Set up single sign-on with Microsoft Entra ID

Canvus Server 26.11.1 and later lets people sign in with their Microsoft work account. The login page shows a Sign in with Microsoft button, and Canvus Server uses OpenID Connect to check the person's identity with Microsoft Entra ID. You configure everything in the web admin panel. You do not edit any configuration file, and you do not restart the server.

Canvus Server can offer up to five sign-in providers at the same time. Admin > Authentication is a list of providers, with one shared Network section. Microsoft Entra ID is one provider type in that list. See Use several sign-in providers. If you set up Microsoft on a 26.11.1 preview build, nothing changes: your set-up keeps working. See If you set up sign-in on a 26.11.1 preview build.

This page takes you through the full setup. If your identity provider is not Microsoft Entra ID, see Single sign-on with another OpenID Connect provider.

Note

Canvus Server 26.11.1 removed SAML. If you used SAML before, read Moving from SAML first.

Before you start

You need:

Canvus Server 26.11.1 or later.
Administrator access to the Canvus Server web UI.
The server's external URL set to the address that users type in their browsers, for example https://canvus.example.com. Single sign-on builds its redirect URI from this address, so it must match exactly what Entra has on record and must be reachable from your users' browsers. Set it with CANVUS_EXTERNAL_URL in podman-compose.yml or external-url in the [system] section of mt-canvus-server.ini. See Server configuration.
A Microsoft Entra role that can register applications, for example Application Developer. To add optional claims or grant consent you may need Cloud Application Administrator.
Outbound HTTPS (port 443) from the Canvus server to login.microsoftonline.com, directly or through a proxy. The server, not the user's browser, fetches the signing keys and exchanges the sign-in code. If your network inspects HTTPS or requires a proxy, see Behind a proxy or with an internal certificate authority.

Create the app registration with one command

Canvus Server can give you one command that does steps 1 to 3 below for you. You run it once in Microsoft's tools. It creates the app registration and prints the values you type into Canvus. If you prefer to click through the Entra admin center yourself, skip this section and start at Step 1. The manual steps still work.

Get the command

Sign in to the Canvus Server web UI as an administrator.
Open Admin > Authentication.
Under Sign-in providers, select Add provider, then select Microsoft Entra ID. To change a provider that already exists, select Edit on its card instead.
Find the block Set up in Microsoft Entra in the provider's form.
Select one of the two buttons above the command: Azure CLI (Bash) or PowerShell (Microsoft Graph).
Select Copy set-up command.

Copy the command from your own server. It contains your server's address, so a command from this page or from another server creates the wrong registration.

If you want certificate sign-in instead of a client secret, choose it first. Under How the server proves its identity, select Certificate. The block then asks you to generate the certificate first. Canvus can only generate a certificate for a provider that has been saved, so select Add provider with Offer this provider on the sign-in page cleared, then select Edit on the new card and select Generate certificate. The command then includes the certificate.

This is what the Azure CLI form looks like for a server at canvus.example.com with a client secret. Yours will differ in the address and may differ in the credential lines.

APP_ID=$(az ad app create \
  --display-name 'Canvus Server (canvus.example.com)' \
  --sign-in-audience AzureADMyOrg \
  --web-redirect-uris 'https://canvus.example.com/users/login/oidc/callback' \
  --optional-claims '{"idToken":[{"name":"email","essential":false}]}' \
  --required-resource-accesses '[{"resourceAppId":"00000003-0000-0000-c000-000000000000","resourceAccess":[{"id":"37f7f235-527c-4136-accd-4a02d197296e","type":"Scope"},{"id":"14dad69e-099b-42c9-810b-d002981feec1","type":"Scope"},{"id":"64a6cdd6-aab1-4aaf-94b8-3cc8405e90d0","type":"Scope"}]}]' \
  --query appId -o tsv) &&
az ad sp create --id "$APP_ID" --output none &&
SECRET=$(az ad app credential reset --id "$APP_ID" --display-name 'Canvus Server' --years 1 --query password -o tsv --only-show-errors) &&
echo "Tenant ID:     $(az account show --query tenantId -o tsv)" &&
echo "Client ID:     $APP_ID" &&
echo "Client secret: $SECRET"

