Brisbane Transport Museum

QOCS - Brisbane Transport Museum

Operational data for admissions, cash, stock, and daily Square reporting.

Microsoft 365 single sign-on

Prepare Microsoft Entra ID authentication for museum PCs and club Microsoft 365 accounts. Sign-in enforcement stays off until the enable box is deliberately ticked and saved. Assign your Admin Settings access on the Permissions page before enabling sign-in.

Admin Permissions SharePoint setup

Entra ID sign-in

Windows and proxy SSO

Leave trusted headers off unless the web server or reverse proxy strips incoming spoofed headers and supplies the authenticated Windows or Microsoft account itself.

Back to admin

Auth environment

Auth-specific variables take priority. Tenant, client ID, and secret can fall back to the existing Graph values.

  • MS_AUTH_ENABLED: missing
  • MS_AUTH_TENANT_ID: missing
  • MS_AUTH_CLIENT_ID: missing
  • MS_AUTH_CLIENT_SECRET: missing
  • MS_AUTH_REDIRECT_URI: set
  • MS_AUTH_AUTO_SSO: set
  • MS_AUTH_TRUSTED_HEADER_ENABLED: missing

Microsoft app registration setup

1. Web platform

Add a web redirect URI that exactly matches https://www.sdap.qocs.org.au/auth/callback.

2. Client secret

Create a secret for the web app. Store it as MS_AUTH_CLIENT_SECRET when possible.

3. Token settings

The app uses OpenID Connect scopes openid, profile, and email, then validates the ID token signature.

4. Windows PCs

Silent SSO lets Microsoft reuse an existing browser or Windows Microsoft 365 session. Trusted headers are only for server-managed Windows authentication.

5. Permissions

Assign QOCS.AdminSettings, QOCS.FullAccess, or QOCS.ReportingAccess in Entra, or use exact-user assignments in the Permissions page.