Skip to main content

How to set up your SSO with Paperless Forms – Microsoft Entra ID Setup Guide

#App #Website #SSOLogin #EntraID

Microsoft Entra ID Setup Guide

This guide walks your IT/identity team through registering Paperless Forms with Microsoft Entra ID so your organization's users can sign in to Paperless Forms using your existing single sign-on.

Overview

Paperless ships in two main applications:

Application

Where it runs

Paperless Forms iPad & Windows App

iPad and Windows devices

Paperless Forms Website (Admin)

A browser, used by administrators and support

Paperless Forms Web App

iOS, Windows and Android devices

Each one needs its own registration in your identity provider, because they authenticate differently (a mobile/desktop app uses different OAuth flows than a website).

You will create two to three app registrations total, then share their identifiers with Paperless Forms support, who will activate SSO for your organization.

Before you start

Have ready:

  • Admin access to your identity provider (Microsoft Azure admin center)

  • A test user account you can use to verify the setup

  • ~30 minutes

Then, decide on:

  • Whether all users in your organization can use Paperless Forms via SSO, or only specific groups

Microsoft Entra ID Setup

ℹ️ If your organization uses Okta instead, head over to the Okta procedure

Step 1 — Create the Paperless Forms iOS/Windows App (for the iOS & Windows version on devices)

  1. Sign in to Microsoft Azure admin center (https://entra.microsoft.com)

  2. Go to Identity → Applications → App registrations

  3. Click ➕ New registration

  4. While registering the application:

    • For Name, use Paperless App, or anything you prefer

    • For Supported account types, select Single tenant only

    • For Redirect URI:

      • Select Public client/native (mobile and desktop applications)

      • Add the address http://localhost:7890/callback

  5. Click Register

  6. Create a new Text (.txt) document

  7. Create a line called Paperless App ID:

  8. Copy the Application (client) ID from the app's General page, which is a long string

  9. Paste it in the Text document next to Paperless App ID:

  10. In the left menu, click Manage → Authentication (Preview)

  11. From the Redirect URI configuration tab, click ➕ Add Redirect URI

  12. Select Mobile and desktop applications

  13. Add the following custom redirect URIs: com.peak.pelican://oauth/callback

  14. Click Configure

  15. Still on the Authentication (Preview) page, from the Settings tab

    • Set Allow public client flows to Enabled

  16. Click Save

  17. In the left menu, click Manage → API permissions

  18. Click ➕ Add a permission

  19. Select Microsoft Graph

  20. Select Delegated permissions, then select:

    • email

    • offline_access

    • openid

    • profile

  21. Click Add permissions

  22. Still on the API permissions page, click on ✔️Grant admin consent for [...]

  23. In the left menu, click Manage → Token configuration

  24. Click ➕ Add optional claim

  25. For the Token type, select ID, then select:

    • email

    • preferred_username

  26. Click Add

  27. Continue to the next step to gather the next ID

Step 2 — Create the Paperless Website App (for the admin website)

  1. Sign in to Microsoft Azure admin center (https://entra.microsoft.com)

  2. Go to Identity → Applications → App registrations

  3. Click ➕ New registration

  4. While registering the application:

    • For Name, use Paperless Website, or anything you prefer

    • For Supported account types, select Single tenant only

    • For Redirect URI:

      • Select Single-page application (SPA)

      • If you are on the US infrastructure, add the address
        ​https://paperless.datahex.ca/Login/SsoCallback
        or if you are on the Canadian infrastructure, add the address
        ​https://ca-paperless.datahex.ca/Login/SsoCallback

  5. Click Register

  6. Create a new Text (.txt) document

  7. Create a line called Paperless Website ID:

  8. Copy the Application (client) ID from the app's General page, which is a long string

  9. Paste it in the Text document next to Paperless Website ID:

  10. In the left menu, click Manage → Certificates & secrets

  11. From the Client secrets tab, click ➕ New client secret

  12. For Description, use Paperless Website Secret, or anything you prefer

  13. For Expires, preferably select the longest available option, but ultimately go with the option that suits your need the most

  14. Click Add

  15. Copy the Value from the Paperless Website Secret, which is a long string

  16. Create a line called Paperless Website Secret: in the Text document

  17. Paste it in the Text document next to Paperless Website Secret:

  18. In the left menu, click Manage → API permissions

  19. Click ➕ Add a permission

  20. Select Microsoft Graph

  21. Select Delegated permissions, then select:

    • email

    • offline_access

    • openid

    • profile

  22. Click Add permissions

  23. Still on the API permissions page, click on ✔️Grant admin consent for [...]

  24. In the left menu, click Manage → Token configuration

  25. Click ➕ Add optional claim

  26. For the Token type, select ID, then select:

    • email

    • preferred_username

  27. Click Add

  28. If you are using the Paperless Forms Web App, continue to the next step to gather the next ID

Step 3 — Create the Paperless Forms WebApp App (for the Web App version on devices)

