---
title: "Entra with SAML SSO"
slug: "saml-sso-with-entra"
description: "You can configure Document360's SAML Single Sign-On (SSO) with the Azure Active directory (Azure AD) as the Identity provider."
tags: ["SAML"]
updated: 2026-10-21T07:14:37Z
published: 2026-10-21T07:14:37Z
canonical: "docs.document360.com/saml-sso-with-entra"
---

> ## Documentation Index
> Fetch the complete documentation index at: https://docs.document360.com/llms.txt
> Use this file to discover all available pages before exploring further.

# Entra with SAML SSO

Connect Microsoft Entra ID (formerly Azure Active Directory) to Document360 with SAML so your users sign in to the knowledge base portal, and your readers to the knowledge base site, with their Microsoft credentials instead of a Document360 password. You can also turn on SCIM so that Entra ID adds and updates users and readers in Document360 for you.

---

## When to use Entra ID with SAML SSO

Use this setup when:

- You manage identities in Microsoft Entra ID and want users to sign in to the knowledge base portal, and readers to the knowledge base site, with their Microsoft credentials.
- You want people to open Document360 directly from the Entra ID app portal (IdP-initiated sign-in).
- You want Entra ID to add and update users and readers in Document360, and sync Entra ID groups, through SCIM.
- You manage several Document360 projects and want a new project to inherit SCIM settings from an SSO configuration in a parent project.

| What you can set up with Entra ID | Supported |
| --- | --- |
| User (knowledge base portal) sign-in | Yes |
| Reader (knowledge base site) sign-in | Yes |
| Sign-in from the Entra ID app portal (IdP-initiated sign-in) | Yes |
| SCIM user provisioning | Yes |
| SCIM reader provisioning | Yes |
| SCIM group sync | Yes |
| Reuse SCIM settings from a parent project | Yes |

---

## Before you begin

- You need administrator access to the [Microsoft Entra admin center](https://entra.microsoft.com/#home).
- You need the **Owner** or **Admin** role in your Document360 project.
- Open Document360 and the Microsoft Entra admin center in two browser tabs. You switch between them during setup.
- If you plan to set up SCIM, have a secure place ready, such as a password manager, to store two secret tokens.

 WARNING

Two choices in this setup can't be undone:

- **Identity provider**: You can't change the IdP after you create the configuration.
- **Convert existing accounts to SSO**: Converted users and readers lose password sign-in right away and must sign in through Entra ID. Each of them receives an email about the change.

---

## How to set up SAML SSO with Entra ID

### Step 1: Start the SSO configuration in Document360

1. Go to **Settings** () > **Users & Permissions** > **Enterprise SSO**.
2. Select **Create SSO**, and then select **SAML**.

![The Enterprise SSO page with the Create SSO button and the SAML option](https://cdn.document360.io/860f9f88-412e-4570-8222-d5bf2f4b7dd1/Images/Documentation/SSO-configurations.png)

1. Select **Entra ID** as your identity provider.

![The identity provider options in the SAML setup wizard, with Entra ID available to select](https://cdn.document360.io/860f9f88-412e-4570-8222-d5bf2f4b7dd1/Images/Documentation/SAML-create-sso-step-1.png)

The **Configure SP** step opens and shows the values you enter in Entra ID: **Callback path** and **Service provider entity ID**. Keep this tab open.

![The Configure SP step for Entra ID showing the callback path and service provider entity ID to copy](https://cdn.document360.io/860f9f88-412e-4570-8222-d5bf2f4b7dd1/Images/Documentation/saml-entra-sp.png)

### Step 2: Create the SAML app in Entra ID

#### Create the enterprise application

1. Sign in to the [Microsoft Entra admin center](https://entra.microsoft.com/#home).
2. In the left navigation, select **Entra ID**, and then select **Enterprise apps**.
3. On the **Enterprise applications** page, select **New application** > **Create your own application**.
4. In **Input name**, enter a name for the app.
5. Select **Integrate any other application you don't find in the gallery**, and then select **Create**.

Don't select a gallery app or search for Document360 in the Entra gallery. Gallery apps don't support custom SCIM provisioning. If you already set up a gallery app, create a new non-gallery app and set up SSO again.

![Creating your own application in the Microsoft Entra admin center from Enterprise apps](https://cdn.document360.io/860f9f88-412e-4570-8222-d5bf2f4b7dd1/Images/Documentation/creating application.gif)

Entra ID creates the app and opens its overview page.

