Skip to main content
Organization Owner access is required in PlayerZero to configure SSO. Entra ID administrator access is required in Azure to create the app registration and adjust settings.

​
Overview

This guide walks you through creating a Microsoft Entra app registration and wiring it to PlayerZero. We use the OIDC Authorization Code flow with PKCE. PlayerZero only requests standard OIDC claims.

​
Prerequisites

  • A PlayerZero organization where you are an Owner
  • Admin access to Azure Portal for your tenant
  • PlayerZero redirect URL: https://playerzero.ai/api/auth/sso

​
Step 1 — Create the App Registration in Entra

  1. Select Single Tenant account type
  2. Add as Web registration using the redirect URL:
    • https://playerzero.ai/api/auth/sso
  3. Create and store a Client Secret.

​
Step 2 — API Permissions (OpenID Connect)

  1. In the app registration, open API permissions → Add a permission → Microsoft Graph → Delegated permissions.
  2. Add these scopes:
    • openid
    • profile
    • email
    • offline_access
  3. Grant admin consent for your tenant.

​
Step 3 — Configure PlayerZero

  1. In PlayerZero, open Settings → SSO Configuration → Add SSO Configuration.
  2. Fill in: Fetch SSO config from well-known endpoint with your OpenID Connect metadata document endpoint.
  3. Click Fetch from Well-Known (PlayerZero will query: https://login.microsoftonline.com/<Directory (tenant) ID>/v2.0/.well-known/openid-configuration)
  4. Verify your organization’s domain and other autofilled settings.
  5. Enter your Client ID and Client Secret Value.
  6. Add the openid profile email offline_access scopes.
  7. Toggle on Use PKCE (Proof Key for Code Exchange).

​
Step 4 — Test the Connection

  1. In PlayerZero SSO Configuration, click Test Connection.
  2. Complete the Microsoft sign-in in the popup.
  3. On success, click Save Configuration.

​
Next Steps — Rollout & User Impact

Once SSO is saved and enabled, PlayerZero will invalidate existing sessions:
  • All users will be logged out of PlayerZero.
  • When users log back in through SSO, they will be able to access all previous work. No data will be lost in the transition.