# Use Microsoft Entra ID as your identity provider

> Set up single sign-on and SCIM provisioning between Microsoft Entra ID and ITVA.

Section: Permissions & RBAC / Identity Providers  
Source: https://www.itva.com/docs/identity-providers/use-microsoft-entra-id  
Last updated: 2026-11-04

In this guide, you connect Microsoft Entra ID to ITVA. First, you set up single sign-on (SSO), so members sign in with their Microsoft account. Then, you set up SCIM provisioning, so Entra ID adds and removes members and their groups for you.

You make two apps in Entra ID: an app registration for SSO, and an enterprise application for SCIM.

## Before you begin

- You are an administrator in ITVA.
- In Entra ID, you have the Application Administrator or Cloud Application Administrator role, or a role with more access.
- Each Entra ID user who needs ITVA has an email address in the **Email** (`mail`) attribute.

## Part 1: Set up single sign-on

### Register ITVA in Entra ID

1. In ITVA, go to **Settings > Organization**. In the **Single Sign-On** card, select **New Single Sign-On**.
2. Copy the **Callback URL**. Keep the ITVA panel open.
3. In a new browser tab, sign in to the Microsoft Entra admin center at `https://entra.microsoft.com`.
4. Go to **Entra ID > App registrations**, and select **New registration**.
5. In **Name**, enter `ITVA`.
6. In **Supported account types**, select **Single tenant only**.
7. Select **Register**. The app's **Overview** page opens.
8. Copy the **Application (client) ID** and the **Directory (tenant) ID**.

### Add the redirect URI

1. In the app, under **Manage**, select **Authentication**.
2. On the **Redirect URI configuration** tab, select **Add Redirect URI**.
3. On the **Select a platform to add redirect URI** pane, select **Web**.
4. In **Redirect URI**, paste the ITVA callback URL.
5. Select **Configure**.

### Make a client secret

**Caution: **Entra ID shows the secret value only once. Copy it before you leave the page. When the secret expires, SSO stops working until you make a new one and enter it in ITVA.

1. In the app, go to **Certificates & secrets**.
2. On the **Client secrets** tab, select **New client secret**.
3. Enter a description, select when the secret expires, and select **Add**.
4. Copy the secret's **Value**. Do not copy the **Secret ID**.

### Add the email claim

ITVA finds the member by the `email` claim in the ID token. Entra ID does not always send this claim, so add it.

1. In the app, go to **Token configuration**, and select **Add optional claim**.
2. In **Token type**, select **ID**. Select **email**, then select **Add**.
3. If Entra ID asks to turn on the Microsoft Graph email permission, select the check box and select **Add**.

### Connect Entra ID to ITVA

1. Go back to the **Manage Single Sign-On** panel in ITVA.
2. In **Client ID**, enter the Application (client) ID.
3. In **Client Secret**, enter the secret value.
4. In **Server Metadata URL**, enter this URL. Replace `<TENANT_ID>` with the Directory (tenant) ID:

```
https://login.microsoftonline.com/<TENANT_ID>/v2.0/.well-known/openid-configuration
```

5. Select **Save**.

### Choose who can sign in

By default, every user in your tenant can sign in to the app in Entra ID. ITVA still lets in only people who are ITVA members. To limit sign-in in Entra ID too:

1. Go to **Entra ID > Enterprise apps**, and open the ITVA app.
2. In **Properties**, set **Assignment required?** to **Yes**, and select **Save**.
3. In **Users and groups**, select **Add user/group**, and add the groups that use ITVA.

## Part 2: Set up SCIM provisioning

To learn what SCIM does in ITVA, see [Provision users with SCIM](https://www.itva.com/docs/permissions-rbac/provision-users-with-scim).

### Create the provisioning app

1. In ITVA, go to **Settings > Users**, and select the **SCIM** tab. Copy the **Tenant URL** and the **Secret Token**.
2. In the Entra admin center, go to **Entra ID > Enterprise apps**, and select **New application**.
3. Select **Create your own application**.
4. Enter a name, for example `ITVA SCIM`. Select **Integrate any other application you don't find in the gallery**, then select **Add**.
5. In the new app, select **Provisioning**, then select **New configuration**.
6. In **Tenant URL**, paste the ITVA Tenant URL. In **Secret Token**, paste the ITVA secret token.
7. Select **Test Connection**. When the test passes, select **Create**.

### Check the attribute mappings

By default, Entra ID sends the user principal name (UPN) as `userName`. ITVA uses `userName` as the member's email, and SSO matches on the email claim. If your users' UPNs are different from their email addresses, change the mapping.

1. In the left panel, select **Attribute mapping**, then select the mapping for users.
2. If the UPN is not the email address, edit the `userName` mapping and set its source attribute to `mail`.
3. Make sure `givenName` maps to `name.givenName`, `surname` maps to `name.familyName`, and `active` has a mapping. ITVA ignores the other user attributes.
4. Select **Save**.
5. Go back to **Attribute mapping**, and make sure the mapping for groups is on. Make sure `objectId` maps to `externalId`.

### Set up groups in ITVA first (recommended)

If you set up each group in ITVA before the first sync, its members get the correct access as soon as Entra ID adds them.

1. In Entra ID, open each group that will use ITVA, and copy its **Object ID**.
2. In ITVA, on the **SCIM** tab, select **New Group**.
3. Enter the group's **Name**. In **External ID**, paste the Object ID.
4. Select the **Role** and the **Tags**, then select **Save**.

### Assign groups and start provisioning

1. In the `ITVA SCIM` app, go to **Users and groups**. Select **Add user/group**, and add the same groups.
2. Make sure the provisioning scope is **Sync only assigned users and groups**.
3. In the left panel, select **Overview**, then select **Start provisioning**.

Entra ID runs the first sync soon after you start provisioning. After that, it syncs about every 40 minutes. To sync one user at once, use **Provision on demand** in the app.

## Check that it worked

1. In the `ITVA SCIM` app, open **Provisioning logs**. The users and groups show with the status **Success**.
2. In ITVA, on the **SCIM** tab, the groups show with their **Users**. On the **Memberships** tab, the users show with their role and tags.
3. In a private browser window, open ITVA and select **Single Sign-On**. Sign in as one of the provisioned users. ITVA opens.

## Troubleshooting

- If **Test Connection** fails with an authorization error, copy the secret token from ITVA again. Make sure the Tenant URL ends in `/scim/v2`.
- If SSO sends you back to the ITVA sign-in page, the email in the token does not match an ITVA member. Make sure the email claim is added, and that `userName` maps to the same email.
- If Entra ID shows error AADSTS50011, the redirect URI does not match. Copy the callback URL from ITVA again. In the app registration, open **Authentication**, and paste it on the **Redirect URI configuration** tab.
- If SSO worked before and stops, the client secret may have expired. Make a new one and enter it with **Edit Single Sign-On**.
- If members have the Default role, the ITVA group's External ID is not the group's Object ID. Edit the group in ITVA and give it a role and tags.