Skip to content
Infralign Infralign Infralign docs

Getting started

Dashboard sign-in (SSO)

One admin consent, once per tenant. The URL to open, the four checks to make in the dialog, and how to read the grant back.

Validated against the Azure portal on 5 August 2026.

Users sign in at app.infralign.ai with the Microsoft work accounts they already have. The sign-in app is called Infralign. It asks for sign-in permissions and nothing else.

No password reaches Infralign. No new credential is created.

Section titled “Grant admin consent (one time)”

One admin, one consent, one enterprise application. Figure 1 is the whole of it. The grant covers every current and future user in your tenant, so nobody meets a per-user prompt.

Admin consent: once, by an admin, and once per tenant rather than per user. An amber band labelled your tenant, one admin, once (marked no RBAC and nothing here grants write access) holds three cards matching the numbered steps below: step 1, confirm your role, and step 2, open the consent URL, tagged any of 3 admin roles; step 3, check the client id, and step 4, select Accept, tagged client id f7113fd5; step 5, verify the grant, tagged delete app to revoke. An arrow labelled accepted once, org-wide runs down to a cyan Infralign band, which states what the app may do: sign in and read the user's own profile. Admin consent: once, by an admin, and once per tenant rather than per user. An amber band labelled your tenant, one admin, once (marked no RBAC and nothing here grants write access) holds three cards matching the numbered steps below: step 1, confirm your role, and step 2, open the consent URL, tagged any of 3 admin roles; step 3, check the client id, and step 4, select Accept, tagged client id f7113fd5; step 5, verify the grant, tagged delete app to revoke. An arrow labelled accepted once, org-wide runs down to a cyan Infralign band, which states what the app may do: sign in and read the user's own profile.
Figure 1: One consent covers every current and future user, and deleting the enterprise application revokes it.

  1. Confirm that you hold one of the three roles listed above.

    Done when Entra shows the role as active for your account.

  2. Open the admin-consent URL for your tenant.

    Replace YOUR_TENANT_ID with your tenant GUID. It is on the Entra admin center’s Overview page, under Entra ID, as Tenant ID. Your tenant’s primary domain works in its place.

    https://login.microsoftonline.com/YOUR_TENANT_ID/adminconsent?client_id=f7113fd5-938a-4551-9406-e8e964e0308e

    Done when the Microsoft consent dialog opens.

  3. Verify these values in the consent dialog:

    FieldRequired value
    ApplicationInfralign
    Client IDf7113fd5-938a-4551-9406-e8e964e0308e, carried in the URL you opened in step 2. The dialog itself does not display it
    PermissionSign in and read user profile
    PublisherInfralign Smart Solutions, with a blue verified badge

    Microsoft's Permissions requested dialog for the Infralign app. Under the Microsoft logo and the signed-in admin's blurred address, the heading reads Permissions requested, review for your organisation. The app name Infralign sits beside the Infralign triangle mark, over a publisher line reading Infralign Smart Solutions with a blue verified badge. The dialog asks to sign in and read user profile, states that acceptance applies for all users in the organisation, links to the terms of service and privacy statement, and offers Cancel and Accept buttons.

    The dialog as a Global Administrator of an external tenant sees it. Captured 6 August 2026; the admin’s address is blurred. It lists one grouped entry.

    Do not accept a request from a URL whose client ID differs. A matching name over a different ID is a consent-phishing signal.

    Done when every value in the table matches and the four checks below hold.

  4. Select Accept.

    Done when Microsoft redirects you to app.infralign.ai.

  5. Read the grant back. In the Entra admin center, confirm Infralign appears under Enterprise applications. Open Permissions → Admin consent.

    The Permissions blade of the Infralign enterprise application in the Microsoft Entra admin center, on the Admin consent tab. A button reads Grant admin consent for, with the organisation name blurred. The table below is headed Microsoft Graph (4) and lists four rows, each for Microsoft Graph: claim value email, meaning view users' email address; openid, meaning sign users in; profile, meaning view users' basic profile; and User.Read, meaning sign in and read user profile.

    The grant, read back from a tenant that has consented. Your own organisation’s name appears on the button, so it is blurred here. Captured 5 August 2026.

    Four rows, not five. offline_access is requested at each sign-in rather than registered on the app, so it never appears in this record. Check what is absent from the list, not how long the list is.

    Done when the enterprise application is listed and the four rows above are the only ones under Microsoft Graph.

