Back to SSO docs

Microsoft Entra ID SAML + SCIM setup

~10 minutes for SAML sign-in, plus another ~5 minutes for SCIM automated provisioning. Entra ID is the new name for Azure AD — the portal is the same.

Step 1.Create the enterprise application

  1. In the Azure Portal, navigate to Microsoft Entra ID → Enterprise applications → New application.
  2. Click Create your own application.
  3. Name: Mnueron. Type: Integrate any other application you don't find in the gallery (Non-gallery). Click Create.

Step 2.Configure SAML single sign-on

  1. On the new app, in the left rail click Single sign-on, then pick SAML.
  2. Click the pencil icon on Basic SAML Configuration (top right of that card).
  3. Fill these fields. Replace your-org with your Mnueron org slug.
Entra fieldValue
Identifier (Entity ID)https://www.mnueron.com/sso/your-org
Reply URL (ACS URL)https://www.mnueron.com/api/auth/sso/your-org/acs
Sign on URLhttps://www.mnueron.com/api/auth/sso/your-org/login
Relay State(leave blank)
Logout URL(leave blank for now)

Click Save. Entra will warn about an unsaved test sign-on — ignore until later steps.

Step 3.Set Name ID to email

  1. On Attributes & Claims (pencil icon), click Unique User Identifier (Name ID).
  2. Change Source attribute to user.mail.
  3. Name identifier format: Email Address.
  4. Click Save.

Confirm the default claims for emailaddress and name are present — they should be by default for non-gallery apps.

Step 4.Download the certificate and copy IdP URLs

  1. Under SAML Certificates, click Download next to Certificate (Base64). Open the downloaded .cer file in any text editor.
  2. Under Set up Mnueron (the section at the bottom of the SAML page), copy:
    • Login URL → Mnueron's IdP SSO URL
    • Microsoft Entra Identifier → Mnueron's IdP entity ID
  3. In a separate tab, open /dashboard/settings/sso → Add connection. Paste:
    • Provider: Microsoft Entra ID
    • IdP entity ID: from the Entra page
    • IdP SSO URL: from the Entra page
    • IdP x509 signing certificate (PEM): full contents of the .cer file you downloaded, including the BEGIN/END CERTIFICATE lines
  4. Click Create draft.

Step 5.Assign users in Entra

On the Mnueron enterprise application's Users and groups tab, click Add user/group and pick the people or groups who should sign in to Mnueron via SSO.

Step 6.Activate the Mnueron connection

Back on /dashboard/settings/sso, click Activate on the connection card. Assigned users can now sign in via:

https://www.mnueron.com/api/auth/sso/your-org/login

Optional: SCIM 2.0 automated provisioning

With SCIM, Entra ID syncs user lifecycle to Mnueron every ~40 minutes (or on demand). Highly recommended at any team size.

  1. In Mnueron at /dashboard/settings/sso, click Mint token. Copy the raw scim_… value immediately.
  2. In Entra, on the Mnueron app's Provisioning tab, click Get started and set Mode = Automatic.
  3. Expand Admin Credentials:
    • Tenant URL: https://www.mnueron.com/scim/v2
    • Secret Token: paste the scim_… value
  4. Click Test connection. Expect credentials authorized. Save.
  5. Entra starts syncing every 40 minutes. Trigger an immediate sync via Provision on demand for testing.

Troubleshooting

/login?sso_error=assertion_invalid

Likely: Entra cert expired or rotated

Fix: Re-download the latest Base64 certificate from Entra's SAML Certificates section, paste fresh PEM into the Mnueron connection.

/login?sso_error=state_mismatch

Likely: Browser blocked cookies, or the round-trip exceeded 5 minutes

Fix: Have the user retry. If they're using strict-cookie-blocking extensions, ask them to allow mnueron.com cookies.

/login?sso_error=saml_no_email

Likely: user.mail attribute empty (common when user has only userPrincipalName, not mail)

Fix: In Entra, set Name ID source to user.userPrincipalName if user.mail is empty, OR backfill the mail field on the Entra user object.

SCIM 'Test connection failed'

Likely: Token wrong, revoked, or pasted with leading/trailing whitespace

Fix: Re-mint a token in Mnueron, copy with no surrounding spaces, paste again.

Using Okta instead? See the Okta guide. For SCIM details, see the SCIM 2.0 reference.