Integrations & SSO - Help · ProPera Online

Help Centre Getting Started How to Use Integrations & SSO Configuration Threat Intelligence Compliance Patch Applications Administration Videos FAQs 🤖 AI Tour

🔵 Sign in with Microsoft (Entra ID SSO)

ProPera uses the OAuth 2.0 authorization code + PKCE flow. The login page shows the Sign in with Microsoft button when the platform-level Entra app is configured.

In the Azure portal (Entra ID → App registrations → New registration):

Give the app a name (e.g. ProPera SSO).
Redirect URI → type Web → https://propera.online/auth/entra/callback.
Create, then copy the Application (client) ID and Directory (tenant) ID.
In Authentication → enable Allow public client flows: Yes (required for the PKCE flow).
In API permissions → ensure User.Read (delegated) for Microsoft Graph.

Platform configuration (.env):

ENTRA_SSO_ENABLED=1
AZURE_TENANT_ID=<your tenant id>
AZURE_CLIENT_ID=<your client id>
# SSO authority for interactive sign-in (multi-tenant SaaS: allow any
# work/school account). Omit to restrict sign-in to your tenant only.
ENTRA_SSO_AUTHORITY=https://login.microsoftonline.com/organizations
# optional:
# AUTH_REDIRECT_URI=https://propera.online/auth/entra/callback
# ENTRA_SSO_ALLOWED_DOMAINS=yourcompany.com
# ENTRA_SSO_REQUIRE_MFA=1

🔑 Endpoints used by the sign-in flow:
Authority: https://login.microsoftonline.com/organizations (or ENTRA_SSO_AUTHORITY)
Authorization: {authority}/oauth2/v2.0/authorize
Token exchange: {authority}/oauth2/v2.0/token - called with POST by the backend.
Note: AZURE_TENANT_ID also drives the MDE/Sentinel/Graph connectors (client credentials), so it keeps the real tenant GUID even when the sign-in authority is organizations.

💡 Per-tenant SSO: each customer can use their own Entra app registration instead. The workspace administrator configures it under Settings → SSO (sso_enabled, sso_tenant_id, sso_client_id, sso_client_secret). The redirect URI is the same .../auth/entra/callback. Sign-in links pass ?tenant=<workspace-slug>.

🟢 Sign in with Google

Also OAuth 2.0 + PKCE. The Sign in with Google button appears on the login and signup pages when configured.

In Google Cloud Console → APIs & Services → Credentials → Create Credentials → OAuth client ID:

Application type: Web application.
Authorized redirect URI: https://propera.online/auth/google/callback.
Copy the Client ID and Client Secret.

Platform configuration (.env):

GOOGLE_SSO_ENABLED=1
GOOGLE_CLIENT_ID=xxx.apps.googleusercontent.com
GOOGLE_CLIENT_SECRET=xxx
# optional:
# GOOGLE_REDIRECT_URI=https://propera.online/auth/google/callback
# GOOGLE_SSO_ALLOWED_DOMAINS=yourcompany.com

⚠️ The redirect URI must match exactly what you register in Google (Google rejects mismatches). Production requires HTTPS. After changing credentials, restart the server.

🛡️ Microsoft security stack

Integration	What it powers	Configured via
Defender for Endpoint	Devices, alerts, incidents, vulnerabilities, response actions (isolate, scan, block).	Tenant settings: tenant/client ID + secret (or certificate / managed identity)
Defender XDR / Graph	Unified alert & incident correlation, user/device context.	`GRAPH_API_URL` + tenant credentials
Microsoft Sentinel	Incident sync both ways, analytics rules, hunting.	Subscription ID, resource group, workspace ID
Microsoft Intune	Device compliance and policy context.	Graph permissions via tenant credentials
Microsoft Purview	Compliance posture and audit signals.	Graph permissions via tenant credentials
Microsoft Teams	Notifications and approval messages.	Incoming webhook URL (Settings)
Secure Score	Score tracking + Secure Now remediation.	Graph permissions via tenant credentials

Backend access to Defender / XDR / Sentinel uses the least-privilege service principal (client credentials) model via the AZURE_* environment variables - separate from the interactive person SSO sign-in above. All secrets are encrypted at rest and every change is audit-logged.

🔗 Third-party extensions

Service	Purpose	Credential
VirusTotal	File/hash enrichment	API key
AbuseIPDB	IP reputation	API key
OTX (AlienVault)	Open threat exchange	API key
Slack	Notifications	Incoming webhook
ServiceNow / Jira / PagerDuty	Ticketing & on-call	API credentials / webhook

Third-party services are clearly labelled as such in the platform and are optional extensions - the Microsoft stack is the primary security engine. Configure everything from the Configuration Centre, then use Test Connection on each.

🔑 REST API & API tokens

Every module is available over REST with OpenAPI documentation. Programmatic clients authenticate with a Bearer token generated from your profile page (My profile → API token). Same-origin UI calls use your session cookie; RBAC is enforced identically for both.

curl -H "Authorization: Bearer <token>" https://propera.online/api/health
curl -H "Authorization: Bearer <token>" https://propera.online/api/incidents

Demo site

Prefer to explore first? The Demo site (demo.propera.online) runs the full product with realistic sample data and no Microsoft tenant required - perfect for evaluating the platform before connecting your environment.