  1. Sign in to Microsoft Azure admin center (https://entra.microsoft.com)

  2. Go to Identity → Applications → App registrations

  3. Click ➕ New registration

  4. While registering the application:

    • For Name, use Paperless WebApp, or anything you prefer

    • For Supported account types, select Single tenant only

    • For Redirect URI:

      • Select Single-page application (SPA)

      • If you are on the US infrastructure, add the address
        ​https://paperless-webapp.datahex.ca/sso/callback
        or if you are on the Canadian infrastructure, add the address
        ​https://ca-paperless-webapp.datahex.ca/sso/callback

  5. Click Register

  6. Create a new Text (.txt) document

  7. Create a line called Paperless WebApp ID:

  8. Copy the Application (client) ID from the app's General page, which is a long string

  9. Paste it in the Text document next to Paperless WebApp ID:

  10. In the left menu, click Manage → Authentication (Preview)

  11. From the Settings tab, in Front-channel logout URL if you are on the US infrastructure, add the address
    ​https://paperless-webapp.datahex.ca
    or if you are on the Canadian infrastructure, add the address
    ​https://ca-paperless-webapp.datahex.ca

  12. In the left menu, click Manage → API permissions

  13. Click ➕ Add a permission

  14. Select Microsoft Graph

  15. Select Delegated permissions, then select:

    • email

    • offline_access

    • openid

    • profile

  16. Click Add permissions

  17. Still on the API permissions page, click on ✔️Grant admin consent for [...]

  18. In the left menu, click Manage → Token configuration

  19. Click ➕ Add optional claim

  20. For the Token type, select ID, then select:

    • email

    • preferred_username

  21. Click Add

Step 4 — Send the credentials to Paperless Forms' team

Email Paperless Forms support the Text document that was built over the previous steps.

  • Identity provider: Entra ID

  • Tenant ID: a long string from your Microsoft Azure home page (e.g., "12345678-1234-1234-1234-123456789abc")

  • Paperless App ID: The value from Step 1

  • Paperless Website ID: The first value from Step 2

  • Paperless Website Secret: The second value from Step 2

  • Paperless WebApp ID: The value from Step 3, optionally

Paperless Forms support will enable SSO for your account using these values.

Common pitfalls

Why does Paperless need up to three apps?

Mobile/desktop apps use a different OAuth flow than browser apps. Identity providers require separate registrations because they have different redirect URI requirements (custom URL schemes vs. HTTPS).

My Okta app keeps showing invalid_token_endpoint_auth_method during testing.

This means that the application was created or configured with Client authentication set to Client secret.

  1. Go to Applications and ressources → Applications

  2. Click on the app you want to edit

  3. In the General tab, edit the Client authentication from Secret client to None

My users get no_matching_policy when signing in

Step 4 of the Okta setup is incomplete.

  1. Go to Security → API → Authorization Servers

  2. Click the default authorization server

  3. In the Access Policies tab, ensure that the applications created in Steps 1 and 2 (and optionally 3) have the rule created in Step 4 assigned to them, and that its Status is set to Active

My users get access denied even though they're in Okta

  1. Go to Applications and ressources → Applications

  2. Click on the app you want to edit

  3. In the Assignments tab, add the group(s) or set the application to Allow everyone in your organization to access

Can we reuse one app for both Device and Web?

In Okta: No, the app types are different (Native vs. Single-Page Application) and the allowed redirect URI formats don't overlap.

In Microsoft Entra: Technically possible (one app with multiple platform configurations), but we recommend separate apps for better audit logging and per-platform policy control.

Will users see a consent screen?

The first time a user signs in, they may be prompted to consent to the requested permissions (the "openid", "profile", "email" claims).

For Microsoft Entra, an admin can pre-grant consent for the entire tenant under API permissions → Grant admin consent to skip this.

What happens after setup

Once you provide the Client IDs and Authority to Paperless Forms support:

  1. Paperless Forms support enables SSO for your organization

  2. Your users open Paperless Forms on their devices, sign in with their Paperless Forms username and password as usual

  3. After validating their Paperless Forms credentials, the app will redirect them to your identity provider's sign-in page (Okta or Microsoft sign-in)

  4. After they sign in with their company SSO credentials, they're returned to Paperless Forms and can use the app normally

The same flow applies for the Paperless website.

If a user's identity provider account is later disabled (e.g., they leave the company), they will lose access to Paperless within a short period — even if their Paperless Forms password still exists, the SSO check will fail.

Did this answer your question?