On this page
Your IT admin registers CaterCow as an app in Microsoft Entra ID, then enters the app’s details in CaterCow. After that, everyone with an email on your company’s domain logs in to CaterCow with their Microsoft work account.
Using Okta instead? See How do I set up Okta single sign-on?
Before you start
- Single sign-on has to be available for your company first. When it is, your company’s designated admin sees Manage Enterprise Settings (e.g. Okta SSO) on your organization’s Settings tab. Don’t see it? Email us at support@catercow.com to set it up.
- You need someone who can register apps in your company’s Microsoft Entra tenant.
Set it up in Microsoft Entra ID
1. Sign in to the Microsoft Entra admin center. Under Entra ID, open App registrations and click New registration.
2. Enter a Name, such as CaterCow. Under Supported account types, choose Single tenant only.
3. Under Redirect URI, choose Web and enter this address exactly, then click Register:
https://www.catercow.com/authenticate/auth/dynamic_enterprise_okta/callback
The address says “okta” for every provider, Microsoft Entra included.
4. On the new app’s Overview page, click Add a certificate or secret. The same page shows the Application (client) ID and Directory (tenant) ID you’ll need in CaterCow.
5. Click New client secret, add a description, choose when it expires, and click Add.
6. Copy the secret’s Value, not its Secret ID, right away. Microsoft shows the Value only once.
7. Open API permissions and click Add a permission, then Microsoft Graph, then Delegated permissions. Check email, openid, and profile, then click Add permissions. If your tenant requires admin consent, click Grant admin consent for your organization.
Enter the details in CaterCow
1. Log in to CaterCow. Click Manage Organization under your organization’s name, then open the Settings tab.
2. Click Manage Enterprise Settings (e.g. Okta SSO). Under SSO, click Update SSO Settings.
3. For Provider, choose Microsoft Entra.
4. Fill in Directory (tenant) ID, Client ID (the Application (client) ID), and Client Secret (the secret’s Value). Enter the tenant ID by itself, not as a web address.
5. Click Submit.
From then on, everyone with an email on your company’s domain logs in through Microsoft Entra. The change can take up to a minute to reach the login page. Stay logged in here, and test it by logging in with a work email in a private browser window. If that fails, go back to Update SSO Settings and enter the values again.
You type these values into CaterCow yourself, so you never need to send us your client secret.
How your team logs in
1. Go to catercow.com/login.
2. Enter your work email. The password field disappears, and the button changes to Log in with SSO.
3. Click Log in with SSO, then sign in with your Microsoft work account.
No need to sign up first: your first sign-in creates your CaterCow account. If you already had an account with your work email, you keep it and its orders. Your CaterCow password stops working.
What changes for your team
- Sign-in starts on CaterCow. Opening CaterCow from Microsoft’s My Apps doesn’t sign you in. Go to catercow.com/login and enter your work email.
- Each person needs an email in Microsoft Entra on your company’s domain. CaterCow signs them in by that email.
- Passwords, Google sign-in, and Apple sign-in stop working for emails on your company’s domain. People with other emails, like contractors with personal addresses, keep logging in the way they do now.
- Single sign-on doesn’t add people to your organization on its own. An Admin still needs to invite them. If your organization uses single sign-on and you were invited, your first sign-in from your invite link adds you to that organization. See How do I join my organization from an invite link?
- CaterCow doesn’t sync with Microsoft Entra. Removing someone in Entra doesn’t remove them from your organization on CaterCow. Remove them there too.
- On My Account, single sign-on users can’t change their email, and the password and two-factor settings don’t appear.
- The form never shows your current values. To change one, fill in every field again.
What if…
…sign-in fails at Microsoft? CaterCow shows Microsoft’s error message word for word. Check with your IT admin before you contact support@catercow.com.
…someone signs in at Microsoft but isn’t logged in to CaterCow? Check that their Microsoft Entra account has an email address on your company’s domain.
…my client secret is about to expire? Create a new one in Microsoft Entra and enter it on Update SSO Settings before the old one expires. Once it expires, no one on your company’s domain can log in through single sign-on, you included. If that happens, email us at support@catercow.com.
…Enterprise Settings says SSO is currently disabled? Your team logs in with their usual CaterCow login for now. Email us at support@catercow.com to turn it back on.