Famly supports OpenID Connect (OIDC) for user authentication, allowing integration with any OIDC provider. This guide focuses on setting up Microsoft Entra ID with Famly.

💡 Single Sign On (SSO) can be purchased as an add-on for all packages for £16 per month with a one-time £500 setup fee. Get in touch with your account manager or support@famly.co to enable SSO

After your first login with SSO, you will no longer be able to sign in using your password. This ensures your account remains secure, as there is no risk of a password breach once SSO is enabled.

Step 1: Register the App in Microsoft Entra

Create an app registration

In Microsoft Entra ID, go to App registrations
Click New registration
Enter a name (e.g. “Famly”) and click Register

Configure branding & authentication

Open the newly created App registration
Go to the Branding section and enter the home page URL:
- https://app.famly.co

💡 If you're using white labelling, add the white label domain as the home page URL instead

Set up authentication

Navigate to the Authentication section
Click Add a platform → Web
Enter https://app.famly.co as the Redirect URI
Tick the ID tokens box
Click Configure

Add an additional redirect URI

Click Add URI
Enter https://app.famly.co/app-trap

💡 If you are using white labeling, add the white label domain in addition to the two Famly URIs

Add API permissions

Famly needs a few permissions on the app registration so it can sign users in and read their basic details. Without these, SSO sign-in can fail even when everything else is set up correctly. To add them:

Open your app registration and go to API permissions
Click Add a permission and select Microsoft Graph
Choose Delegated permissions
Under OpenId permissions, tick email, openid and profile. You can also type each name into the search box to find it
Click Add permissions

You’ll now see email, openid and profile listed under Microsoft Graph, alongside User.Read, which is added by default. Leave User.Read as it is.

Grant admin consent

None of these permissions need an administrator’s approval by default. If you’d like to approve them once for your whole organisation, click Grant admin consent above the list of permissions and confirm. The Status column then shows a green tick. If you don’t, users are asked to approve the permissions themselves when they sign in.

Generate a client secret

Go to Certificates & secrets
Click New client secret
Copy and save the Value immediately, as it won’t be accessible later
Set a reminder to generate a new secret before the current one expires

💡 If your existing certification for the Famly SSO has expired, and you need to send your secret to Famly, ensure you send this over email to your account manager

Step 2: Collect Required Information for Famly

To enable the integration, collect the following details:

Client ID: Found in the Overview under "Application (client) ID"
Client Secret: Copied when generated
Endpoint/Base URI: Found under Endpoints → "Authority URL (Accounts in this organizational directory only)"

The endpoint will look something like this:
https://login.microsoftonline.com/c630ad49-3d5d-4692-9a48-74a5372c1b0b

Entering the details in Famly

Next, you'll need to enter the details in Famly. To do so, head to this link:

https://app.famly.co/#/account/openid/createProvider

You can use the dropdown menu to select the site or organisation you want to set up SSO for.

Choose a Title and enter the Client ID, Client Secret, and Base URI
Save the settings

Updating the client secret

To update an expired client secret:

Go to the same settings page in Famly
Enter the existing Client ID and Base URI
Add the new Client Secret
Save the changes

Troubleshooting

Are you getting a “Not authorised” error when saving settings?

The required “Manage single sign-on settings” permission may be missing

Is SSO sign-in failing even though the setup looks right?

Check that the email, openid and profile API permissions have been added and that admin consent has been granted

Setting up Microsoft Entra ID (SSO)