Native Entra sign-in on iOS; Sightwell Connectivity

The Sightwell app for iPhone and iPad can sign users in with Microsoft Entra directly, through Microsoft Authenticator or Microsoft's own sign-in sheet, instead of a browser page. This page is for the administrators of a Sightwell organisation.

How it works

The app gets an Entra ID token from Microsoft. Your Sightwell server's sign-in service exchanges it for a Sightwell session (OAuth 2.0 token exchange, RFC 8693). The app is a public client: there is no secret on the phone.
Users keep the same Sightwell identity as with browser sign-in, so existing devices and permissions carry over.
Microsoft does the sign-in, so your Entra multi-factor and conditional access policies apply.
If native sign-in isn't set up, or fails, the app offers the browser sign-in.

Requirements

Your Sightwell server uses its built-in sign-in service with a Microsoft Entra connector. You'll find it in the Sightwell dashboard under Settings › Identity Providers.
Access to the Entra app registration that connector uses (Application Administrator or a similar role).
Nothing else changes on the server. The connector already supports token exchange.

1. Add the iOS platform in Entra

In the Microsoft Entra admin centre, open App registrations and choose the app registration the Sightwell connector uses.
Open Authentication, then Add a platform › iOS / macOS.
Enter the bundle ID ai.sightwell.connectivity.ios. Entra creates the redirect URI msauth.ai.sightwell.connectivity.ios://auth.
Save. You don't need Allow public client flows.

Optional: add a conditional access policy for this app that requires a compliant device.

2. Turn it on in the server settings

Note three values:

Value	Where to find it
Directory (tenant) ID	Entra admin centre, the app registration's Overview
Application (client) ID	Same page
Connector ID	Sightwell dashboard, Settings › Identity Providers

If someone else operates your Sightwell server, send them these values. If you run the Helm chart yourself, set them in your values file and run helm upgrade:

nativeSignIn:
  entra:
    enabled: true
    tenantId: <directory (tenant) ID>
    clientId: <application (client) ID>
    connectorId: <connector ID>

3. Check

curl -s https://sightwell.your-company.com/.well-known/sightwell-signin.json

The response contains the three values. They are public identifiers, not secrets.

4. What users see

The next time a user signs in, the app opens Microsoft Authenticator or Microsoft's sign-in sheet instead of the browser page. If the file is missing, or native sign-in fails, the app offers the browser sign-in.

Turn it off

Set enabled: false (or ask your server operator to). The app returns to browser sign-in the next time users sign in.

Native Microsoft Entra sign‑in on iOS