#### Enter the Document360 values

1. In the app, select the **Single sign-on** tab, and then select **SAML**.

![The Select a single sign-on method page in Entra ID with SAML highlighted](https://cdn.document360.io/860f9f88-412e-4570-8222-d5bf2f4b7dd1/Images/Documentation/saml method.png)
2. Select **Edit** in the **Basic SAML Configuration** section, and then copy these values from the Document360 **Configure SP** step:

| Copy from Document360 | Paste into Entra ID |
| --- | --- |
| **Callback path** | **Reply URL (Assertion Consumer Service URL)** |
| **Callback path** | **Sign on URL** |
| **Service provider entity ID** | **Identifier (Entity ID)** |

![The Basic SAML Configuration panel in Entra ID with the identifier, reply URL, and sign on URL filled in from Document360](https://cdn.document360.io/860f9f88-412e-4570-8222-d5bf2f4b7dd1/Images/Documentation/saml config.png)
3. Select **Save**.

### Step 3: Enter the Entra ID details in Document360

#### Get the setup values from Entra ID

On the app's **Single sign-on** page, find these values:

- In the **Set up** section, which is named after your app (for example, **Set up Document360 SSO**): **Login URL** and **Microsoft Entra Identifier**.
- In the **SAML Certificates** section: download **Certificate (Base64)**.

![The SAML Certificates section with the Certificate (Base64) download, and the Set up section with the Login URL and Microsoft Entra Identifier](https://cdn.document360.io/860f9f88-412e-4570-8222-d5bf2f4b7dd1/Images/Documentation/certificate.png)

#### Complete the Configure IdP step

1. Switch to the Document360 tab, and then select **Next**. The **Configure IdP** step opens.
2. (Optional) To reuse SCIM settings from a parent project, select that project's SSO configuration in **Configure an existing connection**. Only configurations with SCIM turned on appear. Your new configuration becomes a child configuration: it inherits the parent's SCIM settings, and you can't change them in the child. To learn more, read [Inherit from another application](/docs/scim-with-entra#inherit-from-another-application). Otherwise, leave this field empty.

![The Configure IdP step in Document360 with the Configure an existing connection, Sign on URL, Entity ID, and SAML certificate fields](https://cdn.document360.io/860f9f88-412e-4570-8222-d5bf2f4b7dd1/Images/Documentation/saml-entra-idp.png)
3. Copy these values from Entra ID:

| Copy from Entra ID | Paste into Document360 |
| --- | --- |
| **Login URL** | **Sign on URL** |
| **Microsoft Entra Identifier** | **Entity ID** |
4. Upload the **Certificate (Base64)** file you downloaded in **SAML certificate**. You can upload a PEM, CRT, or CER file of up to 10 MB.
5. To let people open Document360 from the Entra ID app portal, turn on **Allow IdP initiated sign in**. To learn more, read [Let people sign in from your IdP dashboard](/docs/saml#let-people-sign-in-from-your-idp-dashboard). To send people to your knowledge base site instead of the portal after they sign in from the app portal, set **Relay State** in the **Basic SAML Configuration** section of the Entra ID app. To learn how, read [Send people to the knowledge base site instead of the portal](/docs/saml#send-people-to-the-knowledge-base-site-instead-of-the-portal).
6. Select **Next**. The **SCIM** step opens.

### Step 4: (Optional) Set up SCIM provisioning

With SCIM, the users and readers you add and update in Entra ID are added and updated in Document360, and people you delete in Entra ID become inactive in Document360. You set up SCIM in both tabs now, and test the connection in Step 6, after you create the configuration.

If you don't need SCIM, leave **Enable SCIM provisioning** off, select **Next**, and go to Step 5.

 WARNING

You see the primary and secondary secret tokens only once. Copy both and store them securely before you create the configuration. After that, they're masked and can't be retrieved. If you regenerate a token, the old one stops working, and you must update it in Entra ID to keep syncing.

#### Turn on SCIM in Document360

1. On the **SCIM** step, turn on **Enable SCIM provisioning**.
2. In the confirmation dialog, review the terms, and then select **Agree**. The **SCIM base URL** and the primary and secondary secret tokens appear.

![The SCIM step in Document360 with SCIM provisioning turned on, showing the SCIM base URL and secret tokens](https://cdn.document360.io/860f9f88-412e-4570-8222-d5bf2f4b7dd1/Images/Documentation/saml-entra-scim.png)
3. Copy both secret tokens and store them securely.

