Configure Microsoft Entra ID for Humind

This guide explains how to configure:

• single sign-on with Microsoft Entra ID;
• optional automatic user provisioning with SCIM 2.0.

Humind uses a multitenant Microsoft application managed by Humind for single sign-on. You do not need to create your own App registration.

Microsoft does not enable generic automatic provisioning on the enterprise application created from an OpenID Connect App registration. SCIM therefore uses a second, non-gallery enterprise application in the same tenant. This second application is only a provisioning connector. It does not create another Humind account or replace the Humind SSO application.

Before you start

Prepare the following:

• owner access to the Humind company, or help from a Humind platform administrator;
• a Microsoft administrator who can grant tenant-wide consent, create a non-gallery enterprise application, and configure provisioning;
• the Microsoft Entra tenant ID in GUID format;
• the work email domain or domains used by teammates;
• one or two pilot users;
• a dedicated disposable user for the full SCIM lifecycle test.

Microsoft Entra automatic provisioning and group assignment require an appropriate Microsoft Entra ID license, generally P1 or P2. Direct user assignment is sufficient for the initial pilot.

SSO, SCIM, and Humind permissions

These three responsibilities remain separate:

System	Responsibility
Microsoft Entra SSO	Proves the identity of users assigned to Humind B2B SSO - Production
Microsoft Entra SCIM	Creates, updates, disables, and reactivates users assigned to Humind B2B SCIM - Production
Humind	Owns company membership, company ownership, roles, and the permission matrix

SCIM is optional. Enabling it does not disable manual Humind invitations and does not put every user in the Entra tenant in scope.

The same pilot user can be assigned to both enterprise applications. The SSO assignment allows that user to sign in. The SCIM assignment places that user in the provisioning scope.

The SCIM assignment does not grant access to the SSO application. When Assignment required? is enabled, a user who must be provisioned and then sign in must be assigned separately to both applications.

The generated Tenant URL contains /scim/v2 because Humind implements version 2.0 of the SCIM standard. This is not version 2 of the Humind provisioning feature.

Domains never grant access

Email domains only route sign-in to the correct tenant. Without SCIM, a user must already be a Humind company member or have a pending invitation. With SCIM, the user must first be actively provisioned into the company.

Part 1: Configure single sign-on

1. Find the tenant ID

1. Sign in to the Microsoft Entra admin center.
2. Open Entra ID > Overview > Properties.
3. Copy the Tenant ID. It is a GUID, for example 11111111-2222-3333-4444-555555555555.

Microsoft also documents this process in How to find your Microsoft Entra tenant ID.

2. Save the connection in Humind

1. Open Settings > Company > Single sign-on.
2. Select Microsoft Entra ID.
3. Paste the tenant ID.
4. Add the allowed work email domains, one per line and without @.
5. Turn on Allow Microsoft sign-in.
6. Keep Require Microsoft for this company turned off during the pilot.
7. Save.

Changing the tenant ID after a successful validation clears the validation and ends the affected teammates' sessions. You must then grant consent again if necessary and run a new pilot.

3. Grant administrator consent

In the Microsoft setup section in Humind:

1. Select Open admin consent.
2. Sign in with an administrator account from the configured tenant.
3. Check the application name and application ID.
4. Review the permissions, then accept them for the organization.

Humind requests only the OpenID Connect identity scopes openid, profile, and email. It does not request Microsoft Graph directory, mail, file, or group permissions.

See Grant tenant-wide admin consent to an application.

4. Assign the SSO pilot users in Microsoft

1. In the Entra admin center, open Entra ID > Enterprise applications > All applications.
2. Search for Humind B2B SSO - Production. You can also use the application ID displayed in Humind.
3. Under Properties, set Assignment required? to Yes.
4. Open Users and groups > Add user/group.
5. Assign one or two pilot users directly with the Humind User role.

Humind User grants access to the SSO application only. It never changes the user's company role or permissions in Humind. During the staged migration, do not create new assignments with the disabled legacy roles Humind Administrator, Humind Operator, or Humind Supervisor.

See Assign a user or group to an enterprise application.

5. Prepare the Humind users

Until SCIM is enabled, every pilot user must already be a company member or have a pending Humind invitation.

In Settings > Company > Teammates, check that each pilot:

• uses the same work email in Humind and Microsoft;
• belongs to the expected company or has a pending invitation;
• has the expected Humind role.

6. Test every configured domain

For each email domain configured in Humind:

1. Return to Settings > Company > Single sign-on.
2. Select Test Microsoft login.
3. Sign in with the exact pilot email entered at the beginning of the test.
4. Check that Microsoft applies the expected MFA and Conditional Access policies.
5. Check that the user reaches the correct Humind company with the expected role.
6. Confirm that the domain is shown as verified.

Run at least one successful pilot for every configured domain. Humind unlocks SCIM credentials only when all current domains have been verified.

7. Require Microsoft sign-in, when ready

After the pilot succeeds:

1. Turn on Require Microsoft for this company.
2. Review the confirmation.
3. Save.

Humind then blocks password sign-in for this company and ends current company sessions. It preserves accounts, invitations, roles, permissions, and history.

Keep Microsoft optional during the SCIM pilot

Complete the SCIM creation, update, deprovisioning, and reactivation tests before requiring Microsoft sign-in for the whole company.

Part 2: Configure automatic SCIM provisioning

How tenant isolation works

Each customer creates a dedicated Humind B2B SCIM - Production enterprise application in their own Microsoft Entra tenant. This application, its provisioning job, assignments, logs, and lifecycle status belong only to that tenant. It is not shared with other Humind customers.

