Skip to main content

Permissions & RBAC / Identity Providers

Use Microsoft Entra ID as your identity provider

Set up single sign-on and SCIM provisioning between Microsoft Entra ID and ITVA.

In this guide, you connect Microsoft Entra ID to ITVA. First, you set up single sign-on (SSO), so members sign in with their Microsoft account. Then, you set up SCIM provisioning, so Entra ID adds and removes members and their groups for you.

You make two apps in Entra ID: an app registration for SSO, and an enterprise application for SCIM.

Before you begin

  • You are an administrator in ITVA.
  • In Entra ID, you have the Application Administrator or Cloud Application Administrator role, or a role with more access.
  • Each Entra ID user who needs ITVA has an email address in the Email (mail) attribute.

Part 1: Set up single sign-on

Register ITVA in Entra ID

  1. In ITVA, go to Settings > Organization. In the Single Sign-On card, select New Single Sign-On.
  2. Copy the Callback URL. Keep the ITVA panel open.
  3. In a new browser tab, sign in to the Microsoft Entra admin center at https://entra.microsoft.com.
  4. Go to Entra ID > App registrations, and select New registration.
  5. In Name, enter ITVA.
  6. In Supported account types, select Single tenant only.
  7. Select Register. The app's Overview page opens.
  8. Copy the Application (client) ID and the Directory (tenant) ID.

Add the redirect URI

  1. In the app, under Manage, select Authentication.
  2. On the Redirect URI configuration tab, select Add Redirect URI.
  3. On the Select a platform to add redirect URI pane, select Web.
  4. In Redirect URI, paste the ITVA callback URL.
  5. Select Configure.

Make a client secret

Caution: Entra ID shows the secret value only once. Copy it before you leave the page. When the secret expires, SSO stops working until you make a new one and enter it in ITVA.

  1. In the app, go to Certificates & secrets.
  2. On the Client secrets tab, select New client secret.
  3. Enter a description, select when the secret expires, and select Add.
  4. Copy the secret's Value. Do not copy the Secret ID.

Add the email claim

ITVA finds the member by the email claim in the ID token. Entra ID does not always send this claim, so add it.

  1. In the app, go to Token configuration, and select Add optional claim.
  2. In Token type, select ID. Select email, then select Add.
  3. If Entra ID asks to turn on the Microsoft Graph email permission, select the check box and select Add.

Connect Entra ID to ITVA

  1. Go back to the Manage Single Sign-On panel in ITVA.
  2. In Client ID, enter the Application (client) ID.
  3. In Client Secret, enter the secret value.
  4. In Server Metadata URL, enter this URL. Replace <TENANT_ID> with the Directory (tenant) ID:
https://login.microsoftonline.com/<TENANT_ID>/v2.0/.well-known/openid-configuration
  1. Select Save.

Choose who can sign in

By default, every user in your tenant can sign in to the app in Entra ID. ITVA still lets in only people who are ITVA members. To limit sign-in in Entra ID too:

  1. Go to Entra ID > Enterprise apps, and open the ITVA app.
  2. In Properties, set Assignment required? to Yes, and select Save.
  3. In Users and groups, select Add user/group, and add the groups that use ITVA.

Part 2: Set up SCIM provisioning

To learn what SCIM does in ITVA, see Provision users with SCIM.

Create the provisioning app

  1. In ITVA, go to Settings > Users, and select the SCIM tab. Copy the Tenant URL and the Secret Token.
  2. In the Entra admin center, go to Entra ID > Enterprise apps, and select New application.
  3. Select Create your own application.
  4. Enter a name, for example ITVA SCIM. Select Integrate any other application you don't find in the gallery, then select Add.
  5. In the new app, select Provisioning, then select New configuration.
  6. In Tenant URL, paste the ITVA Tenant URL. In Secret Token, paste the ITVA secret token.
  7. Select Test Connection. When the test passes, select Create.

Check the attribute mappings

By default, Entra ID sends the user principal name (UPN) as userName. ITVA uses userName as the member's email, and SSO matches on the email claim. If your users' UPNs are different from their email addresses, change the mapping.

  1. In the left panel, select Attribute mapping, then select the mapping for users.
  2. If the UPN is not the email address, edit the userName mapping and set its source attribute to mail.
  3. Make sure givenName maps to name.givenName, surname maps to name.familyName, and active has a mapping. ITVA ignores the other user attributes.
  4. Select Save.
  5. Go back to Attribute mapping, and make sure the mapping for groups is on. Make sure objectId maps to externalId.

If you set up each group in ITVA before the first sync, its members get the correct access as soon as Entra ID adds them.

  1. In Entra ID, open each group that will use ITVA, and copy its Object ID.
  2. In ITVA, on the SCIM tab, select New Group.
  3. Enter the group's Name. In External ID, paste the Object ID.
  4. Select the Role and the Tags, then select Save.

Assign groups and start provisioning

  1. In the ITVA SCIM app, go to Users and groups. Select Add user/group, and add the same groups.
  2. Make sure the provisioning scope is Sync only assigned users and groups.
  3. In the left panel, select Overview, then select Start provisioning.

Entra ID runs the first sync soon after you start provisioning. After that, it syncs about every 40 minutes. To sync one user at once, use Provision on demand in the app.

Check that it worked

  1. In the ITVA SCIM app, open Provisioning logs. The users and groups show with the status Success.
  2. In ITVA, on the SCIM tab, the groups show with their Users. On the Memberships tab, the users show with their role and tags.
  3. In a private browser window, open ITVA and select Single Sign-On. Sign in as one of the provisioned users. ITVA opens.

Troubleshooting

  • If Test Connection fails with an authorization error, copy the secret token from ITVA again. Make sure the Tenant URL ends in /scim/v2.
  • If SSO sends you back to the ITVA sign-in page, the email in the token does not match an ITVA member. Make sure the email claim is added, and that userName maps to the same email.
  • If Entra ID shows error AADSTS50011, the redirect URI does not match. Copy the callback URL from ITVA again. In the app registration, open Authentication, and paste it on the Redirect URI configuration tab.
  • If SSO worked before and stops, the client secret may have expired. Make a new one and enter it with Edit Single Sign-On.
  • If members have the Default role, the ITVA group's External ID is not the group's Object ID. Edit the group in ITVA and give it a role and tags.