Where to run it

Azure CLI (Bash). Open Azure Cloud Shell at https://shell.azure.com, choose Bash, paste the command and press Enter. Cloud Shell needs nothing installed. You can also use a terminal where az login is signed in to your tenant.
PowerShell (Microsoft Graph). Use PowerShell with the Microsoft.Graph module. Install it once with this command:
```
Install-Module Microsoft.Graph -Scope CurrentUser
```
Paste the command into PowerShell. It asks you to sign in to your tenant.

Sign in with the account of the tenant whose users should use Canvus.

Who can run it

By default, any user in a Microsoft Entra tenant can register an application. If your tenant has turned that off, the Application Developer role is enough.

What the command creates

One app registration, single tenant only, named Canvus Server (<host>), where <host> is your server's address.
The redirect URI of your server, as a Web redirect URI.
The email optional claim on the ID token.
The Microsoft Graph permissions openid, profile and email.
A service principal (the enterprise application) for the registration.
A credential. With Client secret, it is a client secret that is valid for one year. With Certificate, it is your server's certificate attached to the registration, and no client secret is created.

It changes nothing else in your tenant.

What it prints

When it finishes, the command prints these lines:

Printed line	Where it goes in Canvus
`Tenant ID`	Directory (tenant) ID
`Client ID`	Application (client) ID
`Client secret`	Client secret. Printed only with Client secret.

Copy the client secret at once. Microsoft shows it once, and it is not printed again. If you lose it, create a new secret in the Entra admin center (see Option B).

Then go to Step 4. With the command you can skip steps 1 to 3, except that the credential for certificate sign-in is already attached.

Step 1: Copy the redirect URI from Canvus

Sign in to the Canvus Server web UI as an administrator.
Open Admin > Authentication.
Scroll to the bottom of the page and find the Redirect URI field. It reads <external-url>/users/login/oidc/callback.
Select Copy.

Every provider on the server uses this same address. If the field shows an address that is not the one users type, stop and fix the external URL first (see Before you start).

Step 2: Register the application in Entra

Sign in to the Microsoft Entra admin center. If you can access several tenants, use the Settings icon in the top menu to switch to the tenant whose users should sign in to Canvus.
Browse to Entra ID > App registrations and select New registration.
In Name, enter a name your users will recognise, for example Canvus Server.
Under Supported account types, select Single tenant only - \<your tenant>.
Under Redirect URI (optional), select the platform Web and paste the redirect URI you copied in step 1.
Select Register.
On the Overview page, copy the Directory (tenant) ID and the Application (client) ID. You enter both in Canvus in step 4.

Tip

If you already registered the application without a redirect URI, open the registration, select Manage > Authentication, select Add Redirect URI on the Redirect URI configuration tab, select the Web tile, paste the redirect URI and select Configure.

Add the email claim

Canvus matches and creates accounts by e-mail address, so the ID token must carry an email claim. Entra does not include it by default.

In the app registration, under Manage, select Token configuration.
Select Add optional claim.
For Token type, select ID.
Select email, then select Add.
If Entra asks to turn on the Microsoft Graph email permission, accept.

If a user has no email claim, Canvus falls back to the user's sign-in name (preferred_username) when it contains an @. Users with neither cannot sign in.

Step 3: Create the credential

Canvus Server must prove its identity to Entra when it exchanges the sign-in code. Choose one method.

Option A: Certificate (recommended by Microsoft)

Microsoft recommends a certificate over a client secret. Canvus generates the key pair itself and keeps the private key.

