Connecting Microsoft Entra ID to a training portal

Entra admin centre → Applications → App registrations → New registration

• Registered with a recognisable name Something like “Skyline Training” — it appears on the consent screen your people will see.
• Supported account types set to your organisation only Unless you genuinely need guests from other tenants to take the training.

The app → Authentication → Add a platform

Choose Single-page application. This is the setting that most often goes wrong, and it fails late — after the person has already typed their password.

• Platform is “Single-page application”, not “Web” A Web platform expects a client secret. We hold none, so the token exchange is refused even though sign-in appeared to work.
• Every redirect URI from our list is present, exactly as written No wildcards, no trailing slash after /auth/callback, always https.
• No client secret has been created Nothing under Certificates & secrets is needed. If one exists it is harmless, but it is a sign the platform type may be wrong.

The app → Token configuration → Add optional claim

This is the step that has no equivalent elsewhere, and skipping it produces a learner list with neither names nor email addresses. Entra does not include an email claim by default. It appears only where the directory holds a mail attribute, or where you add it here as an optional claim.

• Optional claims added to the ID token: email, given_name, family_name Token configuration → Add optional claim → ID → tick those three.
• Users have a first name, surname and email in the directory The claim can only carry what the directory holds. A completion certificate prints the learner's name, so an empty surname shows up there.

The app → API permissions

We request openid, email and profile. These are delegated Microsoft Graph permissions and are usually present on a new registration.

• openid, email and profile are listed
• Admin consent granted, if your tenant requires it Where users cannot consent for themselves, every learner is stopped by a consent prompt they have no way to approve.

The app → Authentication → Front-channel logout URL

Signing out of training clears the training session only and leaves the Microsoft session alone, so nothing is required here. Tell us if you would rather signing out of training also signed them out of Microsoft — be aware that affects every other Microsoft application they have open — and we will send an exact value.

Your DNS provider · one CNAME per training address

Only needed if the training runs on your own domain. If we have given you an address ending in .learn.skyline-ats.dev, that is already live — skip this step.

• You have told us the exact addresses before making the change We build the redirect URIs in step 2 from them, so this has to come first.
• CNAME changed to connect.skyline-ats.dev No TXT records and no verification step. The certificate is issued automatically, which takes a minute or two, so pick a quiet moment.