Administrator or Global Administrator role).
• Your organization's Microsoft 365 / Entra ID tenant must be active.
• Estimated time: 10-15 minutes.

1Register a New Application in Azure

1. Sign in to the Azure Portal at https://portal.azure.com using an admin account.
2. In the left navigation menu, search for and select Microsoft Entra ID (formerly "Azure Active Directory").
3. From the left menu under Entra ID, select App registrations, then click + New registration at the top.
4. Fill in the registration form:
   • Name: RedApple Freight SSO (or any name your team prefers)
   • Supported account types: Select "Accounts in this organizational directory only" — this restricts sign-in to your company's tenant.
5. Under Redirect URI:
   • Select platform: Web
   • Enter the following URL exactly as shown below:

6. Click Register to create the application.

2Configure API Permissions

1. After registration, you'll be taken to the app's overview page. In the left menu, click API permissions.
2. You should see Microsoft Graph permissions. Verify the following delegated permissions are present (they are usually added by default):

If any of the above are missing, click + Add a permission → Microsoft Graph → Delegated permissions → search and add the missing ones, then click Add permissions.

3Create a Client Secret

1. In the left menu, click Certificates & secrets.
2. Under the Client secrets tab, click + New client secret.
3. Enter a description (e.g., Base44 SSO) and choose an expiration period:
   • Recommended: 12 or 24 months (your organization's policy may dictate this).
4. Click Add.

4Collect the Three Required Values

After completing the steps above, please collect and send back the following three values. These are needed to finalize the SSO configuration in Base44.

5Optional: Token Configuration (Recommended)

1. In the left menu, click Token configuration.
2. Click + Add optional claim.
3. Select ID token type.
4. Check email and upn (user principal name) to ensure the email claim is always included in the token.
5. Click Add, then Save.

!Security Notes for Your IT Team

• The Client Secret is a sensitive credential. Please transmit it securely (not via plain email). Consider using an encrypted channel or password-protected document.
• When the client secret expires (per the expiration you set), a new one must be created and shared so the SSO integration can be updated. We recommend setting a calendar reminder.
• The redirect URI is specific to this application. If the Base44 app is ever recreated or migrated, the URI will need to be updated in Azure.
• Only users within your Entra ID tenant will be able to sign in (assuming "Accounts in this organizational directory only" was selected). External/guest users will not have access unless the account type is changed.

!What Happens Next

1. Your IT team sends back the Client ID, Client Secret Value, and Tenant ID.
2. The Base44 administrator enters these values in the app's Authentication settings and enables SSO.
3. A "Sign in with Microsoft" button will appear on the RedApple Freight login screen.
4. Users sign in with their Office 365 credentials and are mapped to their existing RedApple Freight accounts by email address.