KeyvaciIntegration · Microsoft Entra ID
The team vault that opens
with your Microsoft identity
If your organisation runs Microsoft 365 or Entra ID (formerly Azure AD), every member already has their Keyvaci sign-in. No new passwords to distribute, no user lists to upload, no directory changes to review.
What the integration does
Directory-verified from the very first click
Authority, recorded
Whoever creates your organisation confirms on the record that it authorised them to, and Keyvaci reads Microsoft’s signed token to record whether they held Global Administrator or Privileged Role Administrator. Prove your domain over DNS and nobody else can create a second organisation in your company’s name.
Standards, not agents
OpenID Connect with PKCE, multi-tenant, tokens verified against Microsoft's published keys on every request. Nothing to install in your tenant, nothing running inside your network.
Lifecycle that follows Entra
Members sign in with their work account. Suspend or remove them in Entra ID and Keyvaci access goes with it; revoking their vault access additionally re-encrypts the vaults they could open.
SSO without weakening encryption
Entra ID answers who you are. What you can decrypt still comes only from your master password, derived on your device. The two systems are separated by design, so adding SSO never dents the zero-knowledge property.
Your MFA policy rides along
Conditional Access, MFA, device compliance: whatever your directory enforces at sign-in applies to Keyvaci automatically, because sign-in is your directory.
Five-minute setup
Sign in, confirm your authority, save the recovery kit your browser generates, invite the team. Most organisations store their first shared credential inside the first coffee.
Setup, in full
Three steps, no ticket to IT
Sign in with Microsoft
Whoever will administer the vault clicks "Start with Microsoft" and consents to the Keyvaci application, exactly like any Microsoft 365 app. Optional tenant-wide admin consent removes the per-user prompt.
Create the organisation
They confirm they are authorised to act for your organisation, then your browser generates its signing and recovery keys locally, shows them once, and never sends them to us. Verifying your domain afterwards reserves the name.
Invite by email
Members sign in with their existing Microsoft account and are recognised automatically. Each sets a master password, gets countersigned by an admin, and starts receiving vaults.
Entra ID questions
Asked by every IT admin so far
Does this require changes to our Entra ID tenant?
No. Keyvaci is a standard multi-tenant OIDC application. Users consent at first sign-in like with any Microsoft 365 app; a tenant admin can optionally grant consent for everyone at once. Nothing is written to your directory.
Who can create our organisation?
Anyone signing in with a work account from your tenant, on one condition: they confirm on the record that your organisation authorised them, and that confirmation is stored with their name and verified identity. Keyvaci also records, from Microsoft’s signed token, whether they held Global Administrator or Privileged Role Administrator, so your audit trail says which. What reserves your company’s name is domain verification: publish the TXT record we issue in your DNS, and nobody else can create a second organisation for that domain.
Does SSO weaken the zero-knowledge encryption?
No, because sign-in and decryption are separate systems. Entra ID proves who you are. Decryption keys are derived from your master password, on your device, and neither the password nor the keys are ever transmitted. Full detail on the security page.
What about members who are not in our tenant?
Guest scenarios and email-based members are supported through email sign-up with mandatory verification, with the same encryption and the same countersignature step before they can receive any vault. Partners running Google Workspace can sign in with their own directory instead.
Your tenant is the hard part. It's done.
Everything else takes minutes. 14 days, every feature, no card.