Diagnosly
Register
Product How it works Personality Pricing Docs Sign in Register
Browse documentation
Personal
Getting started
What is Diagnosly Personal?Signing inInstalling the appYour first diagnosisA tour of the app
Using Diagnosly
Running a diagnosisDiagnosis historyFollow-upsWhat it can change, and how you approve itBackups and restore pointsApp updates
Credits and billing
How credits workSpending limits and checkpointsTopping up
Privacy and security
Privacy basics (PII scrubber)Your data and deleting your account
Help
TroubleshootingFrequently asked questions
Enterprise

For IT teams managing many PCs. Not needed for Diagnosly Personal.Learn more

Set up your fleet
Fleet agent installSetting up your first fleet
Fleet management
Fleet overviewFavouriting devicesBulk actionsRunning checksCommand audit trailFleet troubleshooting & alerts
Security and access
Role-based access control
Integrations
SSO with OktaSSO with Azure AD / Entra IDSMTP / email

SSO with Azure AD / Entra ID

Configure OIDC SSO with Microsoft Entra ID.

Azure AD (now Entra ID) is configured the same way as Okta, same OIDC backend, different IdP setup steps.

Configure Entra ID

  1. In Entra Admin Center, create a new App registration.
  2. Add a Web redirect URI: https://api.diagnosly.app/api/v1/auth/sso/{provider_id}/callback.
  3. Under Certificates & secrets, create a new Client secret. Copy it now, you can't see it again.
  4. Under Authentication, enable ID tokens and Access tokens.
  5. Under Token configuration, add the email and preferred_username optional claims.
  6. The Issuer URL for v2.0 is https://login.microsoftonline.com/{tenant_id}/v2.0, find your tenant ID under Overview.
  7. In Diagnosly: Admin → Identity Providers → Add provider with the values above.

The Diagnosly OIDC backend special-cases Azure v2.0 endpoints (it does discovery from /.well-known/openid-configuration), so the issuer URL alone is enough, no manual JWKS configuration required.

Multi-tenant Entra (advanced)

If you want to allow users from multiple Entra tenants to sign in, set the issuer to https://login.microsoftonline.com/common/v2.0 and use allowed_domains to restrict who actually gets through.

Group claims → roles

Mapping Entra group membership to Diagnosly roles is on the roadmap. Today, all SSO users provision as viewer and admins promote manually.