Administrator guide: setting up SSO (Microsoft) + SharePoint

This page is for IT administrators at a customer organization. End users do not need these steps; for them, see Sign-in & persona selection and SharePoint.

Goal: set up Microsoft Entra ID (formerly Azure AD) and Prudai so that:

1. users sign in with their Microsoft account via SSO, and
2. dossiers, projects and organization knowledge bases can import and sync documents from SharePoint.

Both run through the same Microsoft sign-in: the Microsoft button on Prudai’s sign-in screen. Prudai uses its own Microsoft app for this, the same one for every customer. So you do not create an app registration of your own, and you do not send Prudai a client ID or client secret. On your side, all that is needed is consent for that app. There is also no connect screen in the app: once both sides are in place, SharePoint works for everyone who signs in through Microsoft.

---

Step 1 — Request the integration from Prudai

Send the following via a secure channel (a support ticket or your account manager):

• the email domain(s) of the users who should get access (e.g. @firm.example), so their accounts end up in your organization;
• that you want to use SharePoint.

Prudai then switches on the SharePoint integration for your organization. You cannot switch it on yourself. An owner of your organization can see in the Account Dashboard under Capabilities whether it is active; see Account & RAG dashboards.

---

Step 2 — Grant consent in Microsoft Entra ID

On the first Microsoft sign-in, Microsoft asks for consent for Prudai’s app. These are the delegated Microsoft Graph permissions involved:

Permission	Used for
openid, profile, email	sign-in (SSO)
offline_access	staying signed in without signing in again all the time; needed for SharePoint sync
User.Read	profile details at sign-in
Sites.Read.All	reading SharePoint sites and importing files

Delegated means: Prudai always acts on behalf of the signed-in user, with that user’s permissions. What someone cannot see in SharePoint, they cannot see in Prudai either.

If users in your tenant are not allowed to consent to apps themselves (a common setting), an administrator grants consent once on behalf of the whole organization. Use an account that is allowed to do that in Entra, for example a Global Administrator:

1. Go to Prudai’s sign-in screen and, under Or sign in with, choose the Microsoft button.
2. Sign in with the administrator account.
3. On Microsoft’s consent screen, tick the box to consent on behalf of your organization (Consent on behalf of your organization) and accept.

If Prudai’s app is already present in your tenant, you can also do it in the Entra admin center: open Enterprise applications, search for “Prudai” and pick Prudai’s app, then under Permissions click Grant admin consent for <tenant>.

Without that consent, users get a consent screen at sign-in or a message that administrator approval is required.

Prudai does not request any write permissions and never writes back to SharePoint.

Files.Read.All is not required. Prudai reads files only through a site’s document libraries; a user’s OneDrive is never accessed.

Rolling out the Outlook add-in as well? If you want users to be able to save entire conversations, two more things are needed:

• Prudai switches on the Outlook Integration for your organization.
• An administrator grants consent on behalf of the organization for the delegated Mail.Read permission. Prudai does not request that permission at sign-in. So you grant it yourself, for the same Prudai app (not in an app registration of your own): Enterprise applications → Prudai’s app → Permissions → Grant admin consent for <tenant>. If Mail.Read is not in the list Microsoft then shows you for approval, ask support for a consent link.

Deployment and prerequisites: Deploying Prudai for Outlook.

---

Step 3 — What happens next (there is no connect screen)

This is the step most often misunderstood: there is no screen in the app where you, as an administrator, switch SharePoint on or “connect” it. Do not look for a button under Settings; it does not exist.

The connection is made per user, at the moment that user signs in:

1. The user opens the web app and lands on the Prudai sign-in screen.
2. Under Or sign in with they choose the Microsoft button (not the password field with the Sign In button).
3. After that sign-in the user has SharePoint. No further consent screen appears, provided you granted consent on behalf of the organization in step 2.

The consequence to explain to your colleagues: anyone who signs in with a username and password sees “Not connected”, even though SharePoint works fine for the rest of the firm. That is neither an outage nor a misconfiguration. That user has to sign out and sign back in through Microsoft.

The three requirements

SharePoint only works when three requirements are met. They do not apply at the same level.

Requirement	Applies to	Message when it is missing
Your organization has the SharePoint integration (step 1).	the whole organization	”SharePoint integration is not enabled for your organization.”
The Microsoft connection is set up on Prudai’s side.	all organizations (a setting of Prudai itself)	“SharePoint integration is not configured.”
The user signed in through Microsoft and has a valid Microsoft session.	this user	”Not connected”

Things to remember:

• Prudai takes care of the first two; you cannot flip them yourself and there is no screen for them;
• “configured” says nothing about the consent in your tenant. If someone revokes the consent for Prudai’s app in Entra, the first two stay fine, but everyone sees “Not connected”;
• “Not connected” for one user says nothing about the rest of the firm.

---

Step 4 — Verification

After setup, run at least these two checks.

SSO login

1. Open https://app.prudai.com in an incognito window.
2. On the sign-in screen, under Or sign in with, choose the Microsoft button.
3. Confirm your name appears in the user menu in the top-right corner.

SharePoint import

1. In the sidebar, open Dossiers (in LEO and LEO Fiscaal), Projects (in VERA, ZIA and BEVER) or Folders (in MAIA) and click the dashed New dossier row at the top of the list.
2. In that window, click Import from SharePoint.
3. Pick a small site. If the site has more than one document library, first choose a Document library; then select a single folder, or switch on Import entire site, and click Import site.
4. Wait for the import to finish and open one of the imported documents.

Both work → done.

---

Troubleshooting

Symptom	Cause	Fix
Microsoft shows a consent screen at sign-in, or says administrator approval is required	Consent on behalf of the organization is missing	Grant consent as in step 2.
One user sees “Not connected”, the others do not	That user signed in with a password instead of through Microsoft	Have the user sign out and sign back in with the Microsoft button. No administrator action is needed.
Everyone suddenly sees “Not connected”	The consent for Prudai’s app was revoked, or the app was disabled in your tenant	In Entra, search Enterprise applications for “Prudai” and check that Prudai’s app is still active and has consent. If it does, contact support.
A user cannot see a site or folder in the picker, or importing it fails	The signed-in user has no rights on that site or folder	Grant that user read access in SharePoint. Prudai runs under their identity, so rights they lack in SharePoint they also lack here.
”SharePoint integration is not enabled for your organization.”	The SharePoint integration is not switched on for your organization yet	Request it as in step 1.
”SharePoint integration is not configured.”	The connection on Prudai’s side is not set up	This is not a setting of your organization or tenant; contact support.
SSO works, but the user gets no product access	The email domain is not linked to your organization yet, or rights are missing	Forward the domain to support.

---

Maintenance

• No secret on your side. Because you have no app registration of your own, there is nothing on your side to renew or rotate.
• New permissions (for example Mail.Read for the Outlook add-in) require consent again.
• A user leaving: disable them in Entra. They can then no longer sign in through Microsoft and SharePoint stops working for them. Also have them removed from your organization in Prudai: an owner does that in the Account Dashboard under Members; see Account & RAG dashboards.

More general background: SharePoint · Privacy & security · Troubleshooting & support.