--- title: "Set up Azure AD B2C SSO in WorkEasy" slug: "set-up-azure-ad-b2c-sso-in-workeasy" description: "Configure Azure B2C for identity management with step-by-step instructions for admins, ensuring secure single sign-on for employees." updated: 2026-10-04T15:53:20Z published: 2026-10-04T15:53:20Z canonical: "help.workeasysoftware.com/set-up-azure-ad-b2c-sso-in-workeasy" --- > ## Documentation Index > Fetch the complete documentation index at: https://help.workeasysoftware.com/llms.txt > Use this file to discover all available pages before exploring further. # Set up Azure AD B2C SSO in WorkEasy These instructions are intended for **Azure/IT administrators** or technical staff responsible for configuring identity and access management in their organization. The steps should be performed by someone with administrative access to both **Azure Active Directory** and **WorkEasy Software**. 1. See [Set up Azure AD SSO](/docs/set-up-azure-ad-sso) if you need single sign-on for employees instead of external customers. 2. Ensure you have an active Azure subscription. 3. Follow the [Microsoft guide](https://learn.microsoft.com/en-us/azure/active-directory-b2c/tutorial-create-tenant) to create an Azure B2C tenant. This ensures you have both an Azure account and a tenant subscription. 4. Use the [Microsoft tutorial](https://learn.microsoft.com/en-us/azure/active-directory-b2c/tutorial-register-applications?tabs=app-reg-ga) to register your application in the Azure B2C tenant and set up the redirect URI. 5. Enter a name for the registered application that clearly reflects its purpose. 6. Under **Supported account types** > **Who can use this application or access this API?**, select the third option: **Account in any identity provider...** 7. Add the Redirect URI: `<IdentityServer BaseUrl>/federation/AzureB2C.<CompanyCode>/signin` For example: `https://prism-time-accounts.workeasy.net/federation/ab2c.12345/signin` The company code in this example is **12345**. **Note:** - Only the first Redirect URI is used, even if multiple are added. - Changes may take 3–5 minutes to take effect. 8. In **Manage** > **Authentication** > **Implicit grant and hybrid flows**, select **ID tokens**. ![](https://cdn.us.document360.io/88d7ebef-752e-45d9-95e1-ee13bd7279c5/Images/Documentation/image(686).png?sv=2026-02-06&spr=https&st=2026-11-01T16%3A16%3A53Z&se=2026-11-01T17%3A16%3A53Z&sr=c&sp=r&sig=n29KgI3osXU55YSYVJxeThuMAORnEVBPJBy7CCpfEi4%3D) 9. In **Manage** > **Certificates & secrets** > **Client secrets**, click **+ New client secret** to generate a new secret. ![](https://cdn.us.document360.io/88d7ebef-752e-45d9-95e1-ee13bd7279c5/Images/Documentation/image(688).png?sv=2026-02-06&spr=https&st=2026-11-01T16%3A16%3A53Z&se=2026-11-01T17%3A16%3A53Z&sr=c&sp=r&sig=n29KgI3osXU55YSYVJxeThuMAORnEVBPJBy7CCpfEi4%3D) 10. Enter a description, select an expiration date (default: 6 months), and save. Copy the new secret and store it securely. ![](https://cdn.us.document360.io/88d7ebef-752e-45d9-95e1-ee13bd7279c5/Images/Documentation/image(710).png?sv=2026-02-06&spr=https&st=2026-11-01T16%3A16%3A53Z&se=2026-11-01T17%3A16%3A53Z&sr=c&sp=r&sig=n29KgI3osXU55YSYVJxeThuMAORnEVBPJBy7CCpfEi4%3D) 11. Create a new user flow following [Microsoft's instructions](https://learn.microsoft.com/en-us/azure/active-directory-b2c/user-flow-overview). ![](https://cdn.us.document360.io/88d7ebef-752e-45d9-95e1-ee13bd7279c5/Images/Documentation/image(711).png?sv=2026-02-06&spr=https&st=2026-11-01T16%3A16%3A53Z&se=2026-11-01T17%3A16%3A53Z&sr=c&sp=r&sig=n29KgI3osXU55YSYVJxeThuMAORnEVBPJBy7CCpfEi4%3D) 12. Select **Sign up and sign in** for the flow type. ![](https://cdn.us.document360.io/88d7ebef-752e-45d9-95e1-ee13bd7279c5/Images/Documentation/image(694).png?sv=2026-02-06&spr=https&st=2026-11-01T16%3A16%3A53Z&se=2026-11-01T17%3A16%3A53Z&sr=c&sp=r&sig=n29KgI3osXU55YSYVJxeThuMAORnEVBPJBy7CCpfEi4%3D) 13. Name the flow using the format `<TenantName>_signinandup`. 