Sign-in and security
Let your team sign in with Microsoft, and secure accounts with two-factor authentication and passkeys.
Sign in with Microsoft (Entra ID)
If your organization uses Microsoft 365, your team can sign in with their work account. The owner sets this up under Organization → Sign in with Microsoft. Signing in with a password remains possible as well, for example for external staff without a work account.
Step 1: app registration in Microsoft Entra
For this you need an administrator of your Microsoft environment.
- In the Microsoft Entra admin center, go to App registrations and choose New registration.
- As the account type, choose Accounts in this organizational directory only (single tenant).
- Under Authentication, add a redirect URI of type Web. Kuido shows the correct address on the settings page; it ends in
/sso/callback. - Under Certificates & secrets, create a new client secret and copy the value immediately. It cannot be viewed again later.
- On the overview page, note the Directory (tenant) ID and the Application (client) ID.
Step 2: entering the details in Kuido
Under Sign in with Microsoft, fill in:
| Field | What to enter |
|---|---|
| Directory (tenant) ID | From the app registration. |
| Application (client) ID | From the app registration. |
| Client secret | The value of the secret. Kuido stores it encrypted. |
| Allowed email domains | For example organization.com. Leaving it empty means: any account in your directory. |
| Create accounts automatically | On: anyone signing in for the first time gets an account immediately. Off: only invited team members can sign in. |
| Default role | The role for automatically created accounts: staff member or manager. |
Turn on Enable sign-in with Microsoft and save.
Signing in
On the sign-in page, your team chooses Sign in with Microsoft and enters the organization code. There is also a direct sign-in link, which you can share as a bookmark, for example. The settings page shows when someone last signed in through Microsoft.
Anyone who signs in through Microsoft is not asked for an extra code by Kuido. In that case, set up multi-factor authentication (MFA) in Entra, for example with Conditional Access.
Troubleshooting
| Message | Cause |
|---|---|
| Unknown organization code | The code is incorrect. You can find it in the address bar: /t/code. |
| Sign-in with Microsoft is not enabled for this organization | The owner has not turned it on yet. |
| This email address is not allowed | The domain is not in the allowed email domains. |
| You do not have an account yet | Automatic account creation is turned off. Ask a manager for an invitation. |
Two-factor authentication
If you sign in with a password, turn on two-factor authentication (2FA) under Settings → Security. Scan the QR code with an authenticator app (for example Microsoft Authenticator or Google Authenticator) and enter the six-digit code.
Then store the recovery codes in a safe place. If you lose your phone, you sign in with a recovery code. Each code works once.
Passkeys
With a passkey, you sign in without a password, using your device’s fingerprint, face recognition or PIN. Add a passkey under Settings → Security → Passkeys and give it a name you will recognize, for example iPhone.
Password
Change your password under Settings → Security. Choose a long, unique password. If you have forgotten it, use Forgot password? on the sign-in page.