Microsoft Entra ID / Azure AD Identity Provider

Last updated: October 2, 2026

This guide sets up single sign-on and automatic user provisioning (SCIM) between your Microsoft Entra ID tenant (formerly Azure AD) and Operandio. Operandio is not yet listed in the Microsoft Entra app gallery, so you add it as your own custom application. One application handles both sign-in and provisioning.

  • Single sign-on lets staff sign in to Operandio with their Microsoft work account.

  • Provisioning (SCIM) lets Entra create, update and deactivate Operandio accounts as people join, change or leave.

Before you start

Setup takes around 30 to 45 minutes. You will switch between Operandio and the Microsoft Entra admin center several times, so keep both open in separate tabs. You need:

  • An Operandio account with the Full Administrator permission level.

  • A Microsoft Entra role that can create and configure enterprise applications, such as Application Administrator or Cloud Application Administrator.

  • The right Microsoft licence. Assigning groups to an application and automatic provisioning to a custom app need Microsoft Entra ID P1 or P2. Check with your Microsoft licensing contact if unsure.

  • A decision on who should get Operandio, and which Entra groups you will use to decide their permission level, areas of work and locations.

  • One or two test users you can assign first, before you roll out to everyone.

  • A First name, Last name and Email on every Entra user you will assign. Operandio needs all three, and provisioning fails for anyone missing one.

Already using Entra sign-on with Operandio? You can add provisioning to your existing setup. Skip to Turn on provisioning in Operandio, and when connecting provisioning use the enterprise application that belongs to your existing app registration. Existing users are matched by their Entra Object ID, so provisioning picks them up rather than creating duplicates.

1. Add the identity provider in Operandio

Start in Operandio so you have the redirect addresses Microsoft will ask for.

  1. Go to Settings > Single Sign-On and select Add identity provider.

  2. Enter a Name, for example Contoso Microsoft. Staff see this on the Sign in with… button.

  3. Type TBC in both Client ID and Authority. You replace these in step 4.

  4. Select Save identity provider. The saved provider shows several addresses. Keep this tab open, you need three of them in step 3: the Browser redirect URI, the Browser logout link and the Device redirect URI.

2. Create the Operandio application in Entra

Create Operandio as a custom (non-gallery) enterprise application. Microsoft creates a matching app registration alongside it. You use the app registration for sign-on and the enterprise application for provisioning and user assignment.

  1. Sign in to the Microsoft Entra admin center and go to Entra ID > Enterprise apps (shown as Identity > Applications > Enterprise applications in some tenants).

  2. Select New application, then Create your own application.

  3. Name it Operandio. Staff may see this name when they sign in and in their My Apps portal.

  4. Choose Integrate any other application you don't find in the gallery (Non-gallery) and select Create.

Use one application for both. Don't create a separate app registration for sign-on. With a single application, the users and groups you assign in step 7 control both who is provisioned and who can sign in.

3. Configure sign-on

  1. Go to Entra ID > App registrations, open the All applications tab and select Operandio.

  2. Go to Manage > Authentication. On the Redirect URI configuration tab, select Add Redirect URI.

  3. Choose Single-page application. In the form that opens:

    • Paste Operandio's Browser redirect URI into Redirect URI.

    • Paste Operandio's Browser logout link into Front-channel logout URL.

    • Under Implicit grant and hybrid flows, tick ID tokens (used for implicit and hybrid flows). Leave Access tokens unticked.

    • Select Configure.

  4. Select Add Redirect URI again and choose Mobile and desktop applications. Paste Operandio's Device redirect URI as the redirect URI and select Configure. Without this, sign-in on the Operandio mobile and tablet app fails at Microsoft even though browser sign-in works.

  5. Go to Manage > Token configuration and select Add optional claim. Choose token type ID and tick email, given_name and family_name. If prompted, allow the Microsoft Graph permission. Operandio uses these to fill in each person's name and email address.

  6. Optional. If you will grant access in Operandio based on Entra group membership, select Add groups claim, tick Groups assigned to the application (or Security groups) and keep the ID token format as Group ID.

  7. Go to Overview and copy the Application (client) ID and the Directory (tenant) ID for the next step.

4. Connect sign-on in Operandio

  1. Back in Operandio, open the identity provider you created in step 1.

  2. Replace TBC in Client ID with the Application (client) ID.

  3. Replace TBC in Authority with your tenant's sign-in address, built from your Directory (tenant) ID in this format:

    https://login.microsoftonline.com/{Directory (tenant) ID}/v2.0/

    For example, if your Directory (tenant) ID is bd770d9c-62a3-4232-8e82-d3cd44bfa280, your Authority is https://login.microsoftonline.com/bd770d9c-62a3-4232-8e82-d3cd44bfa280/v2.0/

  4. Set User default permission level. This is the permission level people get when none of your access rules (step 8) give them one. Most organisations choose their least-privileged level.

