Single Sign-On (SSO) Overview
Single Sign-On (SSO) lets people in your organisation sign in to CodeXray with their existing Microsoft Entra ID (Azure AD) work account instead of a separate CodeXray password. Each organisation (tenant) connects its own Entra directory, configures it independently, and manages access from one place.
- One less password — people use the Microsoft account they already have.
- Access follows your directory — when someone leaves and you disable them in Entra, they can no longer sign in to CodeXray.
- Roles come from your directory — an Entra app-role change becomes a CodeXray role change at their next sign-in.
- No manual invites — first-time users are created automatically on their first successful sign-in (optional).
How it works
Sign-in is email-first. A user types their email; CodeXray recognises the domain, sends them to your organisation's Microsoft sign-in page, and brings them back signed in.
CodeXray never sees the user's Microsoft password — authentication happens entirely at Microsoft, and CodeXray only receives a verified confirmation of who signed in.
Key concepts
| Concept | What it means |
|---|---|
| Provider | The connection to one identity provider. Today CodeXray supports Microsoft Entra ID (single-tenant). One provider per organisation. |
| Email domains | The email domains that route to your provider (e.g. acme.com, and often yourorg.onmicrosoft.com). Anyone with one of these domains gets the SSO button. Public domains (gmail.com, outlook.com, …) can't be used. |
| Just-in-time (JIT) provisioning | When on (the default), a first-time user is created in CodeXray automatically on their first successful sign-in. When off, unknown users are turned away until an admin adds them. |
| Roles from Entra | Microsoft app roles map to CodeXray roles (Admin / Editor / Viewer) through a mapping you define. CodeXray applies the mapped role, then updates it only when your directory's answer changes — not on every sign-in. |
| Require single sign-on | When on, password sign-in is refused for your domains — people must use SSO. Enforced on the server, not just hidden in the UI. |
| Break-glass accounts | One or two named accounts allowed to keep signing in with a password even when SSO is required, so a broken directory config can't lock your whole team out. |
Who does what
Setting up SSO involves three roles:
| Who | What they do |
|---|---|
| Your Azure admin | A one-time app registration in your Microsoft Entra directory. Never logs in to CodeXray — they just hand three values to your CodeXray admin. |
| Your CodeXray primary admin | Configures the provider in Settings → Single Sign-On, maps roles, tests the connection, and enables it. |
| Your team (end users) | Type their email, click through Microsoft, land in CodeXray. |
CodeXray staff are not involved after you supply the three Azure values — SSO is self-service per organisation.
Prerequisites
- A Microsoft Entra ID directory for your organisation.
- Someone with permission to register an application in that directory (your Azure admin).
- You must be the primary admin of your CodeXray organisation to configure SSO.
Next steps
- Set Up Azure Entra ID SSO — the full setup guide, from Azure app registration to enabling SSO in CodeXray
- Signing In & Managing SSO Users — the end-user sign-in experience and how SSO users and roles are managed
- SSO Troubleshooting — fixes for the common sign-in and setup errors
- Role-Based Access Control — how roles and permissions work across projects