MDM Lite – Setting Up Single Sign-On with Microsoft Entra ID

This document is intended for public publication. It is written for the IT/identity administration of customers adopting MDM Lite, and for Microsoft's Entra App Gallery reviewers as part of the Gallery submission for "MDM Lite – Data Prudentia". It contains only the information needed for single sign-on setup — no internal operational procedures, no customer-specific identifiers, and no credentials.

As of: 2026-09-23. A German version is available at entra-sso-setup.de.md.

Contents

1. Introduction
2. Licensing requirements
3. Required roles
4. Requested permissions
5. Application identification
6. How MDM Lite maps users
7. Step-by-step setup
8. Testing steps for pilot users
9. Error handling
10. Support

1. Introduction

MDM Lite is a SaaS application from Data Prudentia GmbH for centrally maintaining versioned reference and configuration data (https://mdm.data-prudentia.com). Employees of customer organizations sign in with their own corporate account — MDM Lite never creates guest accounts and never issues additional passwords. The customer's Entra directory fully authenticates the person, including multi-factor authentication and Conditional Access policies; MDM Lite then only determines the person's role within the application.

Protocol

Because authorization runs against the cross-tenant /organizations endpoint, any work or school account from any Microsoft Entra directory can technically authenticate. Whether that person actually gets access to MDM Lite afterwards is decided exclusively by authorization within MDM Lite (tenant membership, see Section 6) — not by Entra authentication alone.

Supported identity providers / account types

2. Licensing requirements

MDM Lite itself requests no Microsoft Graph permissions (see Section 4) and is therefore usable independently of your Microsoft 365 licensing.

3. Required roles

On the customer IT side (in your own Entra directory)

Granting the application one-time consent (Admin Consent) requires one of the following Entra directory roles:

• Global Administrator
• Application Administrator
• Cloud Application Administrator

This role is only needed for the one-time consent. Ongoing operation (assigning users/groups, Conditional Access, revocation) still requires one of these roles, or a delegated permission on the relevant enterprise application.

On the MDM Lite side

• MDM Lite tenant admin: the first person invited into your MDM Lite workspace by Data Prudentia. This role subsequently manages all further users independently (invite, assign role, block) — without further involvement from your IT or from Data Prudentia.
• Editor / Viewer: regular application roles for day-to-day work with the datasets, assigned by the tenant admin. They are not relevant to the SSO setup itself.

4. Requested permissions

When signing in, MDM Lite requests only the following delegated permissions — all act on behalf of the signed-in person, never as an application permission (app-only):

Explicitly not requested: any Microsoft Graph permission — no reading of mailboxes, files, calendars, or Teams content, no directory or group access, no application permissions (app-only access). The app registration's requiredResourceAccess contains no resource other than its own API. MDM Lite can technically only do what the signed-in person is themselves allowed to do within MDM Lite.

5. Application identification

Check these values in the consent dialog and in your list of enterprise applications to uniquely identify the application:

Consents granted before the branding update (2026-09-23) may still show the application under its earlier technical name mdm-lite-prod-frontend in your enterprise applications list. The application ID and publisher domain remain unchanged.

6. How MDM Lite maps users

MDM Lite maps a signed-in Entra account to a user account in MDM Lite via the account's immutable object ID (the oid claim that Entra issues in the token on every sign-in) — not via the email address.

• The email address is used only to match an invitation to an invited person the first time they open the invitation link. Once the invitation is accepted, MDM Lite permanently links the user account to the object ID of the signed-in account.
• If a person's email address or display name later changes in the Entra directory (for example due to marriage or a department change), their access to MDM Lite remains unaffected — the mapping continues to use the same object ID.
• An invitation can only be accepted by the person to whose address it was sent. If someone signs in with a different account, MDM Lite rejects the acceptance, even if the link was forwarded or intercepted (see Section 9).

7. Step-by-step setup

7.1 Admin consent — today's regular path

1. A Data Prudentia contact sends you a consent link following this pattern (with your own Entra directory ID already inserted):

   https://login.microsoftonline.com/<directory-id>/adminconsent?client_id=f78dec68-a861-4a98-b8aa-9663fbba9953&redirect_uri=https://mdm.data-prudentia.com
   

   <directory-id> is the directory (tenant) ID of your Entra directory (Entra portal → Overview → Tenant ID).

2. Open the link — preferably in a private browser window — and sign in with an account that holds one of the roles listed in Section 3.

3. Review the values from Section 5 in the consent dialog and confirm with "Accept".

4. Entra then redirects to https://mdm.data-prudentia.com. Seeing only the sign-in page at first is normal.

7.2 Adding from the Microsoft Entra App Gallery — available once published

Once MDM Lite is listed in the Microsoft Entra App Gallery, you will alternatively be able to add the application directly from the Gallery to your directory (Entra portal → Enterprise applications → New application → search for "MDM Lite" → Create). The subsequent consent step matches Section 7.1. This path is only available once the Gallery submission is complete.

7.3 Controlling access (Conditional Access, MFA, assignment)

After consent, you will find the application under Entra portal → Enterprise applications → MDM Lite – Data Prudentia. All further controls remain entirely in your hands:

• Conditional Access / MFA — your own policies for access to MDM Lite (requires Entra ID P1, see Section 2).

• Users and groups — assign the intended people or a group to the enterprise application.

• Properties → "Assignment required" — restricts sign-in to explicitly assigned users or groups.

  Caution: If you set "Assignment required" to Yes, you must actually assign the intended people or a group — otherwise Entra rejects all sign-ins before MDM Lite is even involved (see AADSTS50105 in Section 9).

• Revocation — consent can be fully revoked at any time: delete the enterprise application, or withdraw the granted consent under Permissions. After that, no further sign-in to MDM Lite is possible.

7.4 Onboarding in MDM Lite

Granting admin consent alone does not yet unlock MDM Lite — MDM Lite must know about your directory before anyone can sign in. Afterwards, please tell Data Prudentia:

1. that consent was granted,
2. your directory ID (tenant ID) — Data Prudentia records it as the directory binding, so that only accounts from your directory can sign in to your workspace,
3. the email address of the first administrator for MDM Lite.

Data Prudentia then sets up your workspace and invites the named person as tenant admin. This person accepts the invitation by signing in with their Entra account, and can then invite all further users themselves — without any further involvement from your IT or additional Entra changes.

8. Testing steps for pilot users

Before extending access to more people, we recommend a test run with a single pilot user:

1. Have the tenant admin invite the pilot user via profile menu → "Manage users" → Invitations, choosing the desired role (Viewer, Editor, or Admin).
2. The pilot user receives an invitation email with an acceptance link and opens it.
3. They sign in with exactly the account to which the invitation was sent (see Section 6).
4. Expected result: After signing in, the "Welcome!" confirmation appears and the person lands in their workspace, with exactly the assigned role.
5. Also verify signing out (profile menu → "Sign out") and signing back in, to confirm the full sign-in cycle.
6. If you have enabled Conditional Access or "Assignment required": verify the pilot user is assigned in the enterprise application, or satisfies the Conditional Access policy (e.g. registered device, MFA), before running the test.

Once the test run succeeds, the tenant admin can add further people through the same invitation flow.

9. Error handling

9.1 Errors on the Entra side (AADSTS codes)

9.2 Messages on the MDM Lite side

These messages appear after a successful Entra sign-in, while MDM Lite authorizes the sign-in:

10. Support

For questions about the setup, please contact Data Prudentia GmbH:

• Email: admin@data-prudentia.de
• Website: https://data-prudentia.de