Microsoft sign-in lets your group's administrators and contributors sign in to the Kitchen back-office with their Microsoft work account, with no Kitchen password to manage. This article is for the IT team that administers your Microsoft Entra ID directory, and for your group's Kitchen administrator.
Kitchen's interface is in French: labels are quoted as they appear on screen, with an English translation where it helps. To create and remove accounts automatically from Microsoft Entra, then set up automatic provisioning (SCIM), described in a separate article. It is set up in a second, non-gallery application: Microsoft Entra does not enable provisioning on the "Kitchen" application, which uses OpenID Connect.
Protocol: OpenID Connect over OAuth 2.0, authorization code flow with PKCE, Microsoft identity platform v2.0 endpoint.
Identity provider: Microsoft Entra ID. Work and school accounts only: personal Microsoft accounts are refused.
Application: "Kitchen", a multi-tenant application published by Kitchen, publisher verified by Microsoft. You create no app registration: the Kitchen enterprise application appears in your directory at the first consent.
Scope: the Kitchen back-office (Administrateur and Contributeur roles). Employees keep signing in to the Kitchen mobile app by SMS: Microsoft sign-in does not apply to them.
Sign-in start: from the back-office sign-in page, button Se connecter avec Microsoft (Sign in with Microsoft).
Account creation at first sign-in: a person from your directory with no account in the group gets an active account with the Contributeur role at their first sign-in. A Kitchen administrator can then change their role.
Exclusive sign-in: once the directory is connected, back-office access for that group goes through Microsoft only. A directory is connected to one Kitchen group, and a group to one directory.
Identification: Kitchen identifies each person by their Microsoft directory and immutable account identifiers, never by email address alone.
Not supported: SAML, and assigning Kitchen roles from Entra groups.
Roles allowed to connect Microsoft:
Administrateur (Kitchen administrator)
Contributors do not see the Connexion Microsoft tab.
On the Microsoft side, the person who connects the directory must hold one of these Microsoft Entra ID built-in roles, the ones allowed to grant tenant-wide admin consent: Global Administrator, Privileged Role Administrator, Cloud Application Administrator, Application Administrator or AI Administrator. The same person must also be an Administrateur in Kitchen.
Licensing. Microsoft sign-in is a paid option of the Kitchen subscription, enabled by the Kitchen team for your group. It is not available during the free trial. If the card shows Option payante (paid option), click Contacter Kitchen (contact Kitchen) to enable it. On the Microsoft side, Microsoft Entra ID is used according to Microsoft's licensing terms.
Kitchen requests delegated permissions only, granted by an administrator for the whole organization. No application permission is requested.
openid: sign the person in with OpenID Connect.
profile: read their first and last name to create their Kitchen profile.
email: read their email address, which identifies their Kitchen account. A Microsoft account without an email address cannot sign in.
User.Read (Microsoft Graph): read the signed-in person's profile. When the directory is connected, Kitchen uses it once to read your organization's name and verified domains, shown in the Connexion Microsoft tab.
Kitchen never reads mailboxes, files or other users of your directory.
The ID token also carries the optional claims email and xms_edov, and the person's directory roles (wids). Kitchen reads those roles only to check that the person connecting the directory is one of its administrators.
Step 1: Sign in to the Kitchen back-office with an Administrateur account, then go to Paramètres (Settings) → Connexion Microsoft. The Connexion avec Microsoft card must show the Option activée (option enabled) badge.
Step 2: In the "Domaine de votre annuaire Microsoft" field (your Microsoft directory domain), type a verified domain of your directory, for example "your-company.com", then click Connecter Microsoft (connect Microsoft).
Step 3: Microsoft opens. Sign in with an account of that directory holding one of the roles listed in the prerequisites, review the requested permissions, tick Consent on behalf of your organization, then click Accept. Finish within 10 minutes of your Microsoft sign-in.
Step 4: You return to the tab, which shows "Votre annuaire Microsoft est connecté." (your Microsoft directory is connected) with the Connecté badge, the Annuaire Microsoft (directory), the Identifiant d’annuaire (directory ID) and the date under Connecté le. Kitchen signs you in again with your Microsoft account.
By default, anyone in your directory can sign in to Kitchen and get a Contributeur account. To limit access to authorized people:
Step 1: In the Microsoft Entra admin center, open Enterprise applications → Kitchen → Properties, set Assignment required? to Yes, then click Save.
Step 2: In Users and groups, click Add user/group and assign the users or groups allowed to use the Kitchen back-office.
