Step 1 – Register app in Azure Active Directory

1. Log in to Azure Portal
2. Select services: Azure Active Directory
3. Copy and save Tenant ID (marked on the screenshot)
4. On the left menu choose App registrations section and New registration
   |
5. Complete the form as shown below. Field Redirect URI fill in the same way as in the screenshot below, but at the end give the name of the organization you have set in tomHRM (workspace)
   
6. On the left menu go to Authentication. Select two checkboxes and Save form.
   
7. Go to Overview tab, copy and save value Application (client) ID

Step 2 – Configure tomHRM

1. On the left menu go to Settings > Settings > Authentication and turn on Single Sign-on
2. Choose
   1. User Identity Provider as Microsoft (Azure AD)
   2. URL token: https://login.microsoftonline.com/{tenant_id}/oauth2/v2.0/authorize
      ,where value {tenant_id} replace it with the value previously copied from your Azure account (Step 1 point 3 above),
      e.g.: https://login.microsoftonline.com/c8bf896d-52a2-42b2-aeca-ce083444480b/oauth2/v2.0/authorize
   3. Auth URL: https://graph.microsoft.com/v1.0/me
   4. Make sure that the Redirect URI that the tomHRM application automatically fills in is the same as the value you entered on the Microsoft Azure configuration pages in Step 1 point #6 above.
   5. Client Secret – null.
   6. Client ID: enter the value you wrote down earlier (Step 1, point #7 above).
   7. Scope: user.readBasic.All user.read openid profile email
   8. Response Type as: id_token token
3. Click Save

Step 3 – Connect Azure AD and tomHRM

tomHRM authorizes users from Azure AD based on a unique employee ID or email.
If the employees listed in Azure AD have the same emails defined in the tomHRM defined, the setup is complete.
Otherwise, associate employee accounts by providing identifiers.

1. In the Azure Portal go to Azure Active Directory and choose on the left menu Users
2. Each user on the list is assigned a unique identifier
3. Employee ID marked in the screen should be entered in the “Identifier” field in the employee profile in the tomHRM