Skip to main content

🤖 Agents SSO

To provide a seamless Single Sign-On (SSO) experience between Docflo Agents and your ERP system, we recommend leveraging your organization's existing Microsoft Entra ID (Azure AD) integration.

How It Works​

  1. The user signs in to Docflo using Microsoft Entra ID.
  2. Microsoft Entra ID authenticates the user and establishes a browser session.
  3. When the user connects the ERP through the Agent, Microsoft Entra ID recognizes the existing session.
  4. Authorization is completed automatically — no additional credentials are required.
  5. The ERP becomes available within the Agent experience.
info

With administrator consent configured in advance, users will not see any consent or approval screens.

Required Azure Configuration​

Step 1: Create a New App Registration​

In the Azure Portal, navigate to App Registrations → New Registration and configure the following:

SettingValue
NameDocflo Agent MCP (or a name of your choice)
Supported account typesSingle tenant
Redirect URI typeWeb
Redirect URIhttps://api.docflo.ai/priority-mcp/userAuth/azure/callback

After creation, note down:

  • Directory (Tenant) ID
  • Application (Client) ID

Step 2: Create a Client Secret​

Navigate to App Registration → Certificates & Secrets → New Client Secret and configure:

SettingValue
Descriptiondocflo-agent-mcp
Expiration24 months
warning

Azure displays the Client Secret Value only once at creation time. Copy and store it securely before leaving the page.

Step 3: Grant Access to the ERP Application​

Navigate to App Registration → API Permissions → Add a Permission:

  1. Select APIs my organization uses
  2. Locate your ERP application
  3. Select Delegated Permissions
  4. Add the user_impersonation permission

Navigate to App Registration → API Permissions and select:

Grant admin consent for [Organization Name]

This step allows users to access the ERP through the Agent integration without being prompted for individual consent.

info

Administrator consent is strongly recommended. Without it, each user will be prompted to approve access individually on first use.

Step 5: Locate the ERP Application Client ID​

From the ERP App Registration in Azure Portal, note down:

  • Application (Client) ID

This identifier is required to request delegated access tokens for the ERP on behalf of authenticated users.

Information Required​

Please provide the following details to complete the integration setup:

ItemRequired
Microsoft Entra ID Tenant ID✅ Yes
Microsoft Entra ID Domain✅ Yes
Agent MCP App — Client ID✅ Yes
Agent MCP App — Client Secret✅ Yes
ERP Application (Client) ID✅ Yes
Admin Consent Granted⚠️ Recommended

Expected Result​

Once configured:

  • ✅ Users authenticate once using Microsoft Entra ID
  • ✅ No additional ERP login is required
  • ✅ No consent prompts are displayed to end users
  • ✅ The Agent can securely access the ERP on behalf of the authenticated user
  • ✅ User identity and permissions remain governed by Microsoft Entra ID

Now go to Docflo platform and update the information we collected above in relevant agent (SAP / Priority / NetSuite etc):

  1. Go to agent Authentication settings

SAP Public Cloud Credentials

  1. Select OAuth

SAP Public Cloud Credentials

  1. Set the details, note that "Scope" must include your ERP app client ID

SAP Public Cloud Credentials