Microsoft Sign-In for Redmine

Q: The directory reports a redirect mismatch.

The value in the registration differs from Redirect URI on the settings page, which shows the exact string to add. It must be registered as a web redirect, not another kind.

Q: Sign-in worked yesterday and fails today.

The Client secret has expired. Create a new one in the registration, paste it here, and set Client secret expiry reminder this time.

Q: Somebody outside the organisation cannot sign in.

By design, only accounts in the directory named by Directory (tenant) ID may.

A Microsoft button on the sign-in page, tied to your own directory. People use the work account they already have, you stop managing passwords, and access ends when their directory account is disabled rather than when somebody remembers to lock them here. Only accounts in the directory you name can sign in.

Registering the application on Microsoft's side is covered in the Microsoft Entra integration guide.

What you can do

Availability: Business and above.
Turn it on: Administration → Plugins → RedminePRO Microsoft Sign-In, then paste the Directory (tenant) ID, Application (client) ID and Client secret from your app registration.
Permissions: None of its own.
Settings: Test configuration confirms connectivity by fetching your directory's configuration and signing keys.
Using it: A person opens the sign-in page and chooses the Microsoft button.

Directory, credentials and the sign-in mode — From a live RedminePRO workspace.

Configure

Settings, permissions, modules and how to use it on RedminePRO Cloud.

Includes connecting Microsoft Entra ID.

Install on your own Redmine

Requirements, install, update and remove, for a self-hosted Redmine 6.

Common questions

The directory reports a redirect mismatch.

The value in the registration differs from Redirect URI on the settings page, which shows the exact string to add. It must be registered as a web redirect, not another kind.

Sign-in worked yesterday and fails today.

The Client secret has expired. Create a new one in the registration, paste it here, and set Client secret expiry reminder this time.

Somebody outside the organisation cannot sign in.

By design, only accounts in the directory named by Directory (tenant) ID may.