Hey all, I'm looking for some real world input before I go too deep on this.

We're on M365 with Entra ID and I've been asked to come up with a single sign-on setup for basically everything we use internally. I'd like to stay inside the Microsoft ecosystem if I can, since we're already paying for most of it.

The problem is the mix of apps. Some are easy (SAML/OIDC). Then there's GLPI on-prem, an ERP/HR suite that has its own identity service that can supposedly federate with Entra, and a handful of old web apps that literally just have a username/password form. No SAML, no API, one of them even uses a shared account.

From what I've read, the plan would be Entra as the IdP, App Proxy in front of the on-prem stuff, header-based SSO for GLPI, and password-based SSO through App Proxy for the form-only apps, so nobody can even reach the login page without going through Entra first. Plus Conditional Access with MFA and assignment required on every app.

The other part is the portal.…