Microsoft Entra ID sign-in

Cybex connects to Microsoft Entra ID in two ways. Both let people sign in to managed computers with their Microsoft work or school account; they differ in what happens at the login screen. Read Set up directory sign-in first if you have not chosen between them yet.

• Microsoft Entra ID shows a web address and a one-time code on the login screen. People finish signing in on a phone or another computer. Requires the GDM login screen.
• Microsoft Entra ID (password) lets people type their Microsoft password — or a PIN they set the first time — directly at the login screen. Any login screen works, and multi-factor prompts appear on the login screen instead of in a browser.

Both need Allow Forge to build from source on every Blueprint of the Policy that uses them.

Microsoft Entra ID with a sign-in code

Create the Microsoft application

1. Sign in to the Microsoft Entra admin center and open Entra ID > App registrations.
2. Select New registration.
3. Enter a recognizable name, such as Cybex workstation sign-in.
4. Under Supported account types, choose the single-tenant option for your organization. Leave Redirect URI empty and select Register.
5. On the application Overview, copy the Application (client) ID and Directory (tenant) ID.
6. Open Authentication. Under Advanced settings, set Allow public client flows to Yes, then select Save.

Microsoft provides more detail in Register an application and Enable public client flow.

Connect it to Cybex

1. In Cybex Manage, open Settings > Sign-in sources.
2. Under Directory connections, find Microsoft Entra ID and select Connect.
3. Paste the Directory (tenant) ID into Tenant ID and the Application (client) ID into Client ID. This sign-in method uses no client secret.
4. Add administrator rules if you need them — see Give people administrator rights. Without a rule, everyone signs in as a standard user.
5. Select Test & connect.
6. On a phone or another computer, open the displayed Microsoft address, enter the one-time code, and sign in with the test account.
7. Cybex reports which account signed in, the username it lands on at the computer, and whether it received administrator rights. Select Done.

The connection is saved only when the test sign-in succeeds. Connect without testing saves it unverified if the provider cannot complete a test right now.

Give people administrator rights

Rules under Admin rights on the computers match a claim in the identity token Microsoft issues.

The reliable approach is an app role. In the app registration, define an app role, assign users or groups to it, then add a rule with claim roles and the role’s Value — for example Cybex.LocalAdmin — mapped to Local administrator.

To match a group directly, use claim groups with the group’s immutable Object ID, not its name, and configure the app registration to emit the groups claim. Everyone who matches no rule signs in as a standard user.

Microsoft Entra ID with a password

This method registers each computer with Microsoft the first time someone signs in on it, using that person’s own credentials. Cybex stores no secret for it, and there is no tenant ID to enter — the tenant is discovered from the domain.

Prepare Entra

Usually nothing needs to be created. Collect the tenant’s verified domains that people sign in with, such as hillcrest.example and hillcrest.onmicrosoft.com.

Create an app registration only if your tenant blocks Microsoft’s built-in Linux sign-in application. In that case register a public client application as described above and keep its Application (client) ID for the advanced setting.

For administrator rights, collect the Object ID of each Entra group whose members should be administrators. Open Entra ID > Groups, select the group, and copy the Object ID from its overview.

Connect it to Cybex

1. In Cybex Manage, open Settings > Sign-in sources.
2. Under Directory connections, find Microsoft Entra ID (password) and select Connect.
3. In Entra domains, enter the verified domains people sign in with, separated by commas. People sign in with their full Microsoft address, such as j.dekker@hillcrest.example, so every domain in use needs to be listed.
4. Choose a Sign-in method:
   • Microsoft password every time — people type their Microsoft password at every sign-in, on every computer. Extra verification appears as a prompt on the login screen.
   • Set a PIN on the first sign-in — people set up a PIN the first time they use each computer, then type that PIN instead of their password on that computer.
5. Optionally list Administrator groups, one Entra group Object ID per line. Group names are rejected, because the computer can only match on the Object ID.
6. Leave Advanced Microsoft settings alone unless your tenant needs them. Microsoft cloud selects Worldwide, US Government, or China (21Vianet); Application (client) ID is only needed when the tenant blocks the built-in Linux sign-in application.
7. Select Connect.

Check that it works

There is nothing to test from Cybex: the registration happens between the computer and Microsoft at the first sign-in, so Manage never holds a credential it could rehearse with.

Verify it on a real computer instead. Select this source in a Policy, send that Policy to one test computer as described in Set up directory sign-in, and sign in there with a directory account before rolling it out more widely.

People sign in as standard users unless a group matches

Anyone who is not a member of a listed administrator group signs in as a standard user. If you need an account that is independent of Entra, keep a shared local account group available as well.