Sign-in setup for your organisation

Three commands, about five minutes.

Run by a Global Administrator in your own Microsoft tenant

MyClaims MAX signs people in with their existing Microsoft work accounts. For that to work, an application registration has to exist in your directory — we cannot create it for you, and by design we have no access to do so.

Run the three commands below in Azure Cloud Shell or a local terminal with the Azure CLI. Paste the two values they return, and the last step builds a single message to send back. Nothing on this page is transmitted anywhere — everything stays in your browser until you choose to send it.

Sign in to your tenant

Make sure the next two commands land in the right directory.

az login --tenant yourcompany.com

Create the application registration

This is what your staff actually sign in through.

App ID returned by that command — the appId value, a GUID

Do not remove --enable-id-token-issuance true. Without it sign-in appears to succeed and then fails with a bare “401 Unauthorized”, and nothing is logged anywhere to say why. It cost us an evening to diagnose the first time.

Create a client secret

Lets MyClaims MAX complete the sign-in handshake. Valid for two years.

Enter the App ID above and this command will fill itself in.

Password returned by that command — the password value. It is shown once.

Send these back

Both values, plus what they belong to, in one message.

Fill in both values above and the message will appear here.

Open in email

The client secret is a credential. Sending it by email is the pragmatic option for a one-time handover — if your policy requires otherwise, send the App ID by email and pass the secret through whatever channel you normally use for credentials.