Limit Entra ID SSO to a subset of users

Restrict Microsoft Entra ID SSO so only assigned users or a security group can sign in to Password Pusher Pro—not the entire company.

This article applies to: hosted subscriptions on pwpush.com and Self-Hosted Pro

When you register a Microsoft Entra ID app and paste the Client ID and secret into Password Pusher Pro, the entire tenant can sign in by default. Restricting access is an Entra ID enterprise-app setting, not a Password Pusher special case.

Short answer

Register a single-tenant app, set Assignment required? to Yes on the enterprise application, and assign a security group (or named users). Everyone else in the company is blocked at Microsoft login.

Why this happens

A single-tenant Entra app is available to anyone in the tenant who can complete OAuth—unless you require assignment. Password Pusher only stores the Client ID, secret, and (for single-tenant) Tenant ID. It does not decide who Microsoft will authenticate.

Require assignment

In the Microsoft Entra admin center:

  1. Go to Entra ID → Enterprise applications (not App registrations).
  2. Open the Password Pusher app.
  3. Open Properties.
  4. Set Assignment required? to Yes.
  5. Save.

Unassigned users then fail sign-in even with a valid company account. Admin consent is typically required once assignment is on.

Microsoft documents this under assign users and groups to an application.

Assign only the people who should use Password Pusher

Same enterprise app → Users and groups → Add user/group.

  • Assign individuals, or
  • Assign a security group (for example Password Pusher Users)

Notes:

  • Group assignment requires Entra ID P1 or P2.
  • Nested groups are not applied—only direct members of the assigned group.
  • This is the standard least-privilege pattern for a custom OAuth app (Client ID + secret).

What Password Pusher still controls

Entra only gates who can authenticate. After a successful Microsoft login:

Setting Effect
Auto-join (hosted, if enabled) Adds users who already passed SSO and match workspace rules (domain allowlist, seats).
Without auto-join Users still need a workspace invite.
Workspace roles (Admin / Manager / Member) Independent of Entra assignment.

Practical split:

  • Entra group = who can log in
  • Workspace invites and roles = what they can do once inside

The same Entra assignment pattern applies to Self-Hosted Pro Microsoft SSO. Hosted workspaces also apply auto-join, domain allowlist, and seats after the IdP handshake.

Related symptoms

Symptom Likely cause
Entire company can reach the Microsoft consent / login for Password Pusher Assignment required? is No (the default).
Valid employees get an Entra “not assigned” / access denied error They are not in Users and groups on the enterprise app.
Microsoft login succeeds, then Password Pusher says contact an administrator Auto-join is off, the email domain is not allowlisted, or there are no seats—invite them or adjust policy. See Hosted SSO troubleshooting.

See also