Jump to:
Login with Microsoft is now powered by YAROOMS Identity, a centralized Microsoft Entra ID app managed by YAROOMS. You no longer need to register your own Azure AD app, manage client secrets, or configure redirect URIs for sign-in. Admin consent is still required once so YAROOMS can read user details and group memberships from your Entra ID tenant for provisioning and attribute mapping.
Activate the integration
Log in to YAROOMS as an administrator and navigate to Settings → Integrations → Login with Microsoft.
In the Options tab, turn on Integration active. This makes the Microsoft sign-in button available on the login page. Review access and provisioning settings below before saving.
Grant admin consent
Before provisioning and attribute sync can work, a tenant administrator must authorize the YAROOMS Identity app against your Microsoft Entra ID tenant.
- Click Grant admin consent. A new tab opens against Microsoft with the YAROOMS Identity consent screen.
- Sign in as an Entra ID administrator and approve the requested permissions on behalf of your organization. The permissions requested are:
- Application:
User.Read.All,GroupMember.Read.All - Delegated:
openid,email
- Application:
- Return to the YAROOMS tab. Once consent is detected you’ll see a confirmation and the provisioning controls become editable.
If consent is never detected, re-open the authorization link and complete the flow again.
Configure domain restrictions
In Options → Access, use Who can sign in to choose which Microsoft accounts can access your workspace:
- Allowing any domain removes the domain restriction. The user must still exist in YAROOMS unless first-sign-in provisioning is enabled.
- Specific domains in our organization restricts sign-in to the domains you list in Allowed domains. Enter one domain per line, for example:
example.com example.org
Configure user provisioning
Use the provisioning switches to control how users are created and updated:
- Provision new users at first sign-in: when enabled, a YAROOMS user is created automatically the first time a matching Microsoft account signs in. When disabled, only users that already exist in YAROOMS can sign in.
- Update properties at each sign-in: keeps user team, location, and roles in sync with Entra ID on every sign-in. If disabled, properties are read only when the user is first provisioned.
- Delete users after AD deprovisioning: users removed from Entra ID are automatically deleted from YAROOMS once a month.
- Auto-provision users from Microsoft directory: users present in Entra ID are automatically added to YAROOMS once a day. Unlike first-sign-in provisioning, this does not require each person to sign in first.
Warning: Enabling first-sign-in provisioning without a domain restriction can allow Microsoft accounts outside your organization to create users in your workspace. Select Specific domains in our organization and list only domains you control. If you cannot restrict domains, keep first-sign-in provisioning disabled.
Choose the provisioning options that fit your onboarding process; the enabled switches in the screenshot are examples, not a recommendation to enable everything. Review location, team, and role mapping before turning on automatic provisioning.
Attributes mapping: set up your users
Open the Attributes mapping tab. This is where you decide which information YAROOMS reads from Microsoft Entra ID and how users receive their location, team, and roles.
Provisioning creates the user; mapping sets up their details. Configure this tab before enabling automatic provisioning so new users receive the right assignments from the start.
Default attributes
Pick the Entra ID property that should populate each core user field. Leave a field empty to use its built-in default: mail for email address, givenName for first name, and surname for last name.
Choose how users receive their location, team, and roles
Below Default attributes, configure Location, Team, and Roles. The same idea applies to each: choose a fixed assignment with Static, or let information from Entra ID determine the assignment with Dynamic. You can use different approaches for different sections, such as one location for everyone but different teams based on their Microsoft groups. Enable role mapping if you want the integration to assign roles too.
Static: give everyone the same assignment
Use Static when everyone should receive the same value. For example, if everyone should join the Staff team, there is no need to look up a different team for each person.
- Select Static in the section you want to configure.
- Choose the YAROOMS location, team, or role to assign, such as Staff in the screenshot.
- Repeat for any other section that should use a fixed assignment.
Dynamic: assign values based on each user’s Microsoft details
Select Dynamic to assign users different locations, teams, or roles based on their information in Microsoft Entra ID, instead of giving everyone the same value.
- Select Dynamic in the section you want to configure.
- Under Mapping type, choose Auto to match names from Entra ID with YAROOMS names exactly, or Manual to define the associations yourself.
- In Entra ID field, enter the source property YAROOMS should read. For team mapping based on Microsoft group membership, use
memberOf. - Choose a Default assignment for users with no match. Select a team or role that gives only the access those users should have.
- With Manual, pair each source value with its YAROOMS assignment. For teams, use Add team to the list, select the team, and paste the corresponding Microsoft group’s Object ID in the left column, not its display name. Repeat for the teams you need.
Suppose you have a Design group in Microsoft and want its members to join the Design team in YAROOMS.
Choose Manual and enter memberOf in Entra ID field. In the mapping table, paste the Microsoft Design group's Object ID on the left and select the YAROOMS Design team on the right.
YAROOMS reads which Microsoft groups each user belongs to. Members of that Design group receive the Design team.
Keep assignments up to date at sign-in
In the Options tab, enable Update properties at each sign-in if YAROOMS should reapply your mapping whenever the user signs in with Microsoft. For example, after someone moves from the Design group to Finance in Entra ID, their next Microsoft sign-in can update their YAROOMS team using the mapping above.
This applies to static assignments too: the configured fixed value is reapplied. If the option is disabled, mapping sets the properties when the user is first provisioned rather than updating them at each sign-in.
Sign-in updates are not continuous background synchronization. Changes in Entra ID are applied through this option at the user's next Microsoft sign-in. Auto-provision users from Microsoft directory is a separate option for creating users without waiting for their first sign-in.
Click Save to apply the integration settings.
Verify the integration
To confirm the integration is live, open your YAROOMS login page in a private/incognito window (or sign out first) and look for the Continue with Microsoft button above the email and password fields.
Click Continue with Microsoft and sign in with an allowed Microsoft account. If the button is missing, double-check that Integration active is turned on and that you saved the settings. If sign-in fails, verify the Who can sign in policy and Allowed domains, and check that the user exists in YAROOMS unless first-sign-in provisioning is enabled. If provisioning seems to be skipped, confirm that Grant admin consent was completed for your tenant.
After a successful sign-in, verify the user’s location, team, and roles against your mapping settings. Daily directory provisioning and monthly deprovisioning run on their respective schedules; they are not immediate sign-in actions.
⚠️ Changing your company's email domain? Most setups identify users by email address. Update the email addresses on existing YAROOMS accounts before users sign in through SSO with their new addresses. Otherwise, automatic provisioning may create duplicate accounts, with bookings split between old and new accounts and harder to manage.