In Canvus, open Admin > Authentication. Canvus can generate a certificate only for a provider that is already saved. If you have not added the Microsoft provider yet, select Add provider, select Microsoft Entra ID, clear Offer this provider on the sign-in page and select Add provider. Then select Edit on the new card.
Under How the server proves its identity, select Certificate.
Select Generate certificate.
Select Download certificate (.cer). The file is named canvus-sso.cer. Note the Thumbprint shown on the page.
In the Entra admin center, open your app registration and select Certificates & secrets > Certificates > Upload certificate.
Select canvus-sso.cer and select Add.
Check that the Thumbprint in Entra matches the one in Canvus.

With the one-command set-up, the command attaches the certificate for you and you skip steps 5 to 7.

Warning

The generated certificate is valid for 365 days. Entra refuses a certificate that has expired, and sign-in stops. Set a reminder to generate and upload a new certificate before it expires. Generate a new certificate replaces the current one, and sign-in stops until you upload the new .cer file to Entra and save.

Option B: Client secret

In the Entra admin center, open your app registration and select Certificates & secrets > Client secrets > New client secret.
Enter a Description, choose an expiry (Microsoft recommends less than 12 months, and allows at most 24 months) and select Add.
Copy the secret Value, not the Secret ID. Entra never shows the value again after you leave the page.
Note the expiry date in your calendar. When the secret expires, sign-in stops.
In Canvus, open Admin > Authentication, select Edit on the Microsoft provider (or add it, see step 4), select Client secret under How the server proves its identity and paste the value into Client secret.

Canvus stores the secret encrypted and never shows it again. After you save, the field tells you that a secret is saved. Leave it blank on later saves to keep it.

Step 4: Finish the configuration in Canvus

In Admin > Authentication, under Sign-in providers, select Add provider and then Microsoft Entra ID. If the provider is already in the list, select Edit on its card.
Paste the Directory (tenant) ID.
Paste the Application (client) ID.
Leave Name shown on the button empty, unless this server has more than one Microsoft provider (see Name shown on the button).
Make sure the credential from step 3 is set.
Decide whether to select Allow new accounts. With it on, Canvus creates an account the first time someone signs in. The e-mail domain allow-list and the admin approval setting still apply (see Who can sign in).
Select Test connection. A working setup reports Connection works. with the issuer and the number of signing keys. This test checks that the server can reach Microsoft and that the tenant exists. It does not check the client ID or the credential, so a successful test does not prove that sign-in works.
Select Offer this provider on the sign-in page.
Select Add provider for a new provider, or Save for an existing one. The message Provider saved. appears. The change applies at once, with no restart.

Name shown on the button

The optional field Name shown on the button is only needed when this server has more than one Microsoft provider, for example two tenants. The button then reads Sign in with Microsoft (name), so people can tell the buttons apart. With one Microsoft provider, leave it empty and the button reads Sign in with Microsoft.

Open a private (incognito) browser window and go to your Canvus Server address.
Select Sign in with Microsoft and sign in with a test user. If the server offers several providers, the login page shows one button for each.
You should land in Canvus, signed in as that user.
Repeat from the Canvus app (see Sign-in from the Canvus app).

If something goes wrong, see Troubleshooting.

Canvus does not decide which Microsoft users may use it. You do, in Entra:

In the Entra admin center, browse to Entra ID > Enterprise apps and open your application.
Under Properties, set Assignment required? to Yes and select Save.
Under Users and groups, select Add user/group and assign the people or groups that may use Canvus.

Users who are not assigned get an error from Microsoft and never reach Canvus.

Warning

If you do not require assignment, every user in your tenant can sign in, and Canvus creates an account for each of them when Allow new accounts is on.

When a user signs in for the first time, Canvus checks in this order:

If this Microsoft identity is already linked to a Canvus user, that user signs in.
Otherwise, if a Canvus user already has the same e-mail address, Canvus links the identity to that user. This works for accounts created with a password, so people keep their canvases and permissions.
Otherwise, Canvus creates a new account, but only if Allow new accounts is on and the user's e-mail domain is on the sign-up allow list. If Require admin approval is on, the account is created as not approved and the user cannot sign in until an administrator approves it.

