Read First

Vibe SSO App Permissions

1. User.Read
2. offline_access
3. Group.Read.All
   

1. User.Read
2. offline_access
   

1. User.Read: This allows us to retrieve the user's First Name, Last Name, Unique ID, and Email Address for authentication and user management purposes.
2. offline_access: This enables us to periodically re-check the groups the validated users belong to. This ensures that any updates to user accounts in Entra (e.g., changes in group memberships) are reflected in the Vibe admin page automatically.
3. Group.Read.All: This permission is only required during the first login. It allows us to fetch a list of groups to set up mappings between the user groups in our system and the corresponding Entra groups.
   

Importantly, we only retrieve groups that contain the word "vibe" to keep the scope of this request focused and relevant. By requesting these permissions, Vibe ensures secure and seamless SSO functionality while respecting the principle of minimal access.

Managing SSO Users

Add Users

To add a new Vibe portal user, create a new Microsoft account (or choose an existing one) and add the user to the relevant group in portal.azure.com.

Remove Users

To remove a users access to the Vibe.fyi portal, deactivate/delete their Microsoft account OR remove them from the Azure user group that is mapped to a Vibe.fyi user group.

This update will take effect within 30 minutes after which the user will not be able to log in to Vibe.

Integration Guide

Step 1: Azure User Groups

Read First

1. Members of the ‘Vibe-Admin’ group have full access to the admin console and portal, with full publishing permissions in the Vibe Portal. 
   
2. Members of the ‘Vibe-Publishers’ group will only have full publishing permissions in the Vibe Portal
   

1. By Roles (e.g., HR, H&S, L&D), where specific teams manage content relevant to their function.
2. By Locations, aligned with segmentation by country or site, which enables local publishing permissions. This way, onsite users can manage content relevant to their location, ensuring localised messaging across their channels. 
   

Add Groups

1. Open Developer Tools and navigate to Modules > Global Module Settings.
   
2. In the Login Form global module settings, tick the Enable Azure AD SSO login and Use Shared Azure AD App checkboxes.
   
3. In the Valid login email domains field, enter the email domain linked to each users work email (e.g.: @myonlinebusiness.com) then click [Add Domain]. Repeat if multiple email domains are required.
   
4. Optional - Upate the Login Button Text as needed
   
5. Click [OK] to save the global settings.

Step 3: Add Redirect URL

This step can be performed at any time before the setup process starts, if it is easier to set this redirect URL in advance.

1. Ask a Vibe developer to your admin console (using an admin-level Vibe user account).
   
2. Open Developer Tools > Modules > Global Module Settings in the menu.
3. In the global module settings, select Login Form.
4. Click the Add redirect URL to the Azure AD app button.
   

Step 4: Log in with your Microsoft account

Permissions are needed to grant admin content for the Vibe.fyi SSO app. Learn more on the Microsoft Learn website where it is stated that in order to grant tenant-wide admin consent, you need a Microsoft Entra user account with one of the following roles:

1. Privileged Role Administrator, for granting consent for apps requesting any permission, for any API.
   
2. Cloud Application Administrator or Application Administrator, for granting consent for apps requesting any permission for any API, except Microsoft Graph app roles (application permissions).
   
3. A custom directory role that includes the permission to grant permissions to applications, for the permissions required by the application.
   

1. Open your Vibe.fyi portal or admin console
   
2. Click [Log in with your Microsoft account] and login with a Microsoft account that has permission to access all Azure groups.
    
3. You may get a “Need admin approval” message at this point, if you see this message…
   
1. Ask an Azure administrator to log into portal.azure.com, go to Enterprise applications and find Vibe site’s customer SSO login
   
2. Open the Permissions pane, and click the Grant admin content for (your organisation name) button
   
3. Read the list of requested permissions and click the Accept button
   
4. Once this this admin consent has been granted, open your Vibe.fyi portal or admin console and click the [Log in with your Microsoft account] button again
4. When you see the "You do not belong to the required Azure groups to be able to log in" message, send the name of your primary Azure 'administrator' group to your Vibe.fyi support contact (or email support@vibe.fyi) and they will perform the initial Azure / Vibe.fyi group mapping.
   

When your Vibe.fyi support contact confirms that the initial grouping is complete, any user in the primary admin group can then login using their Microsoft account and proceed to step 4 below.

Step 5: Map Azure & Vibe.fyi user groups 

Follow these steps to set up new Vibe.fyi user groups:

1. Log into your Vibe.fyi admin console using your Microsoft account
   
2. Add new portal user groups and admin roles (groups) as required
   
3. While editing your group, use the Azure Group Mapping dropdown to locate and select the related Azure user group.
   
1. User Groups
   
   
2. Admin Roles