Question: I have configured my first application in Windows Azure Active Directory and everything works fine: I can login using accounts in my directory.

However, I'm not entirely clear on all the concepts yet, especially the sign-on url. The tooltip says:

> 
> The URL where users can sign in and use your app. You can change this later.
> 
> 
> 

But users sign in somewhere on `login.windows.net` and furthermore, it doesn't matter what I enter here, authentication keeps working. So what is this 'sign-on url'?

![Azure management portal screenshot](https://i.stack.imgur.com/dUioK.png)

Answer: 
I can see why this may be confusing. I think you can look at this as the URL where the whole sign-in process starts (i.e. your app's URL, which, if they're not logged in, will sends them to login.windows.net).

Also, even if for now you might be able to enter anything and authentication still works, I'd try to make it point to the right place just in case things change in the future.
When you add your application to azure ad, it gives you client id and key. When you use that in MVC webappp, you will see that there is an entry like below in web.config: 

```
<system.identityModel.services>
    <federationConfiguration>
      <cookieHandler requireSsl="true" />
      <wsFederation passiveRedirectEnabled="true" issuer="https://login.windows.net/{some guid}/wsfed" realm="https://localhost:44304/" requireHttps="true" />
    </federationConfiguration>
  </system.identityModel.services> 

```

Copy the value of user to sign-on url.