Arcetec application portfolio — Identity with Microsoft Entra ID across 13 applications

The challenge

Several applications shared a single registration in Entra ID, and some stored Microsoft tokens in the browser. An internal audit identified the validations that needed to be strengthened.

The solution

A standard was defined for the 13 applications that sign in with Entra ID: one registration per application, server-side OpenID Connect with PKCE, state and nonce, certificates instead of secrets, httpOnly and SameSite=Strict cookies, no Microsoft tokens in the browser, renewal every 30 minutes, and a session of 7 days at most. Entra decides who gets in through an access role for each application, and each application decides what each person can do. CoworkOne, Planeo360, Campus360, and the AI agent in Teams already implement it.

Technologies used

• Microsoft Entra ID
• OpenID Connect
• PKCE
• Certificados
• MFA

Results

• 13 Applications with Entra ID
• 30 min Renewal with Microsoft
• 7 days Maximum session