Single sign-on (Microsoft 365 / Azure): common questions

Quick answer: With Microsoft (Azure) single sign-on, staff sign in with their Microsoft 365 account. Their name, job title and department come from Microsoft 365, which is why those fields are greyed out in Centro ASSIST. Update them in Microsoft 365 and they'll update in Centro at the person's next sign-in.

Setting up single sign-on

Follow the Centro Azure AD Implementation Guide. When you register the app in Microsoft Entra, the redirect URI is:

https://yourorganisation.centroassist.com.au/sign-in/redirect-from-azure

Replace yourorganisation with your own domain, then send us your Client ID, Tenant ID and sign-in domain so we can switch it on. If you'd like to test with a pilot group first, we can keep the normal email and password sign-in available alongside Microsoft sign-in.

Common questions

Why can't I edit a user's name, job title or department? When someone signs in with Microsoft 365, their Microsoft 365 profile becomes the source of truth for these fields, so they're greyed out in Centro ASSIST. Make changes in Microsoft 365 and they'll appear in Centro the next time the person signs in. You don't need to delete or recreate the user, and their records (such as knowledge test results) are kept, even if their email address changes.

Do we need to set up user provisioning (SCIM) in Microsoft Entra? No. Centro ASSIST creates the user's account automatically the first time they sign in with Microsoft.

New staff see "Only activated users can sign in here". By default, accounts created on first Microsoft sign-in stay inactive until an administrator activates them. This is a security setting. Ask us to turn on instant access if you'd like new users activated automatically. Users who tried to sign in before then can be activated under People > Users.

Can staff use Microsoft sign-in on the mobile app? Yes. Make sure staff have the latest version of the Centro ASSIST app installed.

Set-up checklist and common mistakes

• Enter the redirect URI and home page URL without a forward slash at the end, and make sure the full /sign-in/redirect-from-azure path is saved in your Microsoft Entra app registration.
• Send us the Application (client) ID, the Directory (tenant) ID and the email domain that should use Microsoft sign-in. Don't send the enterprise application's Object ID. Using it causes the error AADSTS90002: tenant not found.
• Users' email addresses must use the email domain you gave us.
• A good order is: set up Microsoft sign-in, upload your users, then (optionally) switch off email and password sign-in.

Can we test with a few users first? Yes. While you test, the sign-in page shows both options: Microsoft and email and password. Tell staff to keep using email and password until you're ready. When you are, we can switch off email and password sign-in on a date that suits you, or turn it back on later if needed.

Can the sign-in buttons be renamed? Yes. Contact us, for example to show "Microsoft sign in" and "Email sign in".

Still need help?

Email support@centroassist.com.au or call 1300 420 171. Please include your organisation's Centro ASSIST web address (for example yourorganisation.centroassist.com.au) and a screenshot if you can.

If your Centro ASSIST subscription is through Ageing Australia, please contact Ageing Australia Quality Systems at quality@ageingaustralia.asn.au.