Identity: domain and identity provider

Before BeeSensible can link an employee to your organisation, it needs to know which email domain belongs to your organisation and through which identity provider employees on that domain sign in. Only once that is in place does the sign-in hint work that the sign-in script places on each device in the next step. Without that connection, employees get the regular account picker and have to choose an organisation and an account themselves. That is why you set this up first, in the rollout console under Identity. Intune is not involved yet.

#Setting up the domain and identity provider

1. Verify the domain. Add your employees' email domain and create the DNS record the console shows at your DNS provider. As soon as BeeSensible finds that record, the domain is verified and you can connect an identity provider to it.
2. Connect the identity provider. Under Business sign-in (Microsoft Entra ID) you find the steps for the app registration in Entra. The console shows the Redirect URI to enter in Entra, and the fields Directory (tenant) ID, Application (client) ID and Client secret (value), into which you copy the details from Entra.
3. Pick a neutral app name. Microsoft shows the app registration's name to every employee on the sign-in screen, so choose a name employees will recognise, such as BeeSensible. You can rename it later in Entra under App registrations → Branding & properties.
4. Note when the client secret expires. A client secret in Entra has an expiry date. Once it has expired, work sign-in stops working until you create a new secret in Entra and paste it into the console, so put the expiry date in your calendar.
5. Keep emergency access. Employees who sign in through the identity provider have no password of their own at BeeSensible. If the connection with Entra fails at some point, for example because of an expired secret, someone still has to be able to get into the dashboard. Make sure at least one administrator has their own password and a second factor. Emergency access in the console shows whether that is the case.

#Synchronising employees automatically

Without synchronisation, you manage your organisation's members in BeeSensible by hand: you invite new employees and remove leavers yourself. You can leave that to Microsoft Entra ID instead. Entra then uses SCIM (System for Cross-domain Identity Management, a standard for exchanging user data between systems) to create new employees in BeeSensible, and an employee you deactivate in Entra also loses access to BeeSensible. Synchronisation covers employees only; groups and departments continue to come from the directory at sign-in, as they do without SCIM.

You set up synchronisation under Identity, at Synchronise employees automatically. This is only possible once your organisation has a verified domain, because otherwise BeeSensible cannot establish that an address belongs to your organisation; without a verified domain, synchronisation refuses every employee.

While synchronisation is on, the directory is the source for the member list. Inviting an employee by hand in the dashboard is then refused. Removing a member remains possible, so that you can still take away someone's access immediately without going through Entra.