Contents
What is this integration?
The Azure Active Directory integration (today Microsoft Entra ID) lets the club's staff sign in to Golfmanager's admin panel with their corporate Microsoft account, instead of using a username and password specific to Golfmanager.
This is what's known as single sign-on (SSO): the employee clicks a button, identifies themselves on the Microsoft screen and gets into Golfmanager without having to remember another password.
Azure AD / Microsoft Entra ID is Microsoft's system where companies manage their employees' accounts and access (the same one they use for Office 365, Teams, etc.). SSO means using that same account to sign in to other applications, like Golfmanager.
What problem does it solve?
A single identity for staff: they use their Microsoft account, with no separate passwords for Golfmanager.
Centralized access management: the IT department controls who can sign in, from Azure. If an employee leaves the company and their Microsoft account is disabled, they can no longer get into Golfmanager.
Permissions based on the Azure group: the profile (permission level) each employee receives in Golfmanager is assigned automatically according to their group in Azure.
More security: you benefit from Microsoft's policies (passwords, two-factor, etc.).
Which systems does it connect, and which way does the data flow?
It connects Golfmanager's admin-panel login with Microsoft (Azure AD):
The employee clicks "Sign in with Azure AD" and Golfmanager redirects them to the Microsoft screen.
Microsoft authenticates them and securely returns their identity (email address and group) to Golfmanager.
Golfmanager checks that the employee exists, assigns the corresponding profile and lets them in.
The identity travels from Microsoft to Golfmanager. Golfmanager relies on Microsoft to verify who the person is; passwords are always managed in Microsoft, not in Golfmanager.
What information is exchanged?
Information | Direction | Purpose |
Employee's email address | Azure AD → Golfmanager | Identify the user in Golfmanager |
The Azure group they belong to | Azure AD → Golfmanager | Assign the corresponding profile (permissions) |
🔒 Security: Golfmanager never receives or stores the employee's Microsoft password. It only receives their email and group once Microsoft has authenticated them, inside a secure token issued by Microsoft.
Prerequisites (before turning the integration on)
Have Azure AD / Microsoft Entra ID in your organization and permission to register an application in it.
Have the Azure AD module installed in your Golfmanager. If you don't, contact support.
Each employee must already exist as a user in Golfmanager, with the same email address they have in Microsoft. The integration does not create new users: it only lets in those who already exist.
Have the profiles (permissions) defined in Golfmanager and know which Azure group corresponds to each one.
Configure Azure to include the user's group in the information it sends (the groups claim), since Golfmanager uses it to assign the profile. Without this, employees won't be able to sign in.
System administrator permission in Golfmanager to configure the integration.
How to set it up (step by step)
Step 1 — Register the application in Azure
The IT team logs in to the Microsoft Entra / Azure portal.
They register a new application (App registration) for Golfmanager.
They set the Redirect URI to your Golfmanager address followed by
/azuread/callback(for example,https://yourclub.golfmanager.app/azuread/callback). It must match exactly.They generate a Client Secret and note down both its value and its identifier (Secret ID).
In the application's token configuration, they add the groups claim (security groups) so Microsoft sends the user's group.
From that registration you'll get four details: the Tenant ID (the organization's identifier), the Client ID (the application's identifier), the Client Secret (the secret key) and the Client Secret ID (that key's identifier).
Step 2 — Enter the details in Golfmanager
Log in to Golfmanager with system administrator permission.
Go to Settings > Azure AD.
Enter the Tenant ID.
Enter the Client ID.
Enter the Client Secret (stored encrypted) and the Client Secret ID.
Save your changes.
Step 3 — Link the Azure groups to the profiles
In Golfmanager, open each profile (the set of permissions for a role).
Fill in the Azure ID field with the identifier of the Azure group that should receive that profile.
Save your changes.
This way, when an employee signs in, Golfmanager looks at their Azure group and automatically assigns them the profile that has that same Azure ID.
⚠️ Very important: turning this integration on disables classic login. You can no longer sign in with a Golfmanager username and password, nor use the access email or the password reset: all staff access goes through Microsoft. Before turning it on, make sure the configuration is correct and that users and profiles are properly linked, so you don't lock yourself out of the system.
Each configuration field explained
Below, one by one, is every field involved in the integration: what it is, how it affects the system, how it behaves, and an example of use showing what happens when you use it.
Tenant ID
Field name: Tenant ID, in Settings > Azure AD.
Description: the identifier of your organization (tenant) in Microsoft Entra / Azure.
System impact: it tells Golfmanager which Microsoft organization to authenticate employees against. Without it, the integration isn't configured and no one can sign in.
System behavior: it's used to build the Microsoft address the employee is redirected to and from which the identity details are requested.
Example of use / what happens: you paste your organization's Tenant ID and save. From then on, the sign-in button takes the employee to your company's Microsoft screen.
Client ID
Field name: Client ID, in Settings > Azure AD.
Description: the identifier of the application IT registered in Azure for Golfmanager.
System impact: it identifies Golfmanager to Microsoft as the application authorized to request the sign-in. Without it, Microsoft doesn't recognize the request.
