Entra Logo
You add the entra logo to your sign-in screen through your directory branding settings. Upload your image files and assign them to your registered internal apps. Most teams start this setup by granting wide directory roles to IT admins. When those directory roles are too broad, one person can edit every app login. That extra permission also lets admins change sign-in rules across the whole company. How the entra logo and app branding workflow operates Microsoft Entra handles visual branding a
Microsoft Entra ID (Azure AD): the complete guide
Architecture patterns, implementation strategies, and security best practices. Delivered to your inbox.
You add the entra logo to your sign-in screen through your directory branding settings. Upload your image files and assign them to your registered internal apps. Most teams start this setup by granting wide directory roles to IT admins. When those directory roles are too broad, one person can edit every app login. That extra permission also lets admins change sign-in rules across the whole company.
How the entra logo and app branding workflow operates
Microsoft Entra handles visual branding at two distinct levels inside your tenant. The first level covers your company sign-in page for all workers. You upload a square badge and a wide banner for the main login screen. The directory shows these images after a user types in a work email address. This step helps users spot fake login pages before they type a password.
The second level controls the icon for each registered internal app. Every database tool or internal portal has its own app record in the directory. An admin uploads the entra logo or a custom icon to that specific record. That icon then shows up on the company app launcher tile for assigned staff. It also appears on the consent prompt when the app asks for user profile info.
To manage these files, your staff need specific directory roles. Many teams take a shortcut and hand out full global admin rights for simple updates. A better path is to assign a smaller role scoped only to app records. You can even assign ownership of a single app record to one team lead. That lead can then update the icon without touching any other company settings.
What directory branding solves and what it leaves open
Good login branding builds trust with your staff during the sign-in flow. Workers know they are on the right page when they see expected company graphics. Scoped app roles also stop admins from breaking login rules for other teams. Directory branding and login roles handle the front door very well.
Microsoft Entra ID (Azure AD): architecture patterns and best practices
Continue reading? Get the full guide.
Free. No spam. Unsubscribe anytime.
Still, the directory only checks who can log into an app at the start. Once a user passes the login screen, the directory steps out of the way. It cannot see what queries or commands that user runs inside a database session. If a developer logs into a production tool, Entra does not inspect the SQL statements. It also cannot rewrite sensitive fields like emails or card numbers in query results.
The same gap exists when staff run commands on Linux servers or cloud clusters. Directory roles decide if a worker can start a session on a host. They do not approve individual commands or mask phone numbers and national IDs in output. Teams need runtime controls that work after the directory sign-in finishes.
Add runtime guardrails and masking beside your databases and APIs
Login rules, role grants, and CI checks govern who connects to your stack. Yet any allowed script, engineer, or AI agent still runs commands with the full scope of its role. For workloads on Postgres, MySQL, SQL Server, MongoDB, ClickHouse, Kubernetes, SSH, or internal HTTP services, hoop.dev sits beside the service as an open-source proxy, a sidecar for your database or API.
Before a query runs, hoop.dev guardrails check the statement against your rules. An AI Analyzer you configure can score intent or hold risky calls for human review. Next, hoop.dev data masking rewrites sensitive fields in responses, and each verdict is logged per listener. Explore the MIT-licensed project on GitHub.
Frequently asked questions
Why does our new app icon not show up on the login screen?
Browser caches and directory content networks hold onto old images for a short period. Have your users test the sign-in flow in a fresh private browser window first. Also check that you uploaded the icon to the public app profile record.
Which role lets a team member change an app icon safely?
You do not need to grant tenant-wide admin rights for image updates. Make the user an owner of that single app record inside the directory instead. That person can update the branding for that app without access to other apps.
Does login branding protect against stolen session tokens?
No, visual logos only help users spot fake login pages before they sign in. If an attacker steals an active session token, they bypass the login screen altogether. You need action-level checks and data masking to protect data during an active session.