Canvus compares e-mail addresses without regard to upper or lower case.

Warning

Matching by e-mail means that a Microsoft user whose address equals the address of an existing Canvus account, including an administrator account, signs in to that account. Use Assignment required? and keep e-mail addresses in your tenant under your control.

Remove a user's single sign-on link

Canvus remembers which Microsoft identity belongs to which Canvus user. Remove that link when the person received a new identity in your directory (for example, the account was deleted and created again) and sees the message about a different single sign-on identity.

In Canvus, open Admin > Users and select Edit for the user.
Under Single sign-on, check the provider, the date the link was made and the last sign-in.
Select Remove link and confirm.

The user can no longer sign in with the old identity. The next time they use single sign-on with the same e-mail address, Canvus links the new identity. Their password sign-in, canvases and permissions do not change. Canvus records an Unlink SSO identity entry in the audit log.

Administrator rights are granted in Canvus, not by Entra, in this release. A user who signs in for the first time is a regular user. An administrator makes them an administrator in Admin > Users.

The sign-up allow list and admin approval are set on the General page of the admin area, or with sign-up-allow-list and require-admin-approval in the [authentication] section of the configuration file. See Server configuration.

Behind a proxy or with an internal certificate authority

The Canvus server calls Microsoft over HTTPS. If your network sends this traffic through a proxy, or inspects it with a certificate from your own certificate authority (CA), configure Canvus as follows.

The proxy and certificate settings are in the Network section of Admin > Authentication. They apply to every provider on the server. Select Save network settings after you change them. The message Network settings saved. appears. Test connection on a provider uses the values you have typed in Network, even before you save them.

Proxy. In the Network section, enter the proxy in Outbound proxy URL, for example http://proxy.example.com:3128. The URL must start with http://, https:// or socks5://. If you leave the field blank, the server uses the HTTPS_PROXY and NO_PROXY environment variables of the Canvus server process. For the container, add them under the environment: block of the canvus service in podman-compose.yml and restart the containers.

Internal CA. If an inspecting proxy re-signs the traffic, the server does not trust its certificate and Test connection fails. In the Network section, paste the root CA certificate of your organisation into Extra root CA certificates (PEM). Use PEM text that starts with -----BEGIN CERTIFICATE-----. You can paste more than one certificate. Canvus then trusts the operating system's certificates plus the ones you add.

Select Test connection on a provider after each change.

The page shows a saved proxy password as ****, for example http://user:****@proxy.example.com:3128. The server keeps the stored password when you save without changing the field. If you change the proxy address or user name, type the password again.

Behind your own load balancer

Canvus limits single sign-on attempts for each network address, so that one address cannot keep everyone else from signing in. If a load balancer or reverse proxy that you run sits in front of Canvus, every user appears to come from its address and they share one allowance.

To give each person their own allowance, open the Network section in Admin > Authentication and enter the address of the load balancer in Trusted proxies, one address or range per line, for example 10.0.5.12 or 10.0.5.0/28. Canvus then reads the user's address from the X-Forwarded-For header that the load balancer adds. The load balancer must set or append that header.

Enter only devices you control. A range can be at most /24 for IPv4 and /64 for IPv6, and you can enter up to 16 entries.
Leave the field empty if users reach Canvus directly.

The Canvus app opens the same sign-in page in a built-in browser window, so Sign in with Microsoft is available there too. Whether a user can finish the sign-in inside that window depends on how your organisation asks them to prove who they are.

