Managed rollout
Identity: domain and identity provider
Prove the domain is yours and connect the identity provider, so a work address leads to your organisation.
Identity
The sign-in hint from step 1 only works when BeeSensible knows your employees' email domain and which identity provider belongs to it. Without that connection, the sign-in falls back to the regular account picker. Set this up before step 1, in the console under Identity.
- Verify the domain. Add your employees' email domain and create the DNS record the console shows. You can only connect an identity provider once the domain is verified.
- Connect the identity provider. Under Business sign-in (Microsoft Entra ID) you will find the steps for the app registration in Entra; the console shows the Redirect URI and the fields for Directory (tenant) ID, Application (client) ID and Client secret (value).
- Neutral app name. Give the app registration in Entra a neutral name, such as BeeSensible: Microsoft shows that name to every employee on the sign-in screen. You can rename it later in Entra under App registrations → Branding & properties.
- Client secret lifetime. A client secret in Entra expires. Note the expiry date: once the secret expires, work sign-in stops working until you paste a new secret into the console.
- Emergency access. Employees who sign in through the identity provider have no password of their own. Make sure at least one administrator does have a password and a second factor; Emergency access in the console shows whether that is the case.
