Self-hosted appliances configure Microsoft Entra ID authentication differently — see the self-hosted version of this article for the appliance flow, which uses a Microsoft client secret and requires a separate Entra ID licence key.
On Foldr Cloud, Microsoft Entra ID authentication is a toggle on the same Entra app you set up for Microsoft 365 storage. When it’s on, users can sign in to Foldr with their Microsoft 365 account. The same Federated Identity Credential (FIC) that authorises storage access also covers the sign-in flow — there is no second app registration, no client secret, and no separate licence.
Prerequisites
Microsoft 365 storage must be wired up first. The sign-in flow rides on the same Entra app and the same Federated Identity Credential. If you haven’t done that yet, follow OneDrive & SharePoint Online integration — steps 1 through 4 are the only ones strictly required for sign-in.
One thing worth checking even if storage is already working: signing someone in reads their account and their group memberships through Microsoft Graph, so your Entra app needs the User.Read.All and Group.Read.All Application permissions, with admin consent granted. They’re listed in step 3 of the storage article, and they’re easy to skip past if all you wanted at the time was files. Without them Microsoft refuses the lookup with Authorization_RequestDenied (“Insufficient privileges to complete the operation”) and nobody can sign in.
Enable Microsoft sign-in
-
Add the sign-in redirect URI to your Entra app. In the Azure portal, open the app you registered for Microsoft 365 integration. Go to Authentication, click the Web platform you registered in step 1 of the storage setup, and add a second Redirect URI:
https://<your-foldr-subdomain>.foldr.cloud/services/microsoft/signinWithout this URI registered, sign-in fails with AADSTS50011 after the user authenticates with Microsoft. The URI is also displayed with a copy button in Foldr Settings (next step) once Microsoft sign-in is enabled.
-
Flip the toggle in Foldr. In Foldr, open Foldr Settings → Integrations → Microsoft and turn on Microsoft sign-in. Three related options become available:
- Redirect all users to Microsoft Online — every user signs in via Microsoft. Foldr-local accounts can no longer sign in via the standard Foldr screen.
- Show a sign-in button — puts a Sign in with Microsoft button on the Foldr sign-in screen, so people can go straight to Microsoft without typing a username first. Off by default. (You won’t see it offered if Redirect all users to Microsoft Online is on, because nobody reaches the sign-in screen to press it.)
- Allow guest user access — users from other Microsoft tenants who are guests in yours can sign in.
-
Save changes. The toggle takes effect immediately.
User experience
Out of the box there’s no separate button. Someone types their username or email address on the Foldr sign-in screen, Foldr recognises it as a Microsoft account and sends them to Microsoft Online; once they authenticate (including MFA if Entra requires it), they’re redirected back to Foldr and signed in.
If you’d rather they didn’t have to type anything first, turn on Show a sign-in button and a Sign in with Microsoft button appears on the sign-in screen alongside whatever else you have enabled.
The first time a user signs in this way, they may see a consent prompt — but only if admin consent for your Entra app’s permissions hasn’t already been granted. If you completed the storage setup including the two directory permissions above, admin consent is already in place.
The Foldr Windows app supports automatic sign-in when the device’s Edge browser is already signed into Microsoft 365.
Coexistence with Foldr-local accounts
By default, Microsoft sign-in runs alongside any other sign-in methods you have enabled: people type their username and Foldr works out where to send them. Turn on Show a sign-in button and they get an explicit Sign in with Microsoft button as well. If you turn on Redirect all users to Microsoft Online, the Foldr-local sign-in screen is bypassed entirely.
Revoking sign-in
To stop allowing Microsoft sign-in, turn off the toggle in Foldr Settings → Integrations → Microsoft. The storage integration keeps working — only the sign-in flow is disabled.
If you want to disconnect Microsoft 365 entirely (sign-in and storage), see Revoking the trust on the storage integration page.
Related articles
- OneDrive & SharePoint Online integration — the storage integration this page builds on.
- Microsoft Entra ID authentication (self-hosted) — the appliance equivalent, which is a fuller-featured product mode with its own licence.