Beeldbank.nl Single Sign-On with Entra ID: One-Time Fee

Single Sign-On for an Image Bank with Entra ID

An IT administrator evaluating an image bank often asks first: do staff need another password, or can they log in with their work account? Beeldbank.nl offers an optional Single Sign-On (SSO) connection as a one-time setup so staff use one account. If your organisation uses Azure or Entra ID, Beeldbank.nl can connect to your existing login system.

Three flexible access methods are available. You can set up Single Sign-On with your organisation's Azure or Entra ID, enable self-registration by email domain for staff, or manage access requests from external people. To understand how these options fit into the full range of connection methods, see enterprise integration options.

How SSO Works with Azure or Entra ID

When you request SSO, the system connects your organisation's existing login to the image bank. OAuth handles account approval and verification. Staff log in once with their work account and gain access to the image bank without needing a separate password. There is no friction for your team, no second login, no separate credentials to remember.

The SSO setup is a one-time fee, not a recurring monthly subscription. This makes it attractive for organisations looking to implement a straightforward identity integration. Before proceeding, confirm the exact price and what the fee covers. Request these details in writing:

• Confirm the exact one-time fee and what it covers
• Verify the fee includes testing with your own users
• Check that the fee remains valid if your identity system changes later
• Get written confirmation from Beeldbank.nl of the fee amount and quote expiry date

Getting these details in writing ensures clarity and protects your budget planning.

OAuth and Account Verification

Beeldbank.nl uses OAuth for account approval and verification when SSO is enabled. OAuth is the technical standard your IT team should recognize. This protocol keeps your identity system in control of verification, staff passwords stay within your organisation, not with the vendor.

Coordinate internally with your IT team to understand your OAuth requirements and confirm they align with your organisation's security policies. This groundwork ensures a smooth integration when you request it.

What to Prepare Before Requesting SSO

Gather these details before requesting SSO. Preparation reduces delays and prevents misalignment between your IT team and the vendor.

• Confirm your organisation uses Azure or Entra ID for staff accounts.
• Identify who in your IT department has approval authority for new applications in your identity environment.
• Define which people get access to the image bank and at what permission level (for example, upload-only, view-only, or full admin).
• Prepare a test list of user accounts, including one for each major role, so testing reflects real usage patterns.
• Check your organisation's OAuth provider settings and confirm they allow third-party application integration.

You will also need to decide how to handle external people like freelancers, contractors, and agencies. An organisation SSO connection works only for staff with accounts in your identity system. For external users, the alternatives listed below, self-registration and access requests, are better suited. Understanding how your image bank stores video helps you plan access needs for different user types.

Self-Registration by Email Domain

Self-registration is simpler than SSO if you want to avoid a technical integration project. Employees register themselves using the organisation's email domain, and you as administrator grant the rights each person needs. There is no additional cost for self-registration, and staff get access immediately without waiting for account setup.

With self-registration, staff create their own password in the system but use their work email for login. Plan to add account removal to your offboarding checklist when people leave your organisation. You should also understand how consent expiry works, so you know how access rights change over time.

Access Requests for External Users

For people outside your staff list, an access request option is available. Visitors to your organisation's login page can click Toegangsverzoek (Request Access), fill in their details, and create a password. Your administrator receives a notification, reviews the request, and can approve part or all of the access and rights that the person needs. This approach works well for external partners, clients, and agencies you want to approve individually.

Assign someone to monitor and respond to requests promptly. For journalists requesting images, read Press Portal for Journalists for a dedicated option.

Comparing Three Ways to Give Access

Access Method	SSO with Azure or Entra ID	Self-registration	Access requests
Who acts	Beeldbank.nl and your IT admin	Admin sets permissions; users register	Admin reviews each request
Cost	One-time fee	No additional cost	No additional cost
Best for	All staff with work accounts	Staff sharing one email domain	Small number of external users
Key task	Confirm fee with Beeldbank.nl	Plan account removal process	Assign review responsibility

Choosing the Right Access Method

Start by asking: who needs access? If everyone should have the image bank and has an Azure or Entra ID account, SSO is worth requesting. If you want to avoid creating accounts by hand, self-registration solves that. If access is limited to external people you want to approve individually, access requests give you the most control. Beeldbank.nl supports all three methods at once, so you can use them together for different user groups.

Before rolling out to your team, tell them how login works, where to find the login page, and who to contact if something fails.

Beeldbank.nl Access: Three Proven Methods

Three flexible access options are available, and you can combine them to serve different groups in your organisation. Single Sign-On with Azure or Entra ID involves a one-time setup fee and uses OAuth for verification; this method is best when you want automatic login for all staff. Self-registration requires no additional cost or integration project; it suits organisations with a clear email domain boundary. Access requests give you the most granular control; use this for small numbers of external people you need to approve individually.

The key advantage of having all three methods available is flexibility. You are not locked into one approach. A large organisation might use SSO for headquarters staff, self-registration for branch offices with the same email domain, and access requests for contractors and partner agencies. The setup is not complex, each method works independently and requires only basic configuration.

When you choose SSO, the technical work is handled for you. The system connects to your existing Azure or Entra ID instance, which means your IT team does not maintain another password database, users do not face login fatigue, and you gain a single audit trail for access to images. The one-time fee covers the initial setup and testing.

When you choose self-registration, onboarding is immediate. Employees can access images on the first day they receive their work email without waiting for account provisioning. The trade-off is that you must manage account removal when staff leave, this is a key reason to add it to your offboarding process.

When you choose access requests, you retain full approval control. An external freelancer or journalist submits a request with their name and role. You review it, grant the access level that is appropriate (upload rights, download rights, viewing-only, or a custom permission set), and the person gains access. This method prevents accidental overpermissioning and creates a clear approval record.