#### Connect Entra ID to Document360

1. In the Entra ID app, select the **Provisioning** tab in the left menu, and then select **New configuration**.

![The Provisioning page of the Entra ID app with the New configuration option](https://cdn.document360.io/860f9f88-412e-4570-8222-d5bf2f4b7dd1/Images/Documentation/new config.png)
2. On the **New provisioning configuration** page, in the **Admin credentials** section, copy these values from the Document360 **SCIM** step:

| Copy from Document360 | Paste into Entra ID |
| --- | --- |
| **SCIM base URL** | **Tenant URL** |
| Primary secret token | **Secret token** |

![The Admin credentials section in Entra ID with the Tenant URL and Secret token fields filled in](https://cdn.document360.io/860f9f88-412e-4570-8222-d5bf2f4b7dd1/Images/Documentation/tenant url.png)

 NOTE

Don't select **Test connection** or **Create** yet. The connection fails until you create the configuration in Document360 in Step 5.

#### Set the default role and groups in Document360

1. Switch to the Document360 tab. To assign users and readers to groups based on their Entra ID groups, turn on **Enable group sync**.
2. In **Default role**, keep **Contributor** or select another role.
3. In **User groups** and **Reader groups**, select the groups to add new people to. Users in the selected user groups get the default role. Readers in the selected reader groups always get read-only access.
4. Select **Next**. The **More settings** step opens.

 NOTE

The default role applies to users only. Readers, including people provisioned with `userType = "reader"` or the legacy `isTeamAccount = False` mapping, always get read-only access. Reviewers provisioned with `userType = "reviewer"` aren't affected by the default role. To learn more, read [Assign attribute mapping](/docs/scim-with-entra#assign-attribute-mapping).

### Step 5: Name the configuration and create it

1. In **SSO name**, enter a name for this configuration.
2. In **Login button text**, enter the text people see on the SSO sign-in button. By default, the button reads **Login with SSO**.
3. (Optional) To sign out SSO users after a period of inactivity, turn on **Idle session SSO timeout**, and then set the **Timeout duration (HH:MM)**. To learn more, read [Sign out idle SSO user](/docs/team-account-idle-timeout).
4. (Optional) To switch existing Document360 users and readers to Entra ID sign-in now, turn on **Convert existing team and reader accounts to SSO**. Then, under **Send invite to**, select **All users** or **Selected users**. Their existing accounts are converted to SSO accounts; no second account is created. Review the warning in **Before you begin** first. You can also convert accounts later. To learn how, read [Convert user to SSO](/docs/convert-user-to-sso) and [Convert reader to SSO](/docs/convert-reader-to-sso).

![The More settings step with the SSO name, Login button text, Idle session SSO timeout, and account conversion options](https://cdn.document360.io/860f9f88-412e-4570-8222-d5bf2f4b7dd1/Images/Documentation/Configure-Okta-more-settings.png)
5. Select **Create**.

The configuration appears in the **Enterprise SSO** list.

 NOTE

The **Auto assign reader group** toggle doesn't appear while you create a configuration. It appears only when you edit an existing configuration. To learn more, read [Managing SSO readers and reader groups](/docs/auto-assign-reader-group).

### Step 6: (Optional) Finish SCIM setup in Entra ID

Skip this step if you didn't set up SCIM in Step 4.

1. Switch to the Entra ID tab, which still shows the **New provisioning configuration** page.
2. Select **Test connection**. A message confirms that Entra ID connected to Document360.

![The New provisioning configuration page in Entra ID with the Test connection option and the filled-in admin credentials](https://cdn.document360.io/860f9f88-412e-4570-8222-d5bf2f4b7dd1/Images/Documentation/test connection(1).png)
3. Select **Create**.
4. To send people to Document360, start provisioning and add the `userType` attribute mapping, which tells Entra ID whether to provision each person as a user, reviewer, or reader. To learn how, read [Start provisioning](/docs/scim-with-entra#start-provisioning) and [Assign attribute mapping](/docs/scim-with-entra#assign-attribute-mapping).

### Step 7: Assign people and test sign-in

Only people assigned to the app in Entra ID can sign in to Document360 through Entra ID.

1. In the Microsoft Entra admin center, select **Enterprise apps**, and then open your Document360 app.
2. Select the **Users and groups** tab, and then select **Add user/group**.
3. On the **Add assignments** page, select **Users and groups**, search for each person or group who should sign in to Document360, select **Select**, and then select **Assign**.

