Microsoft Entra ID single sign-on

Entra ID (Microsoft Entra, formerly Azure AD) SSO is configured per account, not through a global setting — each account brings its own Entra ID app registration, because each customer tenant is different.

Setting up SSO for your account

Turning on Entra ID SSO isn't self-serve — send your CatalystData contact two values and they will configure it on your account:

Field	Where it comes from
Entra ID Tenant ID	Your organization's Entra ID tenant, from the Azure portal
Entra ID Client ID	The application (client) ID of the app registration created for CatalystData

At the same time, tell them whether you want hybrid mode (internal password sign-in stays available alongside Entra ID SSO) and, optionally, an SSO email domain (a bare domain, for example acme.com) — when set, the sign-in page can detect that a user's email belongs to your account and offer the Entra ID sign-in flow automatically, rather than requiring the account slug up front.

What users see

On the sign-in page, a user enters their email. If its domain matches an account configured for SSO, they are offered a "Sign in with Microsoft" button that redirects through the standard Entra ID flow. If no SSO is configured for that domain, they fall back to signing in with an account slug, email, and password.

Azure Marketplace billing and Entra ID connections

Your CatalystData subscription is billed through the Azure Marketplace. Separately, some Entra ID-based data source connections (SQL Server, Fabric, and Databricks OAuth) can authenticate through a shared CatalystData app registration rather than one you supply yourself — when that's enabled on your account, those connections only need a host and database, with no credentials to manage. Ask your CatalystData contact if you'd like this turned on.