System behavior: it accompanies every sign-in request and the exchange of the code for the identity token.
Example of use / what happens: you paste the Client ID from the app registration and save. With it, Microsoft knows the request comes from your Golfmanager.
Client Secret
Field name: Client Secret, in Settings > Azure AD.
Description: the secret key (the application's password) generated in Azure.
System impact: it's what proves to Microsoft that the request is legitimate when redeeming the sign-in. If it's missing, wrong or expired, access fails.
System behavior: it's stored encrypted and used (decrypted on the fly) to complete the secure exchange with Microsoft after the employee authenticates.
Example of use / what happens: you paste the Client Secret value and save. Treat it like a password; remember that in Azure it expires, so you'll need to renew it when its date comes.
Client Secret ID
Field name: Client Secret ID, in Settings > Azure AD.
Description: the identifier of the secret key (the "Secret ID" Azure shows next to the Client Secret value).
System impact: it serves as a reference for which specific secret is being used. It helps identify and keep track of the secret (for example, to know which one to renew when it expires).
System behavior: it's stored as a configuration detail associated with the Client Secret.
Example of use / what happens: you paste the identifier (Secret ID) you see in Azure next to the secret and save. It's not the key itself, but its identifying label.
Azure ID (on each profile)
Field name: Azure ID, on each permission profile record.
Description: the identifier of the Azure group that should receive that permission profile.
System impact: it's what links an Azure group to a Golfmanager profile. It determines what permissions each employee gets based on their group.
System behavior: on sign-in, Golfmanager takes the group Microsoft sends and looks for the profile whose Azure ID matches; if it finds one, it assigns that profile to the employee. This assignment is re-checked on every sign-in.
Example of use / what happens: on the "Front desk" profile you put the Azure ID of the "Front desk" group in Azure. From then on, every employee in that group signs in with the Front desk profile. If no profile has the Azure ID of the employee's group, access is rejected.
How it works day to day
For staff, it's very simple to use:
On the Golfmanager sign-in screen, click the "Sign in with Azure AD" button.
The Microsoft screen opens. Enter your corporate account (and the two-factor code, if you have it enabled).
Microsoft sends you back to Golfmanager and you go straight into the admin panel, with the permissions that apply to you.
What happens / system behavior: Microsoft authenticates the employee and returns a token to Golfmanager with their email and their group. Golfmanager (1) finds the user by that email, (2) takes the group and looks for the profile with that Azure ID, (3) assigns that profile, and (4) opens the session in the panel. There's no Golfmanager-specific password to remember: it's always the Microsoft account.
Managing users and permissions
Give someone access: create them as a user in Golfmanager with their Microsoft email, and add them to the right Azure group. Their profile is assigned on its own based on that group.
Change someone's permissions: move them to a different group in Azure (or adjust which profile each Azure ID points to). The profile is updated on their next sign-in.
Remove access: disable the employee or take them out of the group in Azure. They'll no longer be able to sign in.
Limitations to keep in mind
It's for staff (the admin panel), not for the customers/players of the booking portal, who continue to sign in as usual.
It doesn't create users: the employee must already exist in Golfmanager with the same email as in Microsoft.
The employee must belong to an Azure group and that group must be linked to a profile via the Azure ID field. Otherwise, they can't sign in.
Only the first group is used: if an employee belongs to several Azure groups, Golfmanager takes one of them to assign the profile. It's best for each employee to have a single group relevant to Golfmanager.
Azure must send the group: the Azure application has to be configured to include the group in the token; otherwise sign-in fails with "Expected a group".
It disables classic access: with the integration on, the Golfmanager username/password, the access email and the password reset for staff don't work.
The Client Secret expires: Azure secrets have an expiry date; when it expires, no one can sign in until it's renewed.
A single organization (tenant): the integration is designed for a single Tenant ID.
It depends on Microsoft: if the Azure service is unavailable, no one can sign in during that time.
Frequently asked questions
Who is this integration for? Is it also for the booking portal's customers?
It's for the club's staff, who sign in to the admin panel. The customers/players of the online booking portal are not affected: they keep signing in as before, with their portal account.
Does the integration create new users automatically?
No. The integration only lets in employees who already exist in Golfmanager. Each employee must be set up as a user with the same email address they use in Microsoft. If they don't exist, access is rejected.
An employee can't sign in and sees "The user does not exist". What's happening?
It means the Microsoft email they signed in with doesn't match any Golfmanager user. Create that employee as a user in Golfmanager using exactly the same email they have in Microsoft, and try again.
Do I have to configure anything special for Azure to send the group?
Yes. By default, Azure doesn't always include the user's group in the information it sends. In the app registration, under token configuration, you have to add the groups (security groups) claim. Without this, every sign-in will fail with "Expected a group".
I see "Expected a group". How do I resolve it?
It means Microsoft authenticated the employee but didn't send any group. Check two things: (1) that the employee belongs to a group in Azure, and (2) that the Azure application is configured to include the group in the token (the groups claim). Once that's fixed, access will work.
I see "Group does not exist". What does it mean?
