Microsoft SSO: sign in to rConfig with Entra ID

rConfig V8 signs users in with the Microsoft Entra ID (formerly Azure AD) account they already use for Teams, Outlook and the rest of Microsoft 365. No separate rConfig password to issue, rotate, or forget to remove when someone leaves, and the MFA and conditional access rules you already enforce apply to rConfig from the first login.

New in V8.3.3: Microsoft sovereign clouds

rConfig now signs in Entra ID tenants that live outside the commercial cloud. Set MICROSOFT_CLOUD in your .env file and rConfig uses the correct Microsoft endpoints for GCC High, DoD or China (21Vianet).

Before V8.3.3 every login was sent to login.microsoftonline.com. A GCC High tenant was redirected to an authority that did not know it, so the sign-in never came back and the account never appeared for approval. Upgrade to V8.3.3 and add one line to your .env file. See choose your Microsoft cloud.

---

What you get

One account, one offboarding step. Disable a leaver in Entra ID and their rConfig access goes with it. No orphaned local account still holding the keys to your network devices.

Your existing MFA, applied to rConfig. Number matching, hardware keys, conditional access by device compliance or location: whatever your tenant enforces at sign-in is enforced before rConfig ever sees the user.

An approval gate you still control. A successful Microsoft login does not grant rConfig access on its own. The first sign-in creates the account in a pending state and an administrator has to enable it, so a valid tenant account is not the same thing as access to your configuration backups.

A login page your users recognise. The rConfig login screen gains a Sign in with Microsoft button. That is the whole change from the user’s point of view.

---

Supported Microsoft clouds

Microsoft cloud	Who it applies to	MICROSOFT_CLOUD value	Supported since
Commercial (Global)	Standard Microsoft 365 tenants, including GCC Moderate	commercial (default)	All V8 releases
US Government GCC High	Entra ID tenants in Azure Government	gcc-high	V8.3.3
US Government DoD	Department of Defense tenants in Azure Government	dod	V8.3.3
China (21Vianet)	Tenants operated by 21Vianet	china	V8.3.3

GCC Moderate is not GCC High

The two are easy to confuse and they need different settings. GCC Moderate tenants are hosted in the commercial cloud and keep the default commercial value. If your users sign in at login.microsoftonline.com today, you are on commercial. GCC High and DoD tenants sign in at login.microsoftonline.us and need gcc-high or dod.

If Microsoft adds a cloud rConfig does not list yet, or your deployment reaches Microsoft through your own hostnames, MICROSOFT_LOGIN_ENDPOINT and MICROSOFT_GRAPH_ENDPOINT let you set both hosts directly.

---

How the login works

1. A user clicks Sign in with Microsoft on the rConfig login page.
2. rConfig redirects them to the sign-in host for your configured cloud.
3. They authenticate with Microsoft, including any MFA or conditional access your tenant requires.
4. Microsoft redirects back to rConfig with an authorization code, which rConfig exchanges for a token.
5. rConfig reads the account name and email from Microsoft Graph and creates the user with SSO access disabled.
6. An administrator enables the account under Users and assigns a role. The user can sign in from then on.

Steps 2 and 5 are the ones that differ per cloud, which is why both the sign-in host and the Graph host move together when you set MICROSOFT_CLOUD.

---

What you need before you start

• Administrator access to the Microsoft portal for your cloud: portal.azure.com for commercial, portal.azure.us for GCC High and DoD.
• Administrator access to rConfig V8, plus shell access to edit .env on the rConfig server.
• rConfig reachable over HTTPS on a real domain name. Microsoft will not redirect back to a plain HTTP address.
• Someone nominated to approve new SSO users, since nobody gets in until an administrator enables them.

---

Next step

Work through Microsoft SSO implementation to register the application in Microsoft, set the rConfig environment values for your cloud, and approve your first user.