> ## Documentation Index
> Fetch the complete documentation index at: https://docs.spurtest.com/llms.txt
> Use this file to discover all available pages before exploring further.

> ## Agent Instructions
> Spur is an AI-powered QA engineer that lets teams create and run automated end-to-end tests for web and mobile apps using natural language.
> When answering questions about Spur, cite the relevant page from docs.spurtest.com.

# Azure SSO

## Overview

Spur uses Supabase Auth as its authentication provider, which enables secure OAuth 2.0-based SSO. Users can sign in to Spur using their existing identity provider credentials — no separate Spur password required.

## How SSO Works in Spur

Spur's SSO uses the OAuth 2.0 / OpenID Connect (OIDC) protocol — the modern industry standard for federated authentication. Here's the flow when a user signs in:

<Steps>
  <Step title="Initiate sign-in">
    The user clicks **Sign in with Microsoft** on the Spur login page.
  </Step>

  <Step title="Redirect to Microsoft">
    Spur redirects to Microsoft's authentication endpoint.
  </Step>

  <Step title="Authenticate">
    The user authenticates with their Microsoft credentials (and MFA, if configured by your organization).
  </Step>

  <Step title="Token exchange">
    Microsoft returns a secure token to Spur confirming the user's identity.
  </Step>

  <Step title="Session created">
    Spur creates or resumes the user's session. No Spur-specific password is ever set or stored.
  </Step>
</Steps>

## What Spur Supports

| Item                  | Details                                                                                                 |
| --------------------- | ------------------------------------------------------------------------------------------------------- |
| **Protocol**          | OAuth 2.0 / OpenID Connect (OIDC)                                                                       |
| **Identity Provider** | Microsoft Azure Entra ID (and Google)                                                                   |
| **Tenant type**       | Multi-tenant — any Azure Entra organization can connect without per-tenant configuration on Spur's side |
| **Account types**     | Organizational accounts (work/school). Personal Microsoft accounts are not in scope.                    |
| **User provisioning** | Just-in-time — a Spur account is automatically created on first successful SSO login                    |
| **MFA enforcement**   | Honored — if your Azure tenant requires MFA, it will be enforced before Spur grants access              |
| **Scopes requested**  | `openid`, `email`, `profile` (read-only identity data only)                                             |

## Current Limitations

The following are not supported at this time. If any of these are requirements for your organization, please reach out to discuss your use case.

* **SAML 2.0** — Spur uses OAuth 2.0/OIDC only, not SAML.
* **Per-tenant app registration** — Spur uses a single multi-tenant Azure app registration rather than a dedicated registration per customer.

## What Your Organization Needs to Do

For most organizations, no setup is required. Users can sign in with their Microsoft account immediately once Spur enables the provider.

### If Your Tenant Restricts Third-Party App Access

Some organizations configure Azure Entra to require admin approval before users can sign into third-party applications. If this applies to your tenant, an Azure admin will need to:

<Steps>
  <Step title="Open Enterprise Applications">
    Navigate to **Azure Portal** → **Microsoft Entra ID** → **Enterprise Applications**.
  </Step>

  <Step title="Find Spur">
    Locate the Spur application. It will appear after the first sign-in attempt, or can be added proactively.
  </Step>

  <Step title="Grant admin consent">
    Grant admin consent for the scopes Spur requests: `openid`, `email`, and `profile`.
  </Step>
</Steps>

<Tip>
  This is a one-time action that unblocks all users in your organization without each person needing to consent individually.
</Tip>

### Restricting Access to Specific Users or Groups

If you want to limit which employees in your organization can access Spur via SSO, an Azure admin can:

1. In the Spur enterprise application in Entra, enable **User assignment required**.
2. Assign specific users or Azure groups who are permitted to sign in.

<Warning>
  Without this configuration, any user in your organization's Azure tenant can sign into Spur.
</Warning>

## Data & Security

Spur requests the minimum necessary permissions to authenticate your users. Spur does not request access to email content, calendar, files, or any other Microsoft 365 data.

<Card title="Scopes Spur Requests from Microsoft" icon="lock">
  * **openid** — Required to use OpenID Connect for authentication
  * **email** — The user's email address, used as their Spur account identifier
  * **profile** — Basic profile info (name), used to populate the user's Spur profile
</Card>

## Questions?

If you have questions about SSO configuration, compliance requirements, or want to discuss your organization's specific setup, please contact your Spur account representative.

<Card icon="headset" title="Contact Us" href="/additional-resources/contact-us">
  Reach out to the Spur team for SSO support.
</Card>