retivo Docs
  1. Docs
  2. Tasks

Set up directory sign-in

Let people sign in with Microsoft Entra ID or Active Directory, and verify your email domains.

Before you begin

  • You must be an owner or admin of the company on dash.retivo.net.
  • For Entra ID: permission to register an app in your Entra ID tenant.
  • For Active Directory: at least one Retivo Node online that can reach a domain controller.

Open Directory sign-in on dash.retivo.net.

Verify your email domain

  1. Under Your email domains, press Add domain and enter it, for example example.com.

  2. Add the TXT record Retivo shows in your DNS:

    Name Type Value
    _retivo.example.com TXT retivo-verify=… (copy it from the page)

  3. Press Verify. DNS changes can take a few minutes.

  4. Once verified, choose how people with that domain sign in: Retivo password, Microsoft Entra ID or Active Directory.

Microsoft Entra ID

  1. In the Entra admin center: App registrations > New registration. Single tenant. Add a Web redirect URI and paste the one shown on the Retivo page:

    https://dash.retivo.net/auth/entra/callback

  2. Under Certificates & secrets, create a client secret and copy its value.

  3. In Retivo, fill in the Directory (tenant) ID, the Application (client) ID and the client secret.
  4. Optionally tick Create a Retivo user the first time someone from a verified domain signs in, and choose their role.
  5. Tick Microsoft sign-in is on and save.

People then enter their email on the sign-in page and are sent to Microsoft. Entra ID handles the password and MFA, so Retivo does not ask for an email code.

Caution

Keep at least one owner who signs in with a Retivo password. Retivo will not let you switch Microsoft sign-in off otherwise, so nobody is locked out.

Active Directory

  1. Fill in:
    • Domain controllers: one or more, comma separated.
    • Connection: LDAPS (636) is recommended; LDAP with StartTLS (389) also works.
    • Check the domain controller's certificate: keep it on unless you use a private CA the node does not trust.
    • Base DN, for example DC=corp,DC=example,DC=com.
    • Optionally a group whose members may sign in, a group whose members become Retivo admins, and a service account.
  2. Tick Active Directory sign-in is on and save.
  3. Press Test a sign-in and enter a real user's email (UPN) and password. Nothing is stored.

People sign in with their email (UPN) and AD password, then the email code. The password is checked by your node inside your network; your domain controllers are never exposed.

What's next

Last modified October 15, 2026