Managed rollout
Identity: domain and identity provider
Prove the domain is yours and connect the identity provider, so a work address leads to your organisation.
Identity
The sign-in hint from step 1 only works when BeeSensible knows your employees' email domain and which identity provider belongs to it. Without that connection, the sign-in falls back to the regular account picker. Arrange this before step 1, in the console under Identity.
- Verify the domain. Add your employees' email domain and create the DNS record the console shows. Only after verification can an identity provider be connected to it.
- Connect the identity provider. Under Business sign-in (Microsoft Entra ID) you find the steps for the app registration in Entra; the console shows the redirect URI and the fields for Directory ID, Application ID and client secret.
- Neutral app name. Name the app registration in Entra BeeSensible, for example: Microsoft shows that name to every employee on the sign-in screen. You can rename it later via Entra, App registrations, Branding.
- Client secret lifetime. A client secret in Entra expires. Note the end date: once it expires, the work sign-in stops until you paste a new secret into the console.
- Emergency access. Employees who come in through the identity provider have no password of their own. Make sure at least one administrator does have a password and a second factor; the console shows under Emergency access whether that is the case.
