Microsoft

Microsoft accounts are used in two separate places.

Signing in to PhiWebs

On the PhiWebs sign-in page, choose Microsoft to sign in with your Microsoft account. Nothing needs to be set up. This is how you and your workspace members sign in to the studio and the account app.

Your app’s visitors: company sign-in

An app can let its visitors sign in with your organisation’s Microsoft Entra ID (or another OpenID provider) instead of a PhiWebs account.

1. In Microsoft Entra, register an application as a single-page application. Use your app’s address, https://<app>.phiwebs.app, as its redirect URI. No client secret is needed, because visitors sign in with PKCE.
2. In the studio, open App, then Sign-in & people. Under visitor sign-in, choose Company account and fill in:
   • Issuer: https://login.microsoftonline.com/<tenant id>/v2.0;
   • Client ID: the registration’s Application (client) ID;
   • Audience: only when your tokens are issued for an API of your own (api://…).
3. Publish the app.

The sign-in tells the app who the visitor is. What they may do comes from the app’s own roles and its people list. App roles you assign in Entra also count when they have the same names as the app’s roles.

Your own services can call the app’s records API with a token from the same Entra registration. See API reference.

More on visitor sign-in: Visitor sign-in.