Signing In with Microsoft at Work

When you click Sign in with Microsoft with a work or school account, Microsoft checks whether your organization lets you approve a new app yourself. Usually it asks you once and you’re in. In some organizations it sends a request to your IT administrators instead, and your sign-in waits until they approve it.

This page is about Pia Cloud. If your organization runs its own Pia server, the Microsoft app belongs to that server. Its administrator sets it up as described in Microsoft Entra ID OAuth.

What you normally see

The first time you sign in, Microsoft shows a Permissions requested dialog:

1. The app is Pia Public Cloud, published by neo42 GmbH with a blue verified badge.
2. It lists two permissions: Sign you in and read your profile and Maintain access to data you have given it access to.
3. Click Accept. The browser hands you back to Pia, and you’re signed in.

Pia asks only to sign you in and read your basic profile. It asks for no permission that needs an administrator.

If you are an administrator, the dialog also shows Consent on behalf of your organization. Tick it and you approve Pia for everyone in your organization, so your colleagues aren’t asked.

Note

Organizations that approved Pia before the app was renamed may still list it under its earlier name, neo42 Pia Auth. It is the same app.

When sign-in ends on an access request

Instead of the permissions dialog, Microsoft may show a page saying it has received your access request for Pia Public Cloud, with the status submitted. Your organization doesn’t let users approve apps themselves, so Microsoft sent a request to your IT administrators. The request stays open for 30 days.

This is Microsoft doing what your organization set it up to do. It is not a fault in Pia. Because the browser never comes back to Pia, Pia gives up waiting after five minutes and shows Login timed out.

What to do:

1. Tell your IT administrator that a request for Pia Public Cloud is waiting for them.
2. Wait for Microsoft’s email saying the request was approved.
3. Click Sign in with Microsoft again.

In the meantime you can keep using Pia on this device. Only what needs a Pia account, such as Cloud Sync, waits for your sign-in.

Don’t create a second account with the same email

Don’t sign up with email and password, or with Google, using the same address to get around the wait. A Pia account stays tied to the sign-in method it was created with. Once your IT approves Pia, Sign in with Microsoft would be refused with “An account with this email already exists. Please sign in with your original method.”

For IT administrators: approving Pia

Any one of these clears the way for your users:

• Approve the request. In the Microsoft Entra admin center, open Enterprise applications → Admin consent requests and approve the request for Pia Public Cloud.
• Sign in once yourself. Sign in to Pia with Microsoft as an administrator, and tick Consent on behalf of your organization in the permissions dialog.
• Grant consent from a link. As an administrator, open https://login.microsoftonline.com/<your-tenant-id>/adminconsent?client_id=<client-id>. Pia support gives you the client ID for Pia Cloud.

Why your users can’t approve Pia themselves

Your tenant’s policy decides this. Look under Enterprise applications → Consent and permissions → User consent settings:

Setting	What it means for Pia
Do not allow user consent	Every app needs an administrator, so each new user files a request. Approve Pia once for the whole organization, using one of the options above.
Allow user consent for apps from verified publishers (or a Microsoft-managed setting)	Pia Public Cloud comes from a verified publisher, so your users should be able to approve it themselves. If they still end up on an access request, tell Pia support which setting you use.

If sign-in still fails after approval

A user who was approved but still can’t sign in usually sees a Microsoft error with an AADSTS code rather than the access request page. Check these:

• Enterprise applications → Pia Public Cloud → Properties: Enabled for users to sign in must be on. If Assignment required is on, add the users or their groups under Users and groups.
• Sign-in logs: filter by the user and the app Pia Public Cloud (or neo42 Pia Auth) to read the exact AADSTS code.

Next Steps

To see what an account adds, read Cloud Sync. To limit which sign-in methods your users may use, see allowedSyncProviders in Enterprise Policy.