Consent authorises sign-in only. It grants no wider tenant read, no resource access, and no write access.

Accepting is also what creates the Infralign entry under Enterprise applications. Nobody creates that entry by hand. It is the record of the consent, and deleting it revokes the consent.

Verifying this is the real request

Section titled “Verifying this is the real request”

Make all four checks before you accept.

CheckIt passes when
Client IDThe URL you opened carries client_id=f7113fd5-938a-4551-9406-e8e964e0308e. No other application can present that ID. A dialog named “Infralign” raised by a different client ID is consent phishing, verified badge or not.
Permission listEvery entry appears in what the app asks for. Do not count the entries: Microsoft groups and words them differently per screen. Check that nothing outside the set appears.
The URL you openedIt carries your own tenant ID and client_id=f7113fd5-938a-4551-9406-e8e964e0308e. Check the address bar yourself. A link from a colleague is fine once you verify both values; a link you cannot verify is not.
PublisherIt reads Infralign Smart Solutions with a blue verified badge, and the domain reads infralign.ai. One signal among four, not a substitute for the other three.

If all four hold, accept. If any fails, close the dialog without accepting, then email support@infralign.ai.

Publisher verification is an identity check, not a security audit. What Infralign does with your data is in security and data handling.

What the app asks for

Section titled “What the app asks for”

Five permissions. Every one of them exists to sign a person in.

PermissionHow the dialog words itWhat it does
openidSign users inEstablishes who the person is. The base of any Microsoft sign-in.
profileView users’ basic profileTheir name and basic profile fields.
emailView users’ email addressThe address Infralign matches against your account’s people list.
User.ReadSign in and read user profileReads their own profile. Not anyone else’s.
offline_accessMaintain access to data you have given it access toKeeps the session alive. It grants no new data, and deleting the enterprise application ends it.

None of the five can list other users, read your directory, or reach a mailbox, a file, or any Azure resource. Your cost and resource data is read by infralign-reader, a different identity that you create and control.

Do not count the entries. The dialog rarely lists all five at once. Admin consent covers the four registered on the app together. offline_access is added by the sign-in proxy at the moment of the request, so it can appear on a screen that lists nothing else. Check instead that nothing appears which is not in this table.

Section titled “If your tenant restricts consent”

Find out in advance. In the Entra admin center, open Enterprise applications → Consent and permissions → User consent settings.

Your tenant’s settingCan a non-admin sign in without you?What you have to do
Allow user consent for all appsYesNothing. The first sign-in by any enrolled user works.
Allow user consent for apps from verified publishersYes. Infralign is verified and User.Read is in the low-impact set.Nothing, though admin consent is still tidier.
Do not allow user consentNoGrant admin consent before anyone signs in, or they meet AADSTS90094.

Admin consent is the recommended path in every row. It also removes per-user “Need admin approval” interruptions.

One more setting matters on that page. If Admin consent requests is enabled, a blocked user’s request queues for named reviewers and the user sees the screen below. Re-sending the consent URL changes nothing: the request is already in somebody’s queue. Find the named reviewer and ask them. It can take days.

The Microsoft "Approval required" screen. It reads Approval required, then the app name Infralign with the publisher Infralign Smart Solutions and a blue verified badge. Below, "This app requires your admin's approval to:" lists two expandable entries, "View users' basic profile" and "Maintain access to data you have given it access to". A justification box follows, then links to sign in with another account and to report the app as suspicious, and Cancel and Request approval buttons.

What a non-admin sees when the tenant queues consent requests. Captured from a real tenant on 5 August 2026; the tenant’s identifying header is cropped out. It lists two of the five permissions rather than all five, which is why the checks above ask what is absent rather than how many appear.

Constraining the grant after you accept

Section titled “Constraining the grant after you accept”

Every lever below is applied after consent, in your own tenant, with no involvement from Infralign.

  • Set Assignment required to Yes. On Enterprise applications → Infralign → Properties, set Assignment required? to Yes. Only identities you assign under Users and groups get a token. Entra refuses everyone else before Infralign sees the request.
  • Scope it to one named group. Manage the assignment through a single security group. The membership then answers “who can reach this” in one place, which is what an auditor asks for.
  • Apply Conditional Access to the app. The sign-in application takes ordinary policy: require MFA, require a compliant device, restrict by named location. Sign-in happens on Microsoft’s page inside your tenant, so your policy applies in full.
  • Revoke a live session. The application is subject to Continuous Access Evaluation, so a token can be cut mid-session rather than lingering until it expires.
  • Put an access review on the group. An Access reviews cycle gives the decision an expiry date.

