Kolleno now supports Microsoft Single Sign-On (SSO) — making it easier and faster to access your account using your existing Microsoft login credentials.
How it works:
Go to the Kolleno login screen
Click the new button: "Log in with Microsoft"
Enter your Microsoft email and password (if you're not already signed in)
You’ll be redirected and automatically logged into your Kolleno account
This eliminates the need to remember another password and aligns your login experience with your company’s IT policies if you already use Microsoft 365.
Technical FAQ for IT and security teams
What protocol do you use?
Kolleno uses OpenID Connect (OIDC) on top of OAuth 2.0, with Microsoft Entra ID (Azure AD).
Grant type: Authorization Code
Client type: confidential web app (client ID and client secret)
Authority: https://login.microsoftonline.com/common (multi-tenant)
Sign-in happens on the Microsoft login page, and Microsoft then redirects back to Kolleno. This is not OAuth 1.0, implicit grant, or ROPC (Kolleno never sees or sends your users' Microsoft passwords).
Do you use PKCE?
Yes. The authorization code exchange uses PKCE with the S256 challenge method, in addition to the client secret.
Which permissions and scopes are required?
Only standard delegated OpenID Connect scopes. No Microsoft Graph mail, files, or directory permissions are needed for SSO.
Scope | Type | Purpose |
openid | Delegated | Sign the user in and issue an ID token |
Delegated | Include the user's email address on the ID token | |
profile | Delegated | Basic name information |
offline_access | Delegated | Requested by default by the Microsoft authentication library. Kolleno does not store the resulting refresh token. |
There is no admin-restricted Graph permission for SSO. If your tenant allows user consent, users can accept these scopes on first sign-in. If user consent is disabled, an Entra administrator (Cloud Application Administrator, Application Administrator, or Global Administrator) needs to grant admin consent for the Kolleno application.
Which ID token claims do you need?
Kolleno reads the ID token returned after sign-in. We do not call Microsoft Graph to load the user profile.
Claim | Required | Used for |
Yes | Identify the user and match the Kolleno invitation | |
sub | Yes | Stable Microsoft user identifier |
given_name | No | First name (falls back to name if missing) |
family_name | No | Last name |
Claims such as preferred_username, oid and tid may be present on a v2.0 token but are not required for login. The email claim must be present: Kolleno does not fall back to preferred_username. If a work account has no email address on its directory object, Entra will not issue an email claim and the sign-in will fail, so please make sure your users have a mail address populated, or enable the optional email claim on the ID token.
Does this work with Conditional Access?
Yes. Kolleno does not bypass Entra Conditional Access. Sign-in is an interactive browser redirect to Microsoft, so MFA, device compliance, named locations and other Conditional Access controls run on the Microsoft login page before an authorization code is issued.
Notes for your tenant:
Include the Kolleno enterprise application in the relevant Conditional Access policies, or at least do not exclude it
Kolleno sends prompt=select_account, which only forces the account picker. It does not skip MFA or Conditional Access
What do you not request for SSO?
SSO does not require any of the following:
Mail.Read, Mail.Send or Mail.ReadWrite
User.Read (not requested for this flow)
Directory.Read.All or any other directory administration permission
Application (app-only) permissions
Those belong to the optional Microsoft email and inbox integrations, which are a separate connection.
Short summary for IT
Item | Value |
Protocol | OAuth 2.0 and OpenID Connect |
Flow | Authorization Code |
PKCE | Yes (S256) |
Client | Confidential (client secret) |
Scopes | openid, email, profile, offline_access |
Required ID token claims | email, sub |
Optional ID token claims | given_name, family_name, name |
Conditional Access | Supported, enforced by Entra at login |
Graph or mailbox access for SSO | None |