The employee arrives with an Azure group, but no Golfmanager profile has that group linked. Go to the relevant profile and put, in its Azure ID field, the identifier of that Azure group. From then on, employees in that group will sign in with that profile.
What happens if an employee belongs to several Azure groups?
Golfmanager uses only one of the groups to assign the profile. To avoid unexpected results, it's best for each employee to have a single group relevant to Golfmanager, or for all their relevant groups to point to the same profile.
How is it decided what permissions each employee has?
By their Azure group. Each Golfmanager profile has an Azure ID field with a group's identifier. When the employee signs in, Golfmanager looks at their group and assigns them the profile whose Azure ID matches. This way, permissions are managed from the Azure groups.
I moved an employee to a different group in Azure. When do their permissions update?
On their next sign-in. Every time the employee signs in, Golfmanager re-reads their group and reassigns the corresponding profile. If they already had a session open, the change will apply the next time they sign in.
Is it true that classic login gets disabled?
Yes. With the integration on, staff access with a Golfmanager username and password is disabled, as are the access email and the password reset. All access goes through Microsoft. That's why it's essential to set up users and profiles properly before turning it on, so you don't lock yourself out.
I try to reset the password or use the access email and I get "Disabled". Why?
Because with Azure AD on, those options are deliberately disabled: the password is managed by Microsoft, not Golfmanager. If you've lost access, you must recover it from your Microsoft account, not from Golfmanager.
I see "Not configured". What should I check?
A connection detail is missing. Go to Settings > Azure AD and check that the Tenant ID, the Client ID and the Client Secret are filled in. Complete whatever's missing and save.
I see "Unauthorized". What's usually the cause?
The most common cause is that the application credentials aren't valid or that the Client Secret has expired. Generate a new Client Secret in Azure, update it (along with its Secret ID) in Settings > Azure AD, and try again. It can also be because Microsoft returned an error during the authentication process.
Does the Client Secret expire? How do I renew it?
Yes, Azure secrets expire (usually after one or two years). When it expires, no one can sign in until it's renewed. To renew it: generate a new Client Secret in the Azure app registration, copy its value and its Secret ID, and update them in Settings > Azure AD. It's worth noting the expiry date and renewing it in advance.
Does Golfmanager receive or store the employee's Microsoft password?
No. The password is always entered on the Microsoft screen and never reaches Golfmanager. Golfmanager only receives, once the employee is authenticated, their email and their group, inside a secure token issued by Microsoft.
What Redirect URI should I set in Azure?
Your Golfmanager address followed by /azuread/callback (for example, https://yourclub.golfmanager.app/azuread/callback). It must match exactly the one registered in Azure; otherwise, Microsoft won't complete the redirect back.
What's the difference between the "Client Secret" and the "Client Secret ID"?
The Client Secret is the secret key itself (like a password), and it's stored encrypted. The Client Secret ID is its identifier (the label Azure shows next to the secret), and it serves to know which secret it is. You need both: the value to authenticate, and the identifier as a reference.
What permissions do I need in Golfmanager to configure the integration?
System administrator permission. It's the level needed to access Settings > Azure AD and enter the credentials.
What happens if the Microsoft/Azure service is unavailable?
While Azure is down, staff won't be able to sign in, since authentication depends on Microsoft. Once the service is restored, access works normally again.
When I sign out of Golfmanager, do I also sign out of Microsoft?
No. Signing out of Golfmanager only closes your local Golfmanager session; your Microsoft session stays active according to your organization's policies.
Does Microsoft's two-factor (MFA) work?
Yes. Since authentication is performed by Microsoft, all your organization's security policies apply, including two-factor if you have it enabled. It's one of the advantages of centralizing access in Azure.
Does it work for several organizations or Microsoft accounts at once?
The integration is designed for a single organization (one Tenant ID). If your setup has several Azure tenants, check with support to see how to approach it.
How do I set up a new employee so they can sign in?
Three steps: (1) create them as a user in Golfmanager with their Microsoft email; (2) add them to the Azure group for their role; and (3) make sure that group is linked to a profile via the Azure ID field. The next time they sign in, they'll come in with that profile's permissions.
How do I remove access for an employee who's leaving?
The most direct way is to disable them or take them out of the group in Azure: they'll immediately lose the ability to sign in to Golfmanager. Because it's managed from Microsoft, offboarding is centralized along with the company's other applications.
Can I go back to classic login later on?
Classic access is disabled while the integration is on. If you need to revert it (for example, disable the module), contact support to do it in a controlled way and without locking yourself out of the system.
Recommended best practices
Prepare users and profiles first: set up employees with their Microsoft email and link each Azure group to its profile before turning the integration on.
Configure the group claim in Azure (the groups claim) before you start, or no one will be able to sign in.
Verify access with a test account before rolling it out to the whole team, so you don't lock yourself out.
Give each employee a single relevant group for Golfmanager, so the profile they receive is unambiguous.
Keep track of the Client Secret's expiry: Azure secrets expire; note the date and renew it in time to avoid access outages.
Manage onboarding and offboarding from Azure: centralize control of who gets in through the Microsoft groups.