Two systems then decide access, and both have to agree. Entra decides who may obtain a token. The Infralign People page decides who the dashboards open for. A person added in one and not the other cannot sign in.

A future release that needs more than User.Read cannot widen this grant quietly: Entra raises a fresh consent dialog. If a dialog ever names a permission this page does not list, close it and email support@infralign.ai.

Section titled “Optional: revoke consent”

To stop new sign-ins, delete the Infralign enterprise application. That is the sign-in application, not infralign-reader. Existing sessions expire on their own.

To cut off one person, remove them on the People page. Their access ends in about a second.

To cut off a whole tenant, ask Infralign to remove it from the allowlist. That is the one revocation here you cannot perform yourself. Deleting the Infralign enterprise application achieves the same outcome immediately, and needs nobody’s agreement.

What happens at sign-in

Section titled “What happens at sign-in”

Once consent is in place, each sign-in follows the same path. Microsoft redirects the user to its own sign-in page.

The user enters their password and MFA inside your tenant. Infralign cannot see either value.

Microsoft returns an ID token with the user’s name, email, and tenant ID. Infralign checks two allowlists before loading the dashboard, as figure 2 shows.

What happens at sign-in, on every sign-in. An amber band marks the boundary of your own tenant: labelled your browser, your Entra tenant, it carries two guarantees (no password or secret leaves, and Infralign has no access here) and holds step 1, redirect to Microsoft, tagged your browser, and step 2, password and MFA entered here, tagged Microsoft's own page. An arrow labelled step 3, ID token carrying name, email and tenant id, crosses down into a cyan Infralign band marked read-only, which holds step 4, the allowlist check, tagged tenant, then user, else 403; and step 5, in green, signed in, tagged dashboards, reports and chatbot. What happens at sign-in, on every sign-in. An amber band marks the boundary of your own tenant: labelled your browser, your Entra tenant, it carries two guarantees (no password or secret leaves, and Infralign has no access here) and holds step 1, redirect to Microsoft, tagged your browser, and step 2, password and MFA entered here, tagged Microsoft's own page. An arrow labelled step 3, ID token carrying name, email and tenant id, crosses down into a cyan Infralign band marked read-only, which holds step 4, the allowlist check, tagged tenant, then user, else 403; and step 5, in green, signed in, tagged dashboards, reports and chatbot.
Figure 2: Your password, your MFA factor, and any refresh token never reach Infralign. They are entered on Microsoft's sign-in page inside your own tenant.

Who can sign in

Section titled “Who can sign in”

Infralign enrols your first admin before sending the setup link. That admin then adds and removes everybody else, from the People page in the dashboard sidebar’s Admin section.

Each enrolled identity is pinned to your tenant ID. A removal takes effect in about a second, including any session the person already has open.

The roles, the domain rule and the guardrails are in manage who has access.

If sign-in fails

Section titled “If sign-in fails”

Two security gates run after Microsoft sign-in:

GateRejection state
Tenant allowlistThe callback rejects a tenant that is not enrolled.
User allowlist with tenant bindingTenant pages return 403 for an unenrolled or mismatched identity.
SymptomCauseFix
”Need admin approval” interrupt (AADSTS65001 or AADSTS90094)Consent is missing and the tenant blocks user consentSend the admin the consent URL above. The admin-notify workflow is off by default in most tenants, so the request may not reach an admin on its own.
AADSTS700016, application not found in tenantAdmin consent was never granted, so the sign-in application was never provisionedGrant admin consent (steps above).
AADSTS50011, redirect URI mismatchThe reply URL does not match what the app expectsContact Infralign. This is fixed on Infralign’s side.
AADSTS65004, user declined the dialogSomeone selected Cancel on the consent dialogRe-open the consent URL and select Accept.
AADSTS50105, user not assigned to a role for the applicationYour tenant set Assignment required? to Yes on the Infralign sign-in application and this person is not assignedAdd them, or their group, under Enterprise applications → Infralign → Users and groups. See constraining the grant after you accept.
Signed in fine, but every page returns 403The user is not on the account, or their email does not match the one addedAn admin adds the exact address their Microsoft account asserts, on the People page.
Rejected straight back to sign-in at the callbackYour tenant is not yet on the allowlistConfirm Infralign has your tenant GUID.

Next: Connect Azure. The four values the wizard asks for, and what each of its four steps does.