Entra with SAML SSO

Connect Microsoft Entra ID (formerly Azure Active Directory) to Document360 with SAML so your users sign in to the knowledge base portal, and your readers to the knowledge base site, with their Microsoft credentials instead of a Document360 password. You can also turn on SCIM so that Entra ID adds and updates users and readers in Document360 for you.

When to use Entra ID with SAML SSO

Use this setup when:

• You manage identities in Microsoft Entra ID and want users to sign in to the knowledge base portal, and readers to the knowledge base site, with their Microsoft credentials.
• You want people to open Document360 directly from the Entra ID app portal (IdP-initiated sign-in).
• You want Entra ID to add and update users and readers in Document360, and sync Entra ID groups, through SCIM.
• You manage several Document360 projects and want a new project to inherit SCIM settings from an SSO configuration in a parent project.

Before you begin

• You need administrator access to the Microsoft Entra admin center.
• You need the Owner or Admin role in your Document360 project.
• Open Document360 and the Microsoft Entra admin center in two browser tabs. You switch between them during setup.
• If you plan to set up SCIM, have a secure place ready, such as a password manager, to store two secret tokens.

How to set up SAML SSO with Entra ID

Step 1: Start the SSO configuration in Document360

1. Go to Settings () > Users & Permissions > Enterprise SSO.
2. Select Create SSO, and then select SAML.

3. Select Entra ID as your identity provider.

   

The Configure SP step opens and shows the values you enter in Entra ID: Callback path and Service provider entity ID. Keep this tab open.

Step 2: Create the SAML app in Entra ID

Create the enterprise application

1. Sign in to the Microsoft Entra admin center.

2. In the left navigation, select Entra ID, and then select Enterprise apps.

3. On the Enterprise applications page, select New application > Create your own application.

4. In Input name, enter a name for the app.

5. Select Integrate any other application you don't find in the gallery, and then select Create.

   Don't select a gallery app or search for Document360 in the Entra gallery. Gallery apps don't support custom SCIM provisioning. If you already set up a gallery app, create a new non-gallery app and set up SSO again.

   

Entra ID creates the app and opens its overview page.

Enter the Document360 values

1. In the app, select the Single sign-on tab, and then select SAML.

   

2. Select Edit in the Basic SAML Configuration section, and then copy these values from the Document360 Configure SP step:

   Copy from Document360	Paste into Entra ID
   Callback path	Reply URL (Assertion Consumer Service URL)
   Callback path	Sign on URL
   Service provider entity ID	Identifier (Entity ID)

   

3. Select Save.

Step 3: Enter the Entra ID details in Document360

Get the setup values from Entra ID

On the app's Single sign-on page, find these values:

• In the Set up section, which is named after your app (for example, Set up Document360 SSO): Login URL and Microsoft Entra Identifier.
• In the SAML Certificates section: download Certificate (Base64).

Complete the Configure IdP step

1. Switch to the Document360 tab, and then select Next. The Configure IdP step opens.

2. (Optional) To reuse SCIM settings from a parent project, select that project's SSO configuration in Configure an existing connection. Only configurations with SCIM turned on appear. Your new configuration becomes a child configuration: it inherits the parent's SCIM settings, and you can't change them in the child. To learn more, read Inherit from another application. Otherwise, leave this field empty.

   

3. Copy these values from Entra ID:

   Copy from Entra ID	Paste into Document360
   Login URL	Sign on URL
   Microsoft Entra Identifier	Entity ID

4. Upload the Certificate (Base64) file you downloaded in SAML certificate. You can upload a PEM, CRT, or CER file of up to 10 MB.

5. To let people open Document360 from the Entra ID app portal, turn on Allow IdP initiated sign in. To learn more, read Let people sign in from your IdP dashboard. To send people to your knowledge base site instead of the portal after they sign in from the app portal, set Relay State in the Basic SAML Configuration section of the Entra ID app. To learn how, read Send people to the knowledge base site instead of the portal.

6. Select Next. The SCIM step opens.

Step 4: (Optional) Set up SCIM provisioning

With SCIM, the users and readers you add and update in Entra ID are added and updated in Document360, and people you delete in Entra ID become inactive in Document360. You set up SCIM in both tabs now, and test the connection in Step 6, after you create the configuration.

If you don't need SCIM, leave Enable SCIM provisioning off, select Next, and go to Step 5.

