Microsoft Entra ID single sign-on

Entra ID (Microsoft Entra, formerly Azure AD) SSO is configured per account, not through a global setting — each account brings its own Entra ID app registration, because each customer tenant is different.

Configuring SSO on an account

A platform admin goes to Accounts, opens (or creates) the account, and sets its authentication mode to Azure AD (SSO) or, for hybrid mode, leaves internal password auth enabled alongside it. Two fields are required:

Field	Where it comes from
Entra ID Tenant ID	Your organization's Entra ID tenant, from the Azure portal
Entra ID Client ID	The application (client) ID of the app registration created for CatalystData

Optionally, set an SSO email domain (a bare domain, for example acme.com). When set, the sign-in page can detect that a user's email belongs to this account and offer the Entra ID sign-in flow automatically, rather than requiring the account slug up front.

What users see

On the sign-in page, a user enters their email. If its domain matches an account configured for SSO, they are offered a "Sign in with Microsoft" button that redirects through the standard Entra ID flow. If no SSO is configured for that domain, they fall back to signing in with an account slug, email, and password.

Azure Marketplace billing and Entra ID connections

Your CatalystData subscription is billed through the Azure Marketplace. Separately, some Entra ID-based data source connections (SQL Server, Fabric, and Databricks OAuth) can authenticate through a shared CatalystData app registration rather than one you supply yourself — when that's enabled on your account, those connections only need a host and database, with no credentials to manage. Ask your CatalystData contact if you'd like this turned on.