Sign-in method in Entra	In the Canvus app
Password	Works.
Password and an approval or code from Microsoft Authenticator	Works.
Password and a code by text message or phone call	Works.
Passkey, security key, Windows Hello	Cannot be used in the app's window. With Canvus client 26.11.1 or later, Microsoft offers the user another method, such as the password. Earlier clients stop at Face, fingerprint, PIN or security key.
Passkey or security key as the only allowed method	Does not work in the app's window. Use the browser sign-in below.
Conditional Access that requires a managed or compliant device	Does not work in the app's window, because Entra cannot see the device's management state there. Use the browser sign-in below.

A user who cannot finish the sign-in inside the app can complete it in a normal browser, and the app is signed in as a result.

In the Canvus app, open the sign-in window for the server.
Select the QR Code tab.
Select Copy link.
Paste the link into a browser on the same computer, for example Microsoft Edge or Google Chrome, and select Sign in with Microsoft.
When the browser shows All set, return to the Canvus app. It is signed in.

The browser must be able to reach the Canvus server. A browser on the same computer as the Canvus app always can, also when the server is only reachable inside your network. The Canvus server does not need to be reachable from the internet.

On a video wall or a shared display, scan the QR code with a phone instead. The phone must be on a network that can reach the Canvus server, for example your office Wi-Fi or VPN.

Options for administrators

Tell users with passkeys or a managed-device policy to use the browser sign-in above.
Ask users to open Canvus in the web client in a browser on a managed device.
Exclude the Canvus application from the Conditional Access policy in Entra, if your security policy allows it.

Troubleshooting

Canvus shows a short, fixed message on the login page. The technical detail, including Microsoft error codes such as AADSTS7000222, is written to the server log. See File locations for where the log is.

Message	Cause	Fix
`Sign-in took too long or was started in another tab. Please try again.`	The sign-in took more than 5 minutes, or the browser lost its cookies (a different tab, a different address, or blocked cookies).	Start again from the login page. Use the same address that is set as the external URL.
`Sign-in was cancelled or refused by your organisation's sign-in page.`	The user cancelled, or Microsoft refused the sign-in.	Look in the server log for the Microsoft error. Check assignment and consent (see below).
`Your organisation's sign-in response couldn't be verified. Ask your administrator to check the single sign-on settings.`	The ID token failed a check: wrong tenant, no `email` claim and no usable sign-in name, e-mail marked as not verified, or the server did not accept the sign-in code.	Check the server log for the reason. Add the `email` optional claim (step 2). Check that the tenant ID is the tenant the user signs in from.
`The server couldn't reach your organisation's sign-in service. Ask your administrator to run Test connection in Admin > Authentication.`	The server could not reach Microsoft, does not trust the certificate, or Microsoft refused the server's credential.	Run Test connection. If it works, check the client ID, and check that the secret has not expired or the certificate in Entra is the one Canvus shows.
`There's no Canvus account for you yet, and new accounts can't be created by single sign-on on this server. Ask your administrator.`	Allow new accounts is off and no Canvus account has this e-mail.	Turn on Allow new accounts, or create the user in Admin > Users with the same e-mail.
`Your e-mail domain isn't allowed to create an account on this server. Ask your administrator.`	The e-mail domain is not on the sign-up allow list.	Add the domain to the allow list, or create the user in Admin > Users.
`Your account is waiting for an administrator to approve it.`	Require admin approval is on.	Approve the user in Admin > Users.
`Your e-mail address belongs to a Canvus account that is linked to a different single sign-on identity. Your administrator can remove the old link in Admin > Users.`	A Canvus account with this e-mail is already linked to another Microsoft identity, for example after a user was deleted and re-created in Entra.	Remove the old link: see Remove a user's single sign-on link. The user then signs in again and Canvus links the new identity.
`Your Canvus account is blocked. Ask your administrator.`	The Canvus user is blocked.	Unblock the user in Admin > Users.
`Your e-mail address belongs to an archived Canvus account. Ask your administrator.`	A Canvus account with this e-mail address was archived. Canvus does not create a second account for the same address.	Give the person a different address in your directory, or contact MultiTaction support to restore the archived account. A user deleted in Admin > Users does not cause this message: Canvus creates a new account for that person if Allow new accounts is on.
`Your account at your organisation's sign-in service has no e-mail address. Ask your administrator.`	The sign-in response carried no `email` claim and no usable user name in e-mail form.	Add the `email` optional claim (see Add the email claim) and make sure the user has a mail address in your directory.
`Your e-mail address has not been verified by your organisation's sign-in service. Ask your administrator.`	The provider reported the address as unverified. This applies to providers other than Entra ID.	Verify the address at the provider.
`Your account changed while you were signing in. Please sign in again.`	Two sign-ins for the same new user ran at the same moment, or the account was changed during the sign-in.	Sign in again. No administrator action is needed.
`This Canvus server has no valid licence, so only administrators can sign in. Ask your administrator.`	The server licence is missing or has expired.	Activate a licence in Admin > License.
`Too many sign-in attempts from your network. Wait a moment and try again.`	The server limits single sign-on attempts for each network address. Many people behind one address (a load balancer or reverse proxy in front of Canvus) share one allowance.	Wait a few seconds and sign in again. If Canvus sits behind your own load balancer or reverse proxy, see Behind your own load balancer.
`Signing in took too long. Try again.`	The server did not finish the sign-in in time, for example while it was starting or under heavy load.	Sign in again. If it keeps happening, check the server log.
`Single sign-on isn't available from that link. Use the sign-in options on this page, or ask your administrator if you need single sign-on set up.`	The user followed an old SAML link or portal tile, or single sign-on was turned off.	Update bookmarks and portal tiles to the Canvus login page. See Moving from SAML.
`Single sign-on is not set up on this server.`	Single sign-on is off or not saved.	Turn on Offer this provider on the sign-in page and save the provider.
`Single sign-on failed. Please try again, or ask your administrator.`	Any other single sign-on failure.	Check the server log.

