Azure AD / Entra ID SSO: Security Best Practices

This article outlines recommended configuration and maintenance steps for organizations using Azure SSO (Microsoft Entra ID) with Motimate. These recommendations are part of general security hygiene and help ensure that your SSO configuration follows commonly accepted best practices 🔐

1. App registration recommendation

    

   Review: “Allow public client flows”
    

   • Recommended: 
     Disable “Allow public client flows” unless your organization specifically requires it (for example, when using device code flow).
      

   • Why: 
     Public client flows allow authentication scenarios that do not require a client secret and should generally only be enabled when necessary.
      

     Reference (Microsoft): 
     Configure desktop apps that call web APIs

     
      

2. Enterprise application recommendation
    

   Review: appRoleAssignmentRequired (enterprise application / service principal)
    

   • Recommended: 
     Verify whether appRoleAssignmentRequired is enabled for the Motimate enterprise application.
      
   • If you plan to enable it, ensure that users are explicitly assigned to the application before attempting to sign in.
      

   • Otherwise, users may receive an error such as AADSTS50105.
      

     Reference (Microsoft): 
     Restrict a Microsoft Entra app to a set of users

     
     
      

3. Secret key rotation hygiene
    

   Rotate client secrets periodically
    

   • Recommended: 
     Rotate the Motimate app client secret periodically (for example, once per year) or according to your organization’s internal security policies.
      
   • Many organizations manage SSO through an internal IT or security team, or an external IT partner. Make sure the appropriate owner is involved when performing secret rotation.
     
      

Getting help

If you have questions about your SSO configuration, please contact Motimate Support.