Setup required

Environment variables

• Checking…

1. Register the application in Entra ID

1. In the Azure portal open Microsoft Entra ID → App registrations → New registration.
2. Name it something like Novus QBR.
3. For supported account types choose Accounts in this organizational directory only — this is the first of the two gates that keep sign-in inside your tenant.
4. Add a Web redirect URI of …
5. Under Certificates & secrets create a client secret and copy the value.
6. Under Token configuration nothing is needed: the default openid profile email claims are enough.

2. Set the environment

ENTRA_TENANT_ID=<Directory (tenant) ID>
ENTRA_CLIENT_ID=<Application (client) ID>
ENTRA_CLIENT_SECRET=<the secret value>
PUBLIC_URL=https://qbr.example.com
[email protected]

APP_SECRET_KEY=<openssl rand -hex 32>
SECURE_COOKIES=1

3. Restart and sign in

BOOTSTRAP_ADMIN_UPN is allowed to sign in while the app has no users at all, and becomes the first administrator. From there, add everyone else — and their API keys — in the admin panel. The variable is ignored once an admin exists, so it is safe to leave set.