This article explains how your organization enables Single Sign-On for NIC MAP, and exactly what we'll need from your IT team to make it happen. If your organization has the below requirements prepared, please reach out to your NIC MAP Client Success representative or email us at [email protected] to get started.
What SSO gives you
With SSO, your users sign in to NIC MAP using your organization's own Microsoft Entra ID (formerly Azure AD) credentials — the same account they use for Microsoft 365. Benefits:
No separate NIC MAP password to manage, reset, or rotate.
Centralized control — when you disable a user in Entra, their NIC MAP access ends too.
Your security policies apply — MFA, Conditional Access, and device policies you already enforce carry through to NIC MAP sign-in.
Supported today: Microsoft Entra ID via OpenID Connect (OIDC). If your organization uses a different identity provider (e.g. Okta, Ping, ADFS via SAML), let us know — support is evaluated case by case.
How it works, at a glance
A user goes to NIC MAP and enters their work email address.
NIC MAP recognizes your email domain and redirects them to your Microsoft sign-in page.
The user authenticates with Microsoft (including any MFA / Conditional Access you require).
Microsoft returns the user to NIC MAP, and they're signed in.
Access is gated to your tenant and your email domain(s) — only users from your organization can sign in this way.
What we need from your IT department
This is the short list to hand to whoever manages your Microsoft Entra tenant. Once this information has been gathered, contact your NIC MAP Client Success representative or email [email protected] to get started.
# | We need | Why | Who provides it |
1 | Entra Tenant ID (Directory ID — a GUID) | Identifies your organization's directory so we only trust sign-ins from your tenant | Your IT / Entra admin |
2 | Email domain(s) your users sign in with (e.g. contoso.com) | Routes users at those domains to your SSO instead of a password login | Your IT |
3 | Admin consent — a one-time approval by a Global Administrator | Authorizes the NIC MAP Identity app in your tenant so your users can federate | Your Global Admin (via a link we send — see below) |
4 | Confirmation that sign-in tokens include upn, email, and name claims | We use these to identify and provision the user; a Conditional Access / claims-minimization policy can strip them | Your IT |
Implementation steps
Initiation — you send us items 1 and 2 from the table above.
Configuration — we register your organization: tenant and allowed domains.
Admin consent — your Global Admin approves the app (below).
Testing — we verify sign-in with your admin user(s).
Go live — we enable SSO for your organization and all associated NIC MAP users.
Granting admin consent (for your Global Administrator)
Before any of your users can sign in via SSO, a Global Administrator in your tenant must grant one-time consent to the NIC MAP Identity application.
NIC MAP will provide our CLIENT ID to your IT department.
Fill in your organization's TENANT ID and the NIC MAP CLIENT ID into the following link:
https://login.microsoftonline.com/{TENANT_ID}/adminconsent?client_id={CLIENT_ID}&redirect_uri=https://id.nicmap.com/signin-entraA Global Admin opens the link and signs in with an admin account in your tenant.
Review the permissions requested (basic sign-in / read the user's profile) and click Accept.
Notes for your admin:
The app may display as "unverified" — this is expected and not a cause for concern; it simply means we haven't completed Microsoft publisher verification.
After accepting, the browser redirects to a NIC MAP address — that's the normal landing, not an error.
Only an admin can grant this. A regular user who opens the link will see "Need admin approval" and cannot proceed (unless your tenant has the admin-consent request workflow enabled).
Enforcing SSO
Once you're confident SSO is working, we will require it for all your organization's users — password login is turned off for your users, so everyone authenticates through your Entra tenant. A small number of designated break-glass accounts can be exempted for emergency access. Talk to your NIC MAP contact when you're ready.
Troubleshooting & FAQ
"Need admin approval" when a user tries to sign in
Admin consent (step 3) hasn't been granted yet, or was granted in a different tenant. Have a Global Admin complete the consent link.
A user can't sign in even though consent was granted
Common causes: their email domain isn't on the allowlist we configured; they aren't a NIC MAP user yet; or a Conditional Access policy is blocking the app or stripping required claims.
We use guest (B2B) accounts
A guest's sign-in identity belongs to their home tenant, not yours, so guests generally won't match your organization's domain. Guests are not a supported SSO path — use member accounts in your tenant.
Does NIC MAP see our passwords?
No. Authentication happens entirely at Microsoft; NIC MAP only receives a signed confirmation of identity (your users' passwords are never sent to or stored by NIC MAP).
Security summary
We validate that each sign-in comes from your configured tenant and email domain(s), and that the token was genuinely issued by Microsoft for that tenant.
Passwords are never handled by NIC MAP.
MFA, Conditional Access, and device compliance you enforce in Entra apply to NIC MAP sign-in automatically.
Questions? Contact [email protected] and we can walk your IT team through each step.