dtos) {
+ return workRuleService.saveAll(dtos);
+ }
+}
diff --git a/wtm-api/src/main/java/kr/co/accura/wtm/api/WtmAuthController.java b/wtm-api/src/main/java/kr/co/accura/wtm/api/WtmAuthController.java
new file mode 100644
index 0000000..efd1371
--- /dev/null
+++ b/wtm-api/src/main/java/kr/co/accura/wtm/api/WtmAuthController.java
@@ -0,0 +1,52 @@
+package kr.co.accura.wtm.api;
+
+import lombok.RequiredArgsConstructor;
+import org.springframework.http.ResponseEntity;
+import org.springframework.web.bind.annotation.*;
+
+import java.util.Map;
+
+/**
+ * WTM-specific auth endpoints that supplement wbx-spring-core's AuthController.
+ *
+ * wbx-spring-core already provides: /api/wtm/auth/login, /me, /refresh, /logout, /password/change.
+ * This controller adds only the MISSING endpoints: SSO and password-reset.
+ */
+@RestController
+@RequiredArgsConstructor
+public class WtmAuthController {
+
+ /**
+ * SSO initiation — redirects to OAuth2 authorization endpoint.
+ * Requires Azure Entra ID configuration.
+ */
+ @GetMapping("/api/wtm/auth/sso")
+ public ResponseEntity