Messages from Test connection

Message	Cause	Fix
`The server could not verify <host>'s certificate. Add your organisation's root CA in Admin > Authentication.`	An inspecting proxy re-signs HTTPS with your own CA.	Paste the root CA under Network (see Behind a proxy or with an internal certificate authority).
`Could not reach <host> through the proxy <proxy>. Check the outbound proxy setting.`	The proxy refused the connection or is wrong.	Correct Outbound proxy URL, or the `HTTPS_PROXY` variable.
`Could not reach <host> from the server. Check the network, firewall or outbound proxy settings.`	DNS, firewall or timeout.	Allow outbound HTTPS to `login.microsoftonline.com`, or set a proxy.
`The identity provider answered HTTP <code> for <address>. Check the issuer URL or tenant ID in Admin > Authentication.`	Wrong tenant ID. Entra answers 400 or 404 for an unknown tenant.	Copy the Directory (tenant) ID again from the Overview page.
`Tenant ID must be the directory (tenant) ID, such as ..., or a verified domain such as contoso.onmicrosoft.com.`	The tenant ID has the wrong format.	Paste the GUID from the Overview page.
`Tenant ID is required for Microsoft Entra ID.`, `Client ID is required to enable SSO.`, `Client secret is required when the server authenticates with a client secret.`	A required field is empty.	Fill it in.

Errors shown by Microsoft

These appear on Microsoft's own page, before the user returns to Canvus.

Error	Cause	Fix
`AADSTS50011`, the redirect URI does not match	The redirect URI in Entra differs from the one Canvus sends. Common causes: `http` instead of `https`, a different host name, a trailing slash, or the external URL changed.	In Entra, Authentication, make the Web redirect URI identical to the Redirect URI in Canvus.
`Need admin approval`	Your tenant does not let users consent to applications.	In the app registration, select API permissions > Grant admin consent for \<tenant>.
The user is not assigned to the application	Assignment required? is Yes and the user is not assigned.	Assign the user or a group under Users and groups.

