livewells
Menu

Set up sign-in with Microsoft Entra

livewells signs people in with Microsoft Entra ID. Your Entra administrator gives consent once. After that, your people sign in with their work accounts.

How sign-in works

  1. Open https://app.livewells.io/signin.
  2. Enter your work email and choose Continue.
  3. Sign in with your work account at Microsoft.
  • livewells sends you to Microsoft to sign in.
  • Your Entra organisation picks your livewells organisation. The email address only routes you to the right sign-in.
  • A sign-in at Microsoft must finish within 3 minutes. After that, livewells shows "Sign-in did not complete" and you choose Try again.
  • Sign-in follows your organisation's own Entra policy, including multi-factor sign-in.
  • Microsoft decides which Conditional Access policies apply to the sign-in. You choose them in Entra.
  • A sign-in lasts up to 8 hours and ends after 2 hours without use.
  1. Your Entra administrator opens https://app.livewells.io/auth/consent.
  2. Microsoft shows the consent page. The administrator approves.
  3. A thank-you page shows your organisation id.

livewells asks for the sign-in permissions openid, profile and email. If consent stops at Microsoft, livewells shows "Consent was not given" and changes nothing.

If your policy does not allow a shared app, ask us about a single-tenant app registration in your own Entra tenant.

App roles

livewells reads the app roles in the Microsoft token. The roles are livewells.member, livewells.admin and livewells.reader.

  • livewells.member makes a person an analyst.
  • livewells.admin lets a person in as an analyst. People in Settings decides who administers.
  • livewells.reader alone makes a person read-only; with livewells.member or livewells.admin as well, the person is an analyst when your organisation requires an app role to sign in, and read-only otherwise.
  • When a person holds no livewells role, the person is an analyst, or sees "No livewells role" when your organisation requires an app role.
  • livewells records the role at each sign-in and at each silent re-check, which runs every 10 minutes.

We recommend that you turn on "Assignment required" on the livewells enterprise application in Entra and assign your analysts, administrators and read-only people to it.

Sign-in rules

An administrator sets how people sign in in the Sign-in rules section of Settings. See Administering livewells for the rules Roles come from Entra, Multi-factor sign-in and Sign-in length.

Sign-in pages and their next steps

PageCauseNext step
Your organisation is not set up for livewells yetNo livewells organisation holds the Microsoft organisation of the person.Choose Subscribe, or send the organisation id on the page to support@livewells.io.
No livewells roleYour organisation requires an app role and the account holds none.Ask your administrator to assign livewells.member on the livewells enterprise application, then sign in again.
Multi-factor sign-in requiredYour organisation requires multi-factor sign-in.Sign in with a method that uses more than one factor.
Access removedAn administrator removed the person.Ask an administrator of your organisation.
Sign-in did not completeThe sign-in ended before it finished.Choose Try again. Write to support@livewells.io when the page comes back.

The audit log records the refusals with the codes no-app-role and mfa-required.