How to set up Single Sign On (SSO) with Microsoft Entra

The 'Single Sign On' feature enables your company to have a more secure environment by granting increased security regarding access to your Dalux projects. With this feature, you can control how your organization's users access projects by giving them the option or requiring them to use SSO.

This article will go over how to set up SSO for your projects using Microsoft Login (MS Entra, formerly AzureAD).

Login must be agreed on from both Dalux and the customer’s organization to allow users to log in using their Microsoft Login.

Configuration options

When setting up SSO, you have different options to control how the login should look for your organization's users. In any case, Dalux must be registered in Microsoft Entra before you can provide Dalux with the required information for the setup.

If you want to use Microsoft Entra groups to manage user permissions in Dalux HelpDesk, Operations & Maintenance, or BIM & Documentation, make sure to register Dalux as 'Multitenant'.

Microsoft administrator with Dalux access

1. Dalux enables Microsoft Login for the customer domain
2. An administrator with appropriate access in Microsoft Entra logs in to Dalux. Here, they are asked to grant access to all organization users.
3. (Optional) If admin consent was not granted at the time of the first Microsoft Login to Dalux, the Dalux application can be found in the 'Applications' of Microsoft Entra. The admin can then grant consent from there.
4. In Dalux, define the organization's login policy.

Microsoft administrator without Dalux access

1. Dalux enables Microsoft Login for the customer domain
2. The organization's Dalux administrator defines the organization's login policy
3. The Microsoft administrator grants consent to the application in Microsoft Entra's 'Applications'.

Activate approval requests

You can decide whether you want to grant consent for your organization's users in general or whether a reviewer should grant consent individually.

To do this, enable consent requests in Microsoft Entra and add at least one reviewer type. This way, when a user tries to log in with Microsoft Login, they will be prompted with an approval request form:

The reviewer can then approve or deny the request for this user in Microsoft Entra.

Information to provide to Dalux

Dalux supports Single-Sign-On (SSO) over OAuth2.0 via Microsoft Entra and Microsoft Graph. Request the activation by contacting your Dalux consultant and providing the following information:

• SSO activation: Let your consultant know that you want to activate SSO for your organization.
• Domains: List the domains that you want to activate SSO for and provide the DNS TXT record for Dalux (DALUX=COXXXXXX) to identify as the controller of the registered domain.
• Name of your organization in Dalux (Company profile)

Managing login policies

You can specify how your organization's users are able to log into Dalux. It is possible to configure a domain as “purely SSO”, meaning that users registered with an email from the domain will only be allowed access to Dalux following successful authentication by AD. This will prevent users from having separate passwords in Dalux.

You control this option in the following settings. For Field, Box, Tender, or Handover, go to

Company profiles Select your company Settings 'Managed domains'

Select a domain that is connected to your organization and choose its 'Login policy'.

• Require AD: Requires users to log in with their Microsoft login
• Both AD and DaluxID: Users can choose to log in with Microsoft login or their Dalux account.

For Helpdesk, Operations & Maintenance, or BIM & Documentation: Contact your local CSM.

User management in Dalux FM with Entra

Managing user permissions

Dalux FM allows you to manage your Dalux user groups with groups from within Microsoft Entra. With this, you can manage user permissions in your AD, which will be synced with Dalux.

Make sure that your user groups in Dalux FM are properly set up, and navigate to

SettingsIntegrationsAzure AD

Copy the 'Client Id' and 'Tenant Id' from Microsoft Entra and enter the 'Client Secret' into the appearing window, then click 'Save'. Only after saving will the service attempt to connect. If the connection is successful, the actual mapping options of Microsoft groups, Dalux groups, and Regions will appear.

Mapping of your AD groups with user groups and user regions allows for an AD group to map to a single Dalux user group and region. It does not allow mapping to multiple combinations. You can map multiple AD groups to the same Dalux user group and region.

When entering the AD group's name, you can click on 'Validate' to make sure Dalux finds the group in your directory.

New Dalux user groups or AD groups are displayed immediately and can be mapped, synchronization is executed every night, so changes take a day to appear in Dalux.

Update user information

When a user authenticates via Microsoft Entra, the local Dalux user profile can be updated with the following values from the Microsoft Graph API (user.read):

• User.email -> Email
• User.givenName -> Name
• User.surname -> Name
• User.companyName -> Company
• User.mobilePhone -> Phone

This data in Dalux is overwritten by entries made in your directory. If the value in your directory is empty, the data in Dalux is retained.