Skip to content
Infralign Infralign Infralign docs

Getting started

Dashboard sign-in (SSO)

How your users sign in to app.infralign.ai with their existing Microsoft work account, the one-time admin consent a tenant admin grants, and how to fix sign-in failures.

Validated against the Azure portal on 27 July 2026.

Click any image to enlarge.

Your users reach the dashboard at app.infralign.ai by signing in with their existing Microsoft work account, through a multi-tenant sign-in app called Infralign Portal. No passwords are ever shared with Infralign, and no new credentials are created.

The one delegated Graph permission, User.Read — shown in the consent dialog as “Sign in and read user profile” — reads only the signed-in user’s own name, email, and basic profile. It cannot list other users, read the wider directory, or reach any resource, mailbox, or file in your tenant.

Section titled “Grant admin consent (one time)”

Figure 1 is the whole of it: one admin, one permission, one enterprise application.

Admin consent — once, by an admin, and once per tenant rather than per user. An amber band labelled your tenant, one admin, once — marked no RBAC and nothing here grants write access — holds three cards matching the numbered steps below: step 1, confirm your role, and step 2, open the consent URL, tagged any of 3 admin roles; step 3, check the client id, and step 4, select Accept, tagged client id f7113fd5; step 5, verify the grant, tagged delete app to revoke. An arrow labelled accepted once, org-wide runs down to a cyan Infralign Portal band, which states the app's single permission: sign in and read user profile. Admin consent — once, by an admin, and once per tenant rather than per user. An amber band labelled your tenant, one admin, once — marked no RBAC and nothing here grants write access — holds three cards matching the numbered steps below: step 1, confirm your role, and step 2, open the consent URL, tagged any of 3 admin roles; step 3, check the client id, and step 4, select Accept, tagged client id f7113fd5; step 5, verify the grant, tagged delete app to revoke. An arrow labelled accepted once, org-wide runs down to a cyan Infralign Portal band, which states the app's single permission: sign in and read user profile.
Figure 1 — One consent covers every current and future user, and deleting the enterprise application revokes it.

  1. Confirm you hold one of the three roles listed above. A regular user can self-consent to these low-impact scopes only if your tenant permits user consent and recognises the app’s verified publisher, and many tenants disable user consent. Admin consent is therefore the reliable path, and it avoids per-user “Need admin approval” interruptions.

  2. Open the admin-consent URL, replacing <your-tenant-id> with your directory (tenant) GUID:

    https://login.microsoftonline.com/<your-tenant-id>/adminconsent?client_id=f7113fd5-938a-4551-9406-e8e964e0308e

  3. Review the consent dialog. It lists the single “Sign in and read user profile” permission. The published client ID f7113fd5-938a-4551-9406-e8e964e0308e is your verification anchor: confirm the application shown is Infralign Portal and that the client ID on the dialog matches this value exactly. A consent request that names Infralign but carries a different client ID is not this app — treat that mismatch as a consent-phishing signal and do not accept.

    Microsoft Entra admin-consent dialog for the Infralign Portal application, requesting the Sign in and read user profile permission

    The dialog currently shows the app as unverified (“This application is not published by Microsoft”) and notes that the publisher has not provided terms links. Both clear when Microsoft publisher verification completes. Infralign’s privacy policy is available to review out-of-band.

  4. Select Accept. This grants consent org-wide and authorises sign-in only — no wider directory read, no resource access, no write of any kind. Microsoft then redirects you to app.infralign.ai.

  5. Verify the grant. In the Entra admin center, go to Enterprise applications and confirm Infralign Portal is listed.

    To revoke consent, delete that enterprise application. New sign-ins stop immediately; sessions already open expire on their own. For instant per-request lockout of a user or your whole tenant, ask Infralign to remove the entry from its allowlist — that gate is enforced on every request and takes effect within about a minute.

What happens at sign-in

Section titled “What happens at sign-in”

Once consent is in place, each sign-in follows the same path. Your user is redirected to Microsoft’s own sign-in page, enters their password and MFA there — inside your tenant, where Infralign cannot see either — and Microsoft returns an ID token carrying only their name, email and tenant ID. Infralign then checks two allowlists before the dashboard loads, as figure 2 sets out.

What happens at sign-in, on every sign-in. An amber band marks the boundary of your own tenant: labelled your browser, your Entra tenant, it carries two guarantees — no password or secret leaves, and Infralign has no access here — and holds step 1, redirect to Microsoft, tagged your browser, and step 2, password and MFA entered here, tagged Microsoft's own page. An arrow labelled step 3, ID token — name, email, tenant id, crosses down into a cyan Infralign band marked read-only, which holds step 4, the allowlist check, tagged tenant, then user, else 403; and step 5, in green, signed in, tagged dashboards, reports and chatbot. What happens at sign-in, on every sign-in. An amber band marks the boundary of your own tenant: labelled your browser, your Entra tenant, it carries two guarantees — no password or secret leaves, and Infralign has no access here — and holds step 1, redirect to Microsoft, tagged your browser, and step 2, password and MFA entered here, tagged Microsoft's own page. An arrow labelled step 3, ID token — name, email, tenant id, crosses down into a cyan Infralign band marked read-only, which holds step 4, the allowlist check, tagged tenant, then user, else 403; and step 5, in green, signed in, tagged dashboards, reports and chatbot.
Figure 2 — Your password, your MFA factor, and any refresh token never reach Infralign — they are entered on Microsoft's sign-in page inside your own tenant.

Send Infralign the sign-in details

Section titled “Send Infralign the sign-in details”

After consent, send Infralign two things:

  • your tenant (directory) GUID;
  • the user list — each user’s email exactly as their Microsoft account asserts it, plus a role of member or admin.

Infralign then adds your tenant GUID to a server-side tenant allowlist and enrols each user with their identity pinned to your tenant ID (tenant binding). Adding or removing users afterwards takes effect within about a minute and needs no redeploy — send the updated list and the change applies.

If sign-in fails

Section titled “If sign-in fails”

Two security gates run after Microsoft sign-in succeeds, and most failures below trace back to one of them, or to consent not yet being granted:

  • Tenant allowlist — a sign-in from a tenant not on the list is rejected at the callback, before the app loads.
  • Per-user allowlist with tenant binding — an authenticated user who is not enrolled, or enrolled under a different email, gets 403 on every tenant page.
SymptomCauseFix
”Need admin approval” interrupt — AADSTS65001 or AADSTS90094Consent is missing and the tenant blocks user consentSend the admin the consent URL above. The admin-notify workflow is off by default in most tenants, so the request may not reach an admin on its own.
AADSTS700016 — application not found in tenantAdmin consent was never granted, so the Portal app was never provisionedGrant admin consent (steps above).
AADSTS50011 — redirect URI mismatchThe reply URL does not match what the app expectsContact Infralign — this is fixed on Infralign’s side.
AADSTS65004 — user declined the dialogSomeone selected Cancel on the consent dialogRe-open the consent URL and select Accept.
Signed in fine, but every page returns 403The user is not on the enrolment list, or their email does not match the one enrolledSend Infralign the user’s exact email as their Microsoft account asserts it.
Rejected straight back to sign-in at the callbackYour tenant is not yet on the allowlistConfirm Infralign has your tenant GUID.

Next: Your first day — what lands in the 24 hours after you connect.