  5. Leave Client secret empty. Microsoft Entra ID doesn't need one for Operandio. Save the identity provider.

Sign-on now works for anyone allowed to use the Entra app. You can test it now with the Browser login link, or continue and test everything together in step 9.

5. Turn on provisioning in Operandio

Operandio issues a dedicated service account that Entra uses to manage your users. Its secret is shown once, so have the Entra tab ready before you start.

  1. Open the identity provider and go to the Provisioning tab. The tab appears once the provider has been saved.

  2. Select Enable SCIM provisioning. A dialog shows the service account Client ID (starting with scim-) and Client secret.

  3. Copy both into your password manager or straight into Entra (step 6) before selecting I've saved these credentials. The secret is not shown again.

  4. The tab now shows the connection details. These are the same for every Operandio customer:

    • SCIM base URL: https://api.operandio.com/scim/v2

    • Token URL: https://api.operandio.com/auth/oauth2/token

Treat the secret like an admin password. It can create, change and deactivate the users this identity provider manages. It cannot read or change any other Operandio data. If you lose it or think it has been exposed, select Regenerate client secret and update Entra with the new one. The old secret stops working straight away.

6. Connect provisioning in Entra

  1. Go to Entra ID > Enterprise apps, open Operandio and select Provisioning. Select Get started or New configuration, depending on which your tenant shows.

  2. Set Provisioning Mode to Automatic.

  3. Under Admin Credentials, set Authentication Method to OAuth2 Client Credentials Grant, then fill in:

    • Tenant URL: https://api.operandio.com/scim/v2

    • Token Endpoint: https://api.operandio.com/auth/oauth2/token

    • Client Identifier: the Client ID from step 5 (starts with scim-)

    • Client Secret: the Client secret from step 5

    Leave Secret Token empty if it is shown.

  4. Select Test Connection. When it succeeds, select Create.

  5. Entra opens the provisioning settings for Operandio. In the left menu, go to Manage > Attribute mapping and stay on the Users tab.

    Find the row with source attribute mailNickname and target attribute externalId. Select it to edit, change it as below, and save. Then do the same for the userPrincipalName row, so that Object ID is the only attribute Entra matches on.

    • mailNickname → externalId: change the source attribute to objectId. Set Match objects using this attribute to Yes and Matching precedence to 1.

    • userPrincipalName → userName: keep the mapping. Set Match objects using this attribute to No.

    • mail → emails[type eq "work"].value: no change. This becomes the person's email address in Operandio.

    • givenName and surname → name.givenName and name.familyName: no change.

    • Switch([IsSoftDeleted], …) → active: no change. This deactivates people in Operandio when they leave.

    The externalId change is required. Operandio recognises a person by their Entra Object ID, both when they sign in and when Entra provisions them. If externalId stays mapped to mailNickname, someone who is provisioned and then signs in ends up with two separate Operandio accounts.

    Other rows in the default list, such as department or job title, can stay. Operandio stores name, email and active status, and you can use the others in access rules (step 8).

  6. Open the Groups tab. The default mappings (displayName, objectId to externalId, members) work without changes, so Entra groups can drive access in Operandio.

  7. Go to Manage > Provisioning, expand Settings and set Scope to Sync only assigned users and groups. Optionally add a notification email so you hear about provisioning failures. Select Save.

Don't turn provisioning on yet. Assign your test users first.

7. Assign users and start provisioning

  1. In the Operandio enterprise application, go to Properties and set Assignment required? to Yes, then save. Only people you assign can then sign in, which keeps sign-in and provisioning in step.

  2. Go to Users and groups, select Add user/group and assign one or two test users. When you roll out, you can assign whole groups. Members of nested groups are not provisioned, so assign the group that people are direct members of.

  3. In the provisioning left menu, select Provision on demand, choose a test user and select Provision. Entra shows each step and its result. Check that the person appears under People in Operandio with the right name and email.

  4. When the test looks right, go to Manage > Provisioning, set Provisioning Status to On and select Save. The first cycle provisions everyone in scope and can take a while for large directories. After that, Entra sends changes roughly every 40 minutes.

What happens to people over time

  • Assigned in Entra (directly or through a group): account created and active in Operandio. No invitation email is sent. They sign in with Microsoft.

  • Name or email changes: updated on the next provisioning cycle.

  • Unassigned, disabled or deleted: account deactivated. They can no longer sign in. Their history and records are kept.

