herbe ID · module
Microsoft Entra ID single sign-on
Your people sign in with the Microsoft account they use at work. You trust your company's Microsoft tenant once, and everything else stays as you set it.
Trust your tenant once
Work and school accounts only.
How it works
Matched carefully, not by email alone
Microsoft does not verify the email address on an account, so herbe ID does not take it on trust. The first sign-in is matched to the person you invited only when Microsoft vouches that your company owns the address's domain.
- Personal Microsoft accounts (Outlook.com, Hotmail, Xbox) cannot be used
- No authenticator code after Microsoft: your company's sign-in is the check
- A Microsoft sign-in never confirms a dangerous admin action; those still ask for a code or a passkey
- People link and unlink their own Microsoft account under My account
- Matched to your invitation
The work email on the Microsoft account must be the address the person was invited with.
- Remembered by account
After the first sign-in herbe ID remembers the Microsoft account itself, so a changed work address does not break it.
- Link it yourself if needed
If the first match is refused, sign in another way and link the Microsoft account under My account.
How to start
We create your organisation
It lives on herbe ID, and you invite your people to it.
Get your tenant ID
Ask your Microsoft administrator for the tenant ID, or send them the approval link and let them approve herbe ID for your tenant.
Add the tenant
Paste the tenant ID into your organisation's Microsoft sign-in and confirm with a code or a passkey.
Questions about Microsoft sign-in
Which Microsoft accounts work?
Work and school accounts from a tenant your organisation trusts. Personal Microsoft accounts are refused.
Do we need Microsoft for herbe ID?
No. Microsoft is one way in among several. The emailed link and passkeys keep working for people who do not use it.
Why was my first Microsoft sign-in refused?
Usually one of three things: Microsoft did not confirm that your company owns the address, the address differs from the one you were invited with, or you belong to several organisations and not all of them trust the tenant. The sign-in page gives the same answer whatever the reason. Sign in with the emailed link or a passkey and link the Microsoft account under My account; from then on the button works.
What happens when we remove a tenant?
The next Microsoft sign-in from that tenant is refused. Sessions that are already open end by themselves. To cut someone off now, switch their membership off.
Does a Microsoft sign-in confirm dangerous admin actions?
No. It says who you are at sign-in, not that you are there now. Those actions still ask for an authenticator code or a passkey.