Microsoft Entra ID SSO

Enterprise single sign-on with Microsoft Entra ID (Azure AD), with automatic user and role management through SCIM provisioning.

Enterprise tier

SSO is part of the Automatum Enterprise plan. Contact your account manager to enable it for your organization.

---

Overview

With SSO enabled, your team signs in to Automatum with their Microsoft work account. Entra ID decides who has access and which role each person holds:

• Single Sign-On (OIDC): users click Continue with Microsoft and authenticate with Entra ID. No Automatum passwords.
• SCIM provisioning: Entra ID creates users in Automatum, assigns their role, updates it when it changes, and removes access when a user is unassigned or deactivated.
• Instant deactivation: when a user is deactivated or unassigned in Entra ID, their Automatum access stops immediately — even if they are still signed in.

Roles are managed in Entra ID, not on the Automatum Team page. You assign each user one Automatum App Role in Entra, and provisioning syncs it.

Safe setup

Setup runs in draft mode. While you configure and test, nothing changes for your team — everyone keeps signing in as before. Password sign-in is switched off only when you activate, and activation requires a successful test sign-in first. You cannot lock yourself out.

Prerequisites

• Automatum Enterprise plan with SSO enabled.
• An Automatum account with the Owner role.
• Admin access to your Entra ID tenant (you must be able to create an app registration and configure provisioning).
• Your team's work email domain (for example contoso.com). At least one existing Automatum user in your organization must have an email on that domain.

---

Step 1: Create the Entra ID app registration

1. In the Microsoft Entra admin center, go to Identity → Applications → App registrations → New registration.

2. Name it (for example, Automatum).

3. Under Supported account types, select Accounts in this organizational directory only.

4. Under Redirect URI, select the Web platform and paste the redirect URI shown on your Automatum SSO card (Settings → Integrations → Single Sign-On). It has this shape:

   https://<automatum-auth-domain>.amazoncognito.com/oauth2/idpresponse

5. Click Register.

6. On the app's Overview page, note the Application (client) ID and the Directory (tenant) ID.

7. Go to Certificates & secrets → New client secret. Create a secret and copy its Value now — Entra shows it only once.

Secret expiry

Entra client secrets expire (up to 24 months). Set a reminder to rotate the secret before it expires, or SSO sign-in stops working. To rotate, create a new secret in Entra and re-submit the SSO configuration in Automatum.

Step 2: Define the App Roles

Automatum reads each user's role from an Entra App Role. Create one App Role per Automatum role you use.

1. In your app registration, go to App roles → Create app role.
2. Create a role for each row you need. The Value must match exactly:

Display name	Value	Automatum role
Owner	Owner	Owner
Manager	Manager	Manager
Editor	Editor	Editor
Deal Desk	DealDesk	Deal Desk
Co-sell Manager	CosellManager	Co-sell Manager
Viewer	Viewer	Viewer

For each role, set Allowed member types to Users/Groups and enable it. See Roles & Permissions for what each role can do.

3. Require assignment: go to Enterprise applications → your app → Properties → set Assignment required? to Yes. Users outside the assignment get no access.
4. Assign your users: Enterprise applications → your app → Users and groups → Add user/group. Give each user exactly one role.

One role per user

Assign one App Role per user. A user with multiple roles, or none, is treated as a Viewer (read-only). Access always fails closed.

Step 3: Submit the configuration in Automatum

1. In Automatum, go to Settings → Integrations → Single Sign-On (Owner role required).
2. Enter:
   • Directory (tenant) ID — from Step 1
   • Application (client) ID — from Step 1
   • Client secret — from Step 1
   • Email domain(s) — your team's work email domains
3. Click Save. Automatum provisions your connection in draft mode and shows:
   • A SCIM Tenant URL
   • A SCIM secret token

Copy the token now

The SCIM token is shown once. Store it somewhere safe. If you lose it, use Rotate token on the SSO card to get a new one (the old one stops working).

An email domain can belong to only one Automatum organization. If your domain is already claimed, contact support.

Step 4: Configure Entra provisioning (SCIM)

1. In Enterprise applications → your app → Provisioning → New configuration.
2. Set Provisioning Mode to Automatic and enter:
   • Tenant URL: the SCIM Tenant URL from Step 3
   • Secret Token: the SCIM token from Step 3
3. Click Test Connection, then Save.
4. Map the App Role. Under Mappings → Provision Microsoft Entra ID Users:
   • Add (or edit) a mapping with Mapping type = Expression
   • Expression: SingleAppRoleAssignment([appRoleAssignments])
   • Target attribute: roles[primary eq "True"].value
5. Under Settings, set Scope to Sync only assigned users and groups.
6. Turn Provisioning Status to On, or use Provision on demand to sync your first user right away.

Entra syncs on its own cycle (about every 40 minutes). Provision on demand is instant and is the fastest way to test.

Step 5: Test sign-in

1. Make sure your own user is assigned in Entra with the Owner App Role, and has been provisioned (Step 4).
2. Open the Automatum sign-in page in a private browser window.
3. Enter your work email and click Continue with Microsoft.
4. Sign in with your Entra ID account. You should land in Automatum with your assigned role.
5. Back on the SSO card, click Test configuration to see what Automatum resolved: your identity, your membership, and your role.

Step 6: Activate

Activation is the switch-over. After it, discovery sends your domain's users to Entra ID and password sign-in is turned off for your organization.

On the SSO card, click Activate. Automatum checks two things first:

• At least one federated sign-in has completed (Step 5).
• At least one provisioned, active user holds the Owner role.

If either check fails, activation is refused with the reason — fix it and try again. Until you activate, nothing changes for your team.

---

Managing users after setup

Everything is managed in Entra ID:

To do this	Do this in Entra ID
Add a user	Assign them to the app with one App Role
Change a role	Change their App Role assignment
Remove access	Unassign them from the app, or deactivate the account

Changes sync on the provisioning cycle. Removal takes effect on the next Automatum request after sync — an open session does not keep working.

On the Automatum Team page, provisioned users show as managed in Entra and cannot be edited there.

Troubleshooting

Symptom	Likely cause	Fix
"No provisioned user for this login"	The user has not been provisioned yet	Assign the user in Entra and run Provision on demand
Sign-in works but the role is Viewer	No App Role, more than one App Role, or a misspelled role Value	Assign exactly one role; check the Value matches the table in Step 2
"No active membership"	The user was unassigned or deactivated in Entra	Re-assign the user; provisioning reactivates them
Activation refused	No test sign-in yet, or no provisioned Owner	Complete Step 5; assign the Owner App Role and provision
"SSO required for this organization" on password login	SSO is active for your organization	Sign in with Continue with Microsoft
Sign-in stopped working for everyone	Expired Entra client secret	Create a new secret and re-submit the configuration (Step 3)

Use Test configuration on the SSO card to see exactly what Automatum received for your session.

Turning SSO off

An Owner can remove the SSO configuration from the SSO card. Federated sign-in and provisioning stop, and your email domains are released. User accounts are kept; contact support to restore password access for your team.

Using another provider?

See the Okta SSO guide, the Google Workspace SSO guide, or Other Identity Providers (Generic OIDC).