Microsoft Entra SSO and SCIM

Use this guide when Microsoft Entra ID is your identity provider for observity.ai authentication and provisioning.

App Registration

1. In Microsoft Entra admin center, create an app registration for observity.ai.
2. Add the observity.ai Redirect URI from Settings > Single Sign-On (SSO) as a web redirect URI before creating or copying the client secret.
3. Create a client secret.
4. Copy the issuer URL, application client ID, and client secret into observity.ai.
5. Assign users or groups through the Enterprise Application.

Use these OIDC scopes:

openid email profile

SCIM Provisioning

In the observity.ai Enterprise Application, open Provisioning and configure:

Test the connection before enabling the provisioning job.

Attribute Mapping

Map Entra user fields to SCIM attributes:

Use objectId for externalId because it is stable and not reused.

Group Assignment

Use assigned groups to control observity.ai access:

1. Assign observity.ai groups to the Enterprise Application.
2. Enable group provisioning for assigned groups.
3. Wait for the groups to appear in observity.ai.
4. Map each group to Viewer, Member, or Admin in observity.ai.

Recommended group pattern:

After the first provisioning cycle completes, enable Require SCIM provisioning for SSO access in observity.ai.