Step 1: On the back-office sign-in page (admin.kitchen-app.io), click Se connecter avec Microsoft, then sign in with your Microsoft work account.
Step 1: Assign one or two pilot users to the Kitchen application in Microsoft Entra.
Step 2: Ask each of them to sign in to the back-office with Se connecter avec Microsoft, preferably in a private browsing window.
Step 3: In Paramètres → Utilisateurs, check that they appear with the Contributeur role, and change their role if needed.
Step 4: Check that a person not assigned to the application is refused by Microsoft, then assign the other users or groups.
Remove access: remove the person's assignment in Microsoft Entra, then revoke their access in Paramètres → Utilisateurs. With automatic provisioning (SCIM), removal happens automatically from Entra.
Invite users: in a group connected to Microsoft, people arrive through their first Microsoft sign-in or through automatic provisioning. Paramètres → Utilisateurs offers neither invitations nor password resets.
Disconnect Microsoft: in the tab, click Déconnecter Microsoft, then Déconnecter. Nobody signs in with Microsoft any more: each user chooses a password with Mot de passe oublié ? (forgot password) on the sign-in page.
"Votre annuaire Microsoft n’est relié à aucun groupe Kitchen. Demandez à un administrateur Kitchen de votre groupe de le connecter, ou connectez-vous avec votre e-mail et votre mot de passe." The account's directory is not connected to any group: follow part 1.
"Kitchen n’est pas encore approuvé dans votre organisation Microsoft. Demandez à votre service informatique d’approuver l’application Kitchen, puis réessayez." Admin consent has not been granted (Microsoft codes AADSTS65001, AADSTS65004 or AADSTS90094).
"Connexion avec Microsoft annulée." The person cancelled or declined the sign-in at Microsoft.
"Votre compte Microsoft n’a pas d’adresse e-mail. Demandez à votre service informatique d’en ajouter une, puis réessayez." Add the account's email address in Microsoft Entra.
"Ce compte Microsoft est déjà lié à un autre compte Kitchen." The Microsoft account is already attached to another Kitchen account. Contact support.
"Connexion avec Microsoft refusée. Si votre compte Kitchen utilise un mot de passe, connectez-vous avec votre e-mail et votre mot de passe." Kitchen refused the sign-in: a password account not linked yet (see part 3), a Microsoft account from another directory, or an email address different from the provisioned account's.
"La connexion avec Microsoft a échoué. Réessayez." Unexpected error: try again, then contact support.
If Microsoft says the user is not assigned to the application (code AADSTS50105), assign them to the Kitchen application in Users and groups.
"Microsoft ne connaît aucun annuaire pour ce domaine." No Microsoft directory for this domain: type a verified domain of your directory.
"Ce domaine est celui des comptes Microsoft personnels. Saisissez le domaine de votre entreprise." The domain is the personal Microsoft accounts' one.
"Cet annuaire Microsoft est déjà connecté à un autre groupe." The directory is already connected to another group.
"Un annuaire Microsoft est déjà connecté à ce groupe." A directory is already connected to this group.
"L’option Connexion Microsoft n’est pas activée pour votre groupe." The paid option is not enabled: contact Kitchen.
"Microsoft ne répond pas pour le moment. Réessayez dans un instant." Microsoft is not responding: try again shortly.
"Seul un administrateur du groupe peut connecter Microsoft." Only a Kitchen administrator of the group can connect Microsoft.
"Microsoft n’a pas pu être lié. Connectez-vous avec un compte Microsoft de l’annuaire indiqué, puis réessayez." Sign in with an account of the directory whose domain you typed.
"La connexion à Microsoft a été annulée." The Microsoft step was cancelled.
"Le délai pour vous connecter à Microsoft est dépassé. Recommencez." The Microsoft step took too long: start again.
"Votre compte Microsoft n’est pas administrateur de l’annuaire. Seul un administrateur Microsoft peut connecter le groupe : invitez-le comme administrateur dans Utilisateurs pour qu’il termine la connexion." The Microsoft account holds none of the required directory roles.
"Votre connexion à Microsoft date de plus de 10 minutes. Recommencez." The Microsoft sign-in is more than 10 minutes old: start again.
"Une erreur est survenue. Réessayez." Unexpected error: try again, then contact support.
If the page shows Accord non donné (consent not given): "Microsoft n’a pas enregistré l’accord. Vérifiez que vous êtes administrateur de votre annuaire, puis rouvrez le lien." Check that you are an administrator of your directory, then open the link again.
Email [email protected], or click Aide et support (help and support) in the back-office to chat with the Kitchen team. Include your directory domain, the time of the attempt and the message shown.