Errors from the credential appear in the server log. AADSTS7000222 means that the client secret has expired. Create a new secret in Entra, paste its Value into Client secret in Canvus and select Save.

Where the settings are stored

Canvus stores the settings in a file named sso-config.json. The client secret and the certificate's private key are encrypted with AES-256-GCM. The key that encrypts them is in a separate file, .sso-config.key, in a different folder.

Installation	`sso-config.json`	Key file
Container	`/canvus-data/config/sso-config.json` on the host, `/etc/MultiTaction/canvus/sso-config.json` in the container	`/canvus-data/certs/.sso-config.key` on the host, `/etc/MultiTaction/canvus/server/certificates/.sso-config.key` in the container
Linux `.deb`	`/etc/MultiTaction/canvus/sso-config.json`	`/var/lib/canvus/.sso-config.key`
Windows (MSI)	`%ProgramData%\MultiTaction\canvus\sso-config.json`	`%ProgramData%\MultiTaction\canvus\keys\.sso-config.key`
Linux, manual install without `/var/lib/canvus`	`sso-config.json` in the folder of the configuration file in use	`.sso-config.key` in a `keys` folder under the service user's home directory

You can move the key file by setting the environment variable CANVUS_SSO_KEY_FILE to its full path. The server writes both paths to its log at start-up, in lines that begin Single sign-on config file: and Single sign-on key file:.

Back up both files, and keep them apart. Without the key file, the stored secret cannot be read. If the key file is lost, the server still starts. The Authentication page then shows The stored client secret can't be decrypted on this server. Enter it again and save. Enter the secret again and save. For certificate sign-in, generate a new certificate and upload it to Entra.

Canvus Server keeps all providers in this one file. If you set up sign-in on a 26.11.1 preview build, it also keeps a copy of the old file as sso-config.v1.json in the same folder. See If you set up sign-in on a 26.11.1 preview build.

See also Backup and restore and File locations.

Moving from SAML

Canvus Server 26.11.1 removed SAML. After the upgrade:

The [saml] section and the saml-enabled and saml-sign-up-enabled keys in mt-canvus-server.ini are ignored.
If saml-enabled=true is still in the file, the server writes SAML sign-in was removed in 26.11.1; configure OpenID Connect in Admin > Authentication to its log at start-up, and Admin > Authentication shows the banner SAML sign-in was removed in 26.11.1. Set up OpenID Connect below to restore single sign-on.
SAML users cannot sign in until you set up OpenID Connect.
Old SAML links and identity provider portal tiles open the Canvus login page. Replace them with the login page address.

To switch:

Follow this page from the start.
Use Microsoft Entra ID, or the provider you used for SAML (see Single sign-on with another OpenID Connect provider).
Your users keep their accounts, canvases and permissions, because Canvus matches them by e-mail address on their first sign-in. Check that the e-mail addresses in your identity provider are the same as the ones in Canvus.
After you have confirmed that sign-in works, you can remove the [saml] section from the configuration file.

A server that must keep using SAML must stay on Canvus Server 26.11.0.

Set up single sign-on with Microsoft Entra ID

Before you start

Create the app registration with one command

Get the command

Where to run it

Who can run it

What the command creates

What it prints

Step 1: Copy the redirect URI from Canvus

Step 2: Register the application in Entra

Add the email claim

Step 3: Create the credential

Option A: Certificate (recommended by Microsoft)

Option B: Client secret

Step 4: Finish the configuration in Canvus

Name shown on the button

Step 5: Test the sign-in

Who can sign in

What happens on first sign-in

Remove a user's single sign-on link

Behind a proxy or with an internal certificate authority

Behind your own load balancer

Sign-in from the Canvus app

What works in the app's sign-in window

Sign in with a browser instead

Options for administrators

Troubleshooting

Messages on the login page

Messages from Test connection

Errors shown by Microsoft

Where the settings are stored

Moving from SAML