Sign in with Microsoft 365
StoryVault supports sign-in via Microsoft 365 / Microsoft Entra ID. Your staff can log in with their work Microsoft account without setting an extra StoryVault password.
What the login looks like
Section titled “What the login looks like”- On the login page the user clicks “Sign in with Microsoft”.
- Microsoft asks — on first use — for consent to “Sign in” and “Read profile”. After that, an already-signed-in user is passed straight through.
- StoryVault checks that the Microsoft account belongs to an enabled organization and signs the user into the matching tenant.
The password login stays available in parallel. Even after SSO is enabled, users can still log in with a password — useful if they don’t have a Microsoft account or Microsoft is briefly unreachable.
What we need from your organization
Section titled “What we need from your organization”| Requirement | Who handles it? |
|---|---|
| Microsoft 365 / Entra ID tenant | You / your IT |
| Tenant ID (GUID) of your Microsoft organization | You / your IT (from the Azure portal) |
| List of allowed email domains | You (e.g. customer.com, customer-svc.com) |
| StoryVault tenant is created | StoryVault team |
| Enter SSO configuration | StoryVault team |
| StoryVault accounts for users with that domain | You + StoryVault team (invitation flow) |
What StoryVault will ask you
Section titled “What StoryVault will ask you”To enable SSO for your tenant, the StoryVault team needs the following from you. Please send all of them together to your contact:
- Tenant ID (GUID, e.g.
7da61081-ff2a-45fc-a63d-c9291842abcc) — find it in the Azure portal under Microsoft Entra ID → Overview → “Tenant ID”. - Allowed email domains — all domains whose owners may auto-link with their existing StoryVault account.
- Confirmation that the StoryVault app may sign in to your Microsoft tenant — either once, by a tenant admin (recommended), or per user on their first login.
Technical instructions for your IT — including the admin-consent URL and which permissions the app actually requests — are in our developer docs.
Who can sign in?
Section titled “Who can sign in?”Only users who satisfy all of the following can log in via SSO:
- Microsoft account belongs to your organization (verified via the tenant ID).
- A StoryVault account with that email exists.
- The account is active and is a member of the enabled StoryVault tenant.
- The email domain is on the allowed-domains list (required for first-time linking).
Important: Microsoft accounts that exist in your organization but have no StoryVault account are not allowed in — even with a matching email domain. The membership has to be created up front via the standard invitation flow. This prevents arbitrary Microsoft users from accessing StoryVault data unintentionally.
When something goes wrong
Section titled “When something goes wrong”If sign-in fails, the login page shows a brief explanation. The most common cases:
| Message | Meaning |
|---|---|
| ”Microsoft sign-in was cancelled” | You closed the Microsoft dialog or refused consent. |
| ”Invalid sign-in session” | The browser tab sat open too long. Please start over. |
| ”Microsoft sign-in is not configured for this organization” | Your Microsoft organization is not (yet) enabled for StoryVault — please contact StoryVault. |
| ”No StoryVault access for this Microsoft account” | Your Microsoft account is valid but no matching StoryVault account exists. An admin has to invite you. |
| ”Microsoft sign-in failed” | Technical issue — please report to support. |
What happens on first Microsoft login?
Section titled “What happens on first Microsoft login?”If your StoryVault account and your Microsoft account share the same email address (and your domain is allowed), StoryVault links them automatically. From the second login on, Microsoft sign-in goes through directly without further linking.
Microsoft sign-in is always in addition to the password login — there is no either/or switch. If you forget your StoryVault password and Microsoft is unavailable, the “Forgot password” flow still works.