  • Reassigned or re-enabled: the same account is reactivated.

8. Set access rules (claim mappings)

Access rules decide what each person gets in Operandio based on what Entra knows about them. Set them up in the identity provider's Claim mappings tab. The same rules apply whether a person arrives by signing in or by being provisioned, so you only configure them once.

  1. Select Add claim mapping, then choose what to assign: an Area of work, a Permission level or a Location.

  2. Add one or more conditions. For group-based rules, use claim name groups, operator Includes, and the group's Object ID from Entra as the value. Using the Object ID means the rule works for both sign-in and provisioning, and keeps working if the group is renamed.

Rules add access, they don't remove it. Areas of work and locations granted by a rule stay in place if the person later leaves that Entra group. Permission level is replaced whenever a permission rule matches. To remove someone's access entirely, unassign them in Entra so provisioning deactivates their account.

New starters get group-based access on the next cycle. Entra creates a person before it adds them to groups, so group-based rules apply on the following provisioning cycle, or when they sign in if you added the groups claim in step 3. Until then they have the default permission level.

9. Test and roll out

Test with your pilot users

  • The test user appears in Operandio People with the right name, email, permission level, areas of work and locations.

  • They can sign in using the identity provider's Browser login link.

  • They can sign in on a mobile or tablet using the Device login link QR code.

  • Unassigning them in Entra and running Provision on demand deactivates their Operandio account. Reassign them afterwards.

  • The provisioning logs in Entra (Enterprise apps > Operandio > Provisioning logs) show no failures.

Roll out

  1. Assign the rest of your users or groups to the Operandio enterprise application.

  2. Give staff the Browser login link. After their first sign-in, their browser remembers the provider and shows a Sign in with… button. To put Operandio in My Apps, open the app registration, go to Branding & properties and set Home page URL to the Browser login link.

  3. On mobiles and tablets, staff install the Operandio app from their app store, then scan the Device login link QR code.

Adding people manually

Provisioning creates accounts for you, but you can still add a single sign-on user by hand under People, using the Single sign-on user option. Set the User ID field to the person's Entra Object ID. Provisioning and sign-in then recognise the same account.

Find the Object ID under Entra ID > Users for an individual user. It is also the id column when you export the user list to CSV.

It looks like 8a726c59-0b68-4cbb-895c-f8fab5a51e6e.

Troubleshooting

Test Connection fails

Check that the Tenant URL and Token Endpoint match the values above exactly, with no trailing spaces, and that OAuth2 Client Credentials Grant is selected. If the secret may be wrong or was regenerated, select Regenerate client secret in Operandio and paste the new one into Entra. Also check that provisioning is still enabled on the identity provider's Provisioning tab.

Provisioning fails with "Resource undefined not found"

The person is usually missing a first name, last name or email address in Entra. Open the failed entry in the provisioning logs and check that name.givenName, name.familyName and emails[type eq "work"].value all appear in the list of attributes sent. If any are missing, fill in First name, Last name and Email on the user in Entra and provision them again.

If some of your users have no mailbox, you can send their sign-in name as their email instead. In Attribute mapping, edit the mail row, set Mapping type to Expression and enter Coalesce([mail], [userPrincipalName]).

Someone has two Operandio accounts

The externalId attribute was not mapped to objectId when they were provisioned. Fix the mapping (step 6), then contact Operandio support to tidy up the duplicate account.

A user was provisioned but has no areas of work or locations

Group-based rules apply on the provisioning cycle after the person is added to the group. Wait for the next cycle, or run Provision on demand for that person. Also check that the group is assigned to the app and that the rule uses the group's Object ID.

Sign-in works in the browser but fails on devices

The Device redirect URI is missing from the app registration. Add it with the Mobile and desktop applications platform (step 3).

People signed in before provisioning was set up

Nothing to do. Their accounts are already linked to their Entra Object ID, so provisioning updates those accounts rather than creating new ones. The same applies to people you added manually with their Object ID as the User ID.

We use more than one Microsoft tenant or identity provider

Repeat this guide for each one. Each identity provider in Operandio has its own redirect addresses and its own provisioning credentials. A person's Operandio account belongs to one identity provider, so don't assign the same people to Operandio in two tenants.

Stopping provisioning

To pause, set Provisioning Status to Off in Entra. To stop permanently, also select Disable provisioning on the identity provider's Provisioning tab in Operandio. Existing accounts stay as they are and single sign-on keeps working.

Your IT team can find technical detail in the Single Sign-On & Provisioning reference. Microsoft occasionally renames menus in the Entra admin center. If a label differs slightly from this guide, look for the nearest match.