Microsoft Entra ID integration

Ollet gives your employees a recovery page they can reach from the Microsoft sign-in screen. Before an account can be recovered, the employee verifies their identity with Ollet on their iPhone, and Ollet compares the result with their name in Entra.

This guide is for administrators. Each organization completes the setup once, in its own tenant, from the Microsoft Entra admin center.

Before you begin#

You need a Microsoft Entra ID tenant and administrators who hold the following roles:

Test users should have Ollet installed and identity setup complete on a supported iPhone. Follow Getting started before relying on the app for account recovery.

Email info@ollet.id to request an Entra integration. Include your company name, a technical contact, and your Tenant ID, which is on the Overview page of your tenant. Ollet links the tenant ID to your organization's record and replies with two links:

• The consent link used in step 1.

• Your recovery link, used in step 3. It has this form, where <org> is the identifier Ollet assigns to your organization:

  https://<Ollet host>/recovery/<org>

1. Approve the Ollet application#

Open the consent link from Ollet. It has this form:

https://login.microsoftonline.com/organizations/v2.0/adminconsent?client_id=<Ollet application ID>&scope=https%3A%2F%2Fgraph.microsoft.com%2F.default&redirect_uri=<Ollet redirect URI>

1. Sign in as a Global Administrator or Privileged Role Administrator.
2. Review the three permissions Ollet requests.
3. Select Accept.

Ollet then appears under Entra ID > Enterprise applications. Deleting it there removes Ollet's access to your tenant at any time.

If Ollet adds a permission later, open the consent link again to approve it.

2. Match employee names to their ID documents#

Ollet compares the name on the employee's ID document with their name in Entra. Under Entra ID > Users, check each user's First name and Last name in Properties.

Use names that correspond to the user's passport. Include all given names, and avoid preferred names or nicknames that differ from the document. A mismatch blocks recovery.

3. Publish the recovery link on the sign-in page#

A locked-out employee cannot sign in to find Ollet, so the link has to be on the Microsoft sign-in page itself.

1. Open Entra ID > Custom branding and edit the default sign-in experience.

2. Open the Sign-in form tab.

3. Set Sign-in page text to a link to your recovery page, for example:

   [Locked out?](https://<Ollet host>/recovery/<org>)

4. Under Self-service password reset, set Common URL to the same recovery link.

5. Select Save.

The sign-in page text appears under the sign-in form. The common URL replaces the default Forgot my password destination.

4. Test the recovery workflow#

1. Sign out, open the Microsoft sign-in page for your tenant, and confirm both links appear.
2. Select each link and confirm it opens your organization's recovery page.
3. Complete a recovery as a test user whose Entra name matches their passport.

Also test a mismatched name, cancellation, and an expired session. None should recover the account.

Removing Ollet#

Delete Ollet under Entra ID > Enterprise applications to revoke its access immediately. Remove the recovery link from Custom branding at the same time so employees are not sent to a page that can no longer help them.

Troubleshooting#

For help, contact info@ollet.id with your company name, tenant ID, the step being tested, and the error shown.