Turn on SCIM in Document360

1. On the SCIM step, turn on Enable SCIM provisioning.

2. In the confirmation dialog, review the terms, and then select Agree. The SCIM base URL and the primary and secondary secret tokens appear.

   

3. Copy both secret tokens and store them securely.

Connect Entra ID to Document360

1. In the Entra ID app, select the Provisioning tab in the left menu, and then select New configuration.

   

2. On the New provisioning configuration page, in the Admin credentials section, copy these values from the Document360 SCIM step:

   Copy from Document360	Paste into Entra ID
   SCIM base URL	Tenant URL
   Primary secret token	Secret token

   

Set the default role and groups in Document360

1. Switch to the Document360 tab. To assign users and readers to groups based on their Entra ID groups, turn on Enable group sync.
2. In Default role, keep Contributor or select another role.
3. In User groups and Reader groups, select the groups to add new people to. Users in the selected user groups get the default role. Readers in the selected reader groups always get read-only access.
4. Select Next. The More settings step opens.

Step 5: Name the configuration and create it

1. In SSO name, enter a name for this configuration.

2. In Login button text, enter the text people see on the SSO sign-in button. By default, the button reads Login with SSO.

3. (Optional) To sign out SSO users after a period of inactivity, turn on Idle session SSO timeout, and then set the Timeout duration (HH:MM). To learn more, read Sign out idle SSO user.

4. (Optional) To switch existing Document360 users and readers to Entra ID sign-in now, turn on Convert existing team and reader accounts to SSO. Then, under Send invite to, select All users or Selected users. Their existing accounts are converted to SSO accounts; no second account is created. Review the warning in Before you begin first. You can also convert accounts later. To learn how, read Convert user to SSO and Convert reader to SSO.

   

5. Select Create.

The configuration appears in the Enterprise SSO list.

Step 6: (Optional) Finish SCIM setup in Entra ID

Skip this step if you didn't set up SCIM in Step 4.

1. Switch to the Entra ID tab, which still shows the New provisioning configuration page.

2. Select Test connection. A message confirms that Entra ID connected to Document360.

   

3. Select Create.

4. To send people to Document360, start provisioning and add the userType attribute mapping, which tells Entra ID whether to provision each person as a user, reviewer, or reader. To learn how, read Start provisioning and Assign attribute mapping.

Step 7: Assign people and test sign-in

Only people assigned to the app in Entra ID can sign in to Document360 through Entra ID.

1. In the Microsoft Entra admin center, select Enterprise apps, and then open your Document360 app.
2. Select the Users and groups tab, and then select Add user/group.
3. On the Add assignments page, select Users and groups, search for each person or group who should sign in to Document360, select Select, and then select Assign.

Each person also needs an SSO account in Document360. If SCIM is on, Entra ID creates it when it provisions them; to push one person right away, use Provision on demand on the Provisioning tab. Otherwise, convert their existing account (Step 5) or invite or add them as SSO users.

To test sign-in:

1. In a private browser window, open the Document360 login page.
2. Enter the email address or subdomain of an SSO account assigned to the app, and then select Login with SSO, or the text you set in Login button text.
3. Sign in on the Microsoft sign-in page.

You land in the knowledge base portal. To learn more about how people sign in, read Log in using SSO - Knowledge base portal. If sign-in fails, read SSO login issues and SAML SSO issues.

Manage users and readers with SCIM

With SCIM on, you manage people in Entra ID, not in Document360. In Entra ID, you set how each person is provisioned (as a user, reviewer, or reader) with the userType attribute, create users, readers, and groups, push changes with Provision on demand, and delete people. In Document360, you can only manage their content access.

To learn how, read Managing users and readers with SCIM in Entra.

Limits and limitations

Best practices

• Test with a small group first. Before you roll out SSO to everyone, assign a few test accounts and sign in with them to catch attribute mapping or access issues.
• Store both secret tokens like passwords. Keep them in a password manager or secrets vault, never in plain text files or code repositories.
• Set userType or isTeamAccount for each user, not for groups. People in several groups with different values can get the wrong role in Document360.
• Match the idle timeout to your security policy. Set Timeout duration (HH:MM) to your organization's session rules.
• Renew the SAML certificate before it expires. When the certificate expires, SSO sign-in stops working. To learn more, read Managing SSO certificates.

FAQ