14. Select **Email signup** and make all other required selections. ![](https://cdn.us.document360.io/88d7ebef-752e-45d9-95e1-ee13bd7279c5/Images/Documentation/image(709).png?sv=2026-02-06&spr=https&st=2026-11-01T16%3A16%3A53Z&se=2026-11-01T17%3A16%3A53Z&sr=c&sp=r&sig=n29KgI3osXU55YSYVJxeThuMAORnEVBPJBy7CCpfEi4%3D) 15. Make all other selections as shown here. ![](https://cdn.us.document360.io/88d7ebef-752e-45d9-95e1-ee13bd7279c5/Images/Documentation/image(698).png?sv=2026-02-06&spr=https&st=2026-11-01T16%3A16%3A53Z&se=2026-11-01T17%3A16%3A53Z&sr=c&sp=r&sig=n29KgI3osXU55YSYVJxeThuMAORnEVBPJBy7CCpfEi4%3D) 16. Go to **User flows** and select the tenant you created. Select the user attributes: **Country/Region, Email Address, Given Name, Surname, User is new,** and **User's Object ID**. ![](https://cdn.us.document360.io/88d7ebef-752e-45d9-95e1-ee13bd7279c5/Images/Documentation/image(712).png?sv=2026-02-06&spr=https&st=2026-11-01T16%3A16%3A53Z&se=2026-11-01T17%3A16%3A53Z&sr=c&sp=r&sig=n29KgI3osXU55YSYVJxeThuMAORnEVBPJBy7CCpfEi4%3D) 17. In **Settings** > **Properties**, enable **Self-service password reset**. ![](https://cdn.us.document360.io/88d7ebef-752e-45d9-95e1-ee13bd7279c5/Images/Documentation/image(713).png?sv=2026-02-06&spr=https&st=2026-11-01T16%3A16%3A53Z&se=2026-11-01T17%3A16%3A53Z&sr=c&sp=r&sig=n29KgI3osXU55YSYVJxeThuMAORnEVBPJBy7CCpfEi4%3D) 18. If needed, add a new Azure AD B2C user via **Home** > **Azure AD B2C** > **Users**. ![](https://cdn.us.document360.io/88d7ebef-752e-45d9-95e1-ee13bd7279c5/Images/Documentation/image(714).png?sv=2026-02-06&spr=https&st=2026-11-01T16%3A16%3A53Z&se=2026-11-01T17%3A16%3A53Z&sr=c&sp=r&sig=n29KgI3osXU55YSYVJxeThuMAORnEVBPJBy7CCpfEi4%3D) 19. Ensure users exist in both Azure AD B2C and WorkEasy with matching email addresses. ![](https://cdn.us.document360.io/88d7ebef-752e-45d9-95e1-ee13bd7279c5/Images/Documentation/image(717).png?sv=2026-02-06&spr=https&st=2026-11-01T16%3A16%3A53Z&se=2026-11-01T17%3A16%3A53Z&sr=c&sp=r&sig=n29KgI3osXU55YSYVJxeThuMAORnEVBPJBy7CCpfEi4%3D) 20. Copy the **Domain name**. ![](https://cdn.us.document360.io/88d7ebef-752e-45d9-95e1-ee13bd7279c5/Images/Documentation/image(715).png?sv=2026-02-06&spr=https&st=2026-11-01T16%3A16%3A53Z&se=2026-11-01T17%3A16%3A53Z&sr=c&sp=r&sig=n29KgI3osXU55YSYVJxeThuMAORnEVBPJBy7CCpfEi4%3D) 21. Copy the **Application (client) ID** and **Directory (tenant) ID**. ![](https://cdn.us.document360.io/88d7ebef-752e-45d9-95e1-ee13bd7279c5/Images/Documentation/image(716).png?sv=2026-02-06&spr=https&st=2026-11-01T16%3A16%3A53Z&se=2026-11-01T17%3A16%3A53Z&sr=c&sp=r&sig=n29KgI3osXU55YSYVJxeThuMAORnEVBPJBy7CCpfEi4%3D) 22. Send the following to WorkEasy Software: - **CompanyCode**: Company code - **AB2C_TenantCode**: Tenant name from earlier - **AB2C_TenantId**: Directory (tenant) ID - **AB2C_ClientId**: Application (client) ID - **AB2C_ClientSecret**: Secret from earlier step - **@AB2C_UserFlowName**: Flow name from earlier - **@AB2C_DomainName** 23. After WorkEasy Software have registered the application for SSO, perform a login test using: [https://accounts.workeasysoftware.com/Account/login?urltoken=](https://accounts.workeasysoftware.com/Account/login?urltoken=<CompanyCode>)