Skip to main content

SSL and DNS Configuration

Public URL​

Pick one hostname for the portal — e.g. https://cet.<msp>.com for an MSP instance serving many customers, or https://cet.<customer>.com for a customer-owned deployment. This exact URL must be registered as a redirect URI on App 1 (Portal) before anyone can sign in.

SSL certificate​

  • Model A: use an App Service managed certificate, or bind your own certificate to the custom domain.
  • Model B: terminate TLS at your ingress/reverse proxy (e.g. cert-manager with Let's Encrypt).

:::warning Two different certificates — don't confuse them The public TLS certificate for the portal hostname is completely separate from the Graph app-only certificate used by App 2 (Data) for Microsoft Graph authentication. They serve different purposes and are managed independently. :::

DNS​

Add a CNAME (or A record, depending on your host) pointing the portal hostname at your App Service or ingress. If visitors might also reach a www. variant, register that origin as an additional redirect URI on App 1 as well — Entra treats it as a distinct origin.

Reverse proxy considerations (Model B)​

  • Terminate TLS, then forward plain HTTP to Kestrel.
  • Forward WebSocket upgrade headers if you add any WebSocket-dependent features.
  • Do not attach a Content-Security-Policy at the proxy that blocks the SPA's own assets or Microsoft Entra's sign-in endpoints — this will silently break login with no obvious error beyond a blocked script/style in the browser console.

Continue to Tenant Onboarding.