SSO Setup (Azure AD)
Enable single sign-on so your team signs in to LeadFuel with their corporate Microsoft credentials.
Before You Start
- A LeadFuel Enterprise plan
- Admin access in LeadFuel
- Someone who can add a DNS TXT record for your email domain
- A Microsoft Entra administrator who can approve LeadFuel for your organization
Open Security Settings
Go to Settings → Security in your LeadFuel dashboard. This page is only visible on the Enterprise plan.
You do not create an app registration in Azure. LeadFuel is a pre-registered Microsoft application; your organization only needs to verify its email domain, provide its tenant ID, and approve LeadFuel once.
If you don't see the Security tab, your account may be on a different plan. Check Settings → Billing to confirm you're on Enterprise.
Configure and Verify Your Email Domain
In the Allowed Email Domain field, enter your organization's email domain — for example, acme.com — and click Save Settings.
The page then shows a DNS TXT record (name _leadfuel-sso.acme.com, value starting leadfuel-sso-verify=). Add it at your DNS host, then click Verify domain. DNS changes can take a few minutes to propagate.
This proves the domain is yours so no other LeadFuel customer can route your sign-ins to their account. Until it's verified, the Enable SSO toggle stays disabled.
Use your primary corporate email domain. If your company uses multiple domains, contact support and we can help configure additional domains.
Enter Your Microsoft Tenant ID
In the [Microsoft Entra admin center](https://entra.microsoft.com), open Overview and copy the Tenant ID — a GUID like 2f1a7c9e-4b3d-4e8a-9c21-0f6d5e8b7a10.
Paste it into Microsoft Entra Tenant ID in LeadFuel and click Save Settings. LeadFuel uses it to make sure every SSO sign-in comes from your tenant, not just from any Microsoft account with a matching email domain.
Use the GUID form only. The `yourcompany.onmicrosoft.com` form will not work.
Enable SSO
Toggle Enable SSO to on and click Save Settings. This activates single sign-on for users with your verified email domain.
Leave Enforce SSO (disable password login) off until you have tested. When enforced: - Users can only sign in via their Microsoft corporate account. This works on the web dashboard and in the iPhone app, which hands sign-in to Microsoft the same way the web does. The macOS desktop app still uses a password or a Transcription Key, so check who relies on it before you enforce - The admin who configured SSO retains password access as an emergency backdoor - SSO-only users who need a password can use the Forgot password flow while enforcement is off
Approve LeadFuel in Microsoft and Test
Have a Microsoft administrator open a private/incognito browser window, go to the LeadFuel sign-in page, enter their work email, and click Sign in with Azure AD.
Microsoft shows a consent screen listing what LeadFuel requests (sign in, read name and email). Tick Consent on behalf of your organization and click Accept. That one-time approval covers everyone in your organization.
Alternatively, after any user's first attempt, LeadFuel appears under Entra admin center → Enterprise applications; open it, go to Permissions, and click Grant admin consent.
Test without enforcing SSO first. Once you've confirmed sign-in works for a few team members, you can enable enforcement.