Microsoft Entra sign-in

With Microsoft Entra sign-in, users sign in to ManicTime Server with their Microsoft work account. To set it up, you register ManicTime Server as an app in Entra, then copy the app's details to ManicTime Server.

Requirements

  • ManicTime Server v2026.3 or newer
  • The new sign-in system. If Administration -> User management -> Sign-in methods shows New sign-in system available, switch to the new system first.

Register ManicTime Server in Entra

  1. Open the Microsoft Entra admin center, go to App registrations and click New registration.
  2. Enter a name, for example ManicTime Server.
  3. Under Supported account types, select Single tenant only.
  4. Under Redirect URI, select Web and paste the redirect URI from ManicTime Server. You will find it in Administration -> User management -> Sign-in methods, when you click Configure next to Entra.
  5. Click Register.

Give the app permission to read users

  1. In the app, go to API permissions and click Add a permission.
  2. Click Microsoft Graph, then Application permissions, and add User.Read.All.
  3. Click Grant admin consent.

ManicTime Server uses this permission to read user names and email addresses, and to see when an account is disabled.

Create a client secret

  1. Go to Certificates & secrets and click New client secret.
  2. Enter a description, for example ManicTime Server, choose when the secret expires and click Add.
  3. Copy the secret's Value. Entra shows it only once.

Client secrets expire. Before yours expires, create a new one and enter it in ManicTime Server.

Configure Entra in ManicTime Server

Go to Administration -> User management -> Sign-in methods and click Configure next to Entra. Fill in the fields:

  • Tenant ID - the Directory (tenant) ID from the app's Overview page
  • Client ID - the Application (client) ID from the app's Overview page
  • Client secret - the value you copied
  • Native client ID - leave it empty, or see the next section

Click Test to check the values, then click Save. Finally, enable the Entra sign-in method.

Optional: sign in without a browser on Windows

By default, the Windows client opens a browser for Entra sign-in. If you register a second app, ManicTime for Windows can sign users in automatically with the work account they use on their computer.

  1. In App registrations, click New registration.
  2. Enter a name, for example ManicTime Desktop, select Single tenant only and click Register.
  3. Copy the Application (client) ID from the Overview page.
  4. Go to Authentication, click Add Redirect URI and select Mobile and desktop applications.
  5. Leave the checkboxes empty. In the box below them, enter ms-appx-web://Microsoft.AAD.BrokerPlugin/<client ID>, with the ID you copied in place of <client ID>. Then save.
  6. Go to API permissions and click Grant admin consent. ManicTime for Windows signs users in without asking them anything, so users cannot give this consent themselves.
  7. In ManicTime Server, go to Administration -> User management -> Sign-in methods and click Configure next to Entra. Enter the same ID in Native client ID and click Save.