Signing in with Microsoft (Entra ID)

Clment has Microsoft sign-in built in. It uses Clment’s own Microsoft Entra application, so there’s nothing to register in your tenant and nothing to send us — no client IDs, no secrets, no support ticket. It works with Microsoft work and school accounts (Entra ID, formerly Azure AD) and with personal Microsoft accounts.

Connecting a Microsoft account

Each person connects their own Microsoft account, in whichever way fits:

• New to Clment — on the sign-up page choose Microsoft, then Continue with Microsoft. This creates your Clment account.
• Accepting an invitation — choose Continue with Microsoft on the invitation page. The Microsoft account’s email must be the address the invitation was sent to.
• Already have a Clment account — sign in as usual, open Settings → Security, and choose Connect on the Microsoft row. If the Microsoft account’s email (or its sign-in name, the UPN) is the same as your Clment email, it’s connected straight away. If it’s different, we email your Clment address a link to confirm it’s yours — open it while signed in to Clment and choose Connect.

From then on, Microsoft on the sign-in page takes you straight in.

Making Microsoft your organisation’s sign-in method

Admins set this on Settings → Security, in the Sign-in methods card — no help from us needed:

• Require for org on the Microsoft row — everyone in the organisation must sign in with Microsoft. Email and password, and Google, are refused.
• Disable for organization on the Email and password row — turns password sign-in off for the organisation but still accepts both Microsoft and Google. (If you sign in with SSO only and have no password, the button is Disable password for organization.)

Before you switch, make sure everyone can get in with Microsoft. A member who hasn’t connected Microsoft yet is connected automatically the first time they choose Microsoft at sign-in — provided their Microsoft account’s email (or UPN) exactly matches their Clment email. Anyone whose Microsoft email is different should Connect Microsoft from Settings → Security first.

Clment’s own two-step verification applies to password sign-in only. When someone signs in with Microsoft, your tenant’s MFA and Conditional Access policies do that job instead.

Optional controls in your Microsoft tenant

Clment asks Microsoft only for sign-in and basic profile information — openid, profile, email and User.Read (name, email address and photo). None of the following is required, but tenant administrators can:

• Approve Clment for everyone. If your tenant doesn’t let users consent to apps themselves, the first person to sign in will be asked to request approval. An administrator can then grant it in the Microsoft Entra admin center → Enterprise applications (the admin consent requests page, or Clment → Permissions → Grant admin consent).
• Limit who can use Clment. In Enterprise applications → Clment → Properties, set Assignment required? to Yes, then add the people or groups who should have access under Users and groups. Microsoft then refuses everyone else before they reach Clment.
• Apply Conditional Access. Your Conditional Access policies can target the Clment enterprise application — for example to require MFA or a compliant device.

Clment appears under Enterprise applications once someone in your tenant has consented to it.

Who can get into your organisation

Signing in with Microsoft proves who someone is — it doesn’t give them access to your organisation. Your members are the people you invite from Settings → Team (see Inviting users and roles), plus whoever created the organisation. To end someone’s access, remove them on the Team page. Once password sign-in is off for your organisation, disabling their Microsoft account also stops them signing in again.

Troubleshooting

• “Your Microsoft account isn’t linked to your Clment account yet” — sign in the way you usually do (email and password, or Google), then Connect Microsoft from Settings → Security.
• The Microsoft email doesn’t match — an invitation needs the Microsoft account that uses the invited address; check which account you chose (the account picker lets you switch). Connecting from Settings → Security works with a different email — look for our confirmation email.
• “Need admin approval” — your tenant requires an administrator to approve new apps (see above).
• “Microsoft sign-in isn’t allowed for that organization” — an admin has required a different sign-in method. Use one of the methods shown.

See also

• Security and SSO
• Signing in with Google
• MFA and account protection