Each person also needs an SSO account in Document360. If SCIM is on, Entra ID creates it when it provisions them; to push one person right away, use **Provision on demand** on the **Provisioning** tab. Otherwise, convert their existing account (Step 5) or [invite or add them as SSO users](/docs/inviting-or-adding-sso-users).

To test sign-in:

1. In a private browser window, open the Document360 login page.
2. Enter the email address or subdomain of an SSO account assigned to the app, and then select **Login with SSO**, or the text you set in **Login button text**.
3. Sign in on the Microsoft sign-in page.

You land in the knowledge base portal. To learn more about how people sign in, read [Log in using SSO - Knowledge base portal](/docs/login-using-sso-knowledge-base-portal). If sign-in fails, read [SSO login issues](/docs/sso-login-issues) and [SAML SSO issues](/docs/saml-sso-issues).

---

## Manage users and readers with SCIM

With SCIM on, you manage people in Entra ID, not in Document360. In Entra ID, you set how each person is provisioned (as a user, reviewer, or reader) with the `userType` attribute, create users, readers, and groups, push changes with **Provision on demand**, and delete people. In Document360, you can only manage their content access.

To learn how, read [Managing users and readers with SCIM in Entra](/docs/scim-with-entra).

---

## Considerations

| Item | Limit |
| --- | --- |
| Identity provider | You can't change the IdP after you create the configuration. |
| SAML and OpenID Connect | SAML and OpenID Connect configurations can't both be active in the same project. |
| Gallery apps | Entra gallery apps don't support custom SCIM provisioning. Use a non-gallery app. |
| SCIM with OpenID Connect | SCIM provisioning with Entra ID works only with SAML. |
| People managed through SCIM | You can't edit their names, delete them, or change their roles and permissions in Document360. You can only manage their content access. |
| Deleting people in Entra ID | Document360 doesn't remove the profile. Its status changes from **Active** to **Inactive**. |
| Child configurations | A configuration that inherits SCIM settings from a parent project can't change those settings. |
| Last active configuration | If this is the only active SSO or JWT configuration and the default login page is disabled, you can't turn it off or delete it. Document360 shows: "This is the only active SSO or JWT configuration and the default login page is disabled, so turning it off or deleting it would lock everyone out. Enable another configuration, or turn the default login page back on, first." |

---

## Best practices

- **Test with a small group first.** Before you roll out SSO to everyone, assign a few test accounts and sign in with them to catch attribute mapping or access issues.
- **Store both secret tokens like passwords.** Keep them in a password manager or secrets vault, never in plain text files or code repositories.
- **Set `userType` or `isTeamAccount` for each user, not for groups.** People in several groups with different values can get the wrong role in Document360.
- **Match the idle timeout to your security policy.** Set **Timeout duration (HH:MM)** to your organization's session rules.
- **Renew the SAML certificate before it expires.** When the certificate expires, SSO sign-in stops working. To learn more, read [Managing SSO certificates](/docs/managing-sso-certificates).

---

## FAQ

**Why do I need a non-gallery app instead of the Document360 app in the Entra gallery?**

Entra gallery apps don't support custom SCIM provisioning. To use SCIM between Entra ID and Document360, create your own application and select **Integrate any other application you don't find in the gallery**. If you already set up a gallery app, create a new non-gallery app and set up SSO again.

**Can I use SCIM with Entra ID and OpenID Connect?**

No. SCIM provisioning with Entra ID works only with SAML.

**What happens to existing Document360 users and readers when I set up SSO?**

Nothing changes for them unless you turn on **Convert existing team and reader accounts to SSO** in Step 5, or convert them later. Conversion switches their existing account to SSO; it doesn't create a second account. After conversion, they sign in through Entra ID instead of with a password. To learn more, read [Convert user to SSO](/docs/convert-user-to-sso) and [Convert reader to SSO](/docs/convert-reader-to-sso).

**Can I reuse SCIM settings from another project?**

Yes. In **Configure an existing connection** on the **Configure IdP** step, select an SSO configuration that has SCIM turned on. To do this, you need the Owner or Admin role in both projects, and the same non-SSO account in all the projects involved. The new configuration inherits the parent's SCIM settings, and you can't change them in the child.

**Why are there two SCIM secret tokens?**

Two tokens let you replace one without breaking the sync. If the primary token is exposed, switch Entra ID to the secondary token first, and then regenerate the primary token. Provisioning keeps running while you replace it.