Humind generates a company-specific Tenant URL and secret token. Every SCIM request must match both values and is then restricted to that Humind company, tenant ID, and Entra objectId. A user unassigned by one customer cannot be removed from another Humind company.

A Paused or Disabled provisioning status in Microsoft Entra therefore applies only to that customer's job. It does not pause Humind SCIM globally and does not affect another customer's application.

How existing users are handled

SCIM uses the immutable Entra objectId and the normalized work email to link users safely.

Situation before provisioning	Humind behavior
Existing member of this company	Links the existing account without a duplicate
Pending invitation to this company	Consumes the invitation and preserves its role
New user	Creates a password-disabled Humind account with the applicable role
Account that belongs only to another Humind company	Rejects provisioning until that account is explicitly invited to this company
Account invited here and already used in another company	Links the same global account and preserves the other company membership
Manual member or invitation outside Entra scope	Leaves it unchanged
Company owner disabled or unassigned in Entra	Returns an error until ownership is transferred

Deprovisioning removes only the membership of the company managed by this SCIM endpoint. It does not delete the global Humind account or memberships in other companies.

SCIM can create the account and store its objectId, but it does not prove that the person controls the Microsoft identity. Humind creates the global tenant ID + object ID SSO identity link only during the first successful OpenID Connect sign-in.

1. Generate the Tenant URL and token

In Settings > Company > Single sign-on:

1. Open Automatic user provisioning.
2. Choose the default Humind role.
3. Select Generate and enable.
4. Copy the Tenant URL and secret token immediately.

The default role is applied to every new user created by SCIM. An existing member or pending invitation keeps their current Humind role.

Store the token securely

Humind displays the raw token only once. Do not paste it into support tickets, chat messages, or logs. If it is lost or exposed, rotate it. Rotation immediately invalidates the previous token.

2. Create the dedicated Entra provisioning application

Do not configure SCIM in the SSO application

The Provisioning page of Humind B2B SSO - Production shows automatic provisioning as unavailable. This is expected for an OpenID Connect based application. Deleting and recreating the SSO application does not change this Microsoft limitation.

1. In the Entra admin center, open Entra ID > Enterprise applications > All applications.
2. Select New application, then Create your own application.
3. Enter Humind B2B SCIM - Production.
4. Select Integrate any other application you don't find in the gallery (Non-gallery).
5. Create the application.
6. Under Properties, set Visible to users? to No. This application is only a provisioning connector and should not appear in My Apps.
7. Open Provisioning.
8. Select New configuration or Get started, depending on the Entra interface displayed.
9. Keep Bearer authentication as the authentication method.
10. Paste the Humind Tenant URL and secret token under Admin credentials.
11. Select Test connection.
12. After the connection test succeeds, select Create.

A successful test confirms that Entra can authenticate to the company-specific Humind endpoint. As part of this test, Entra can query a user that does not exist. Humind returns an HTTP 200 response with an empty SCIM list, as expected by Microsoft.

See Provision users and groups with SCIM.

3. Configure the required attribute mappings

In Humind B2B SCIM - Production, open Attribute mapping and configure these user mappings explicitly:

Microsoft Entra attribute or expression	Humind SCIM attribute	Notes
objectId	externalId	Matching attribute with precedence 1
userPrincipalName	userName	Required; matching attribute with precedence 2
displayName	displayName	Recommended
mail	emails[type eq "work"].value	Required; populate mail for every provisioned user
givenName	name.givenName	Required
surname	name.familyName	Required
Switch([IsSoftDeleted], , "False", "True", "True", "False")	active	Active unless the Entra object is soft-deleted

Delete the default mailNickname to externalId mapping if it is present. Humind requires the immutable Entra objectId, which is also the identity used during Microsoft sign-in.

Remove the other generic mappings added by Entra: title, preferredLanguage, name.formatted, all addresses and phoneNumbers mappings, and the enterprise extension mappings for employeeNumber, department, and manager. Humind does not currently provision these attributes.

After this cleanup, only the seven mappings in the table above should remain.

Before the pilot, check that every user's mail attribute is populated and matches the work address expected in Humind.

4. Keep company roles in Humind

The dedicated non-gallery provisioning application does not inherit the application roles from Humind B2B SSO - Production.

The Humind User role in the SSO application grants access to Microsoft sign-in only. Company roles and permissions remain managed in Humind. The supported two-application setup does not synchronize company roles from Entra.

For SCIM:

1. do not add a roles attribute mapping;
2. choose the expected default Humind role before generating the credentials;
3. verify that a new provisioned user receives that default role;
4. verify that an existing member or pending invitation keeps their current role;
5. change a user's company role from Settings > Company > Teammates when a different role is required.

The company owner can never be demoted or removed by SCIM.

5. Limit the provisioning scope

In Humind B2B SCIM - Production:

1. open Users and groups and directly assign one disposable pilot user;
2. set Scope to Sync only assigned users and groups in the provisioning settings;
3. disable provisioning of group objects under Attribute mapping because Humind accepts user resources only;
4. keep every other user and group unassigned during the first pilot.

An assigned group can still define which users are in scope, but Humind does not create a corresponding group object.

Run a safe production pilot

The Humind SCIM endpoint is intentionally enabled only on the production API. Use a dedicated test company, assigned users, and disposable accounts. Do not require Microsoft sign-in during this pilot.

First pass: Provision on demand

Use Provision on demand to validate:

1. an existing company member is linked without a duplicate and keeps their role when no Entra role is sent;
2. a pending invitation is consumed without a duplicate and keeps its invitation role;
3. a new user receives a password-disabled account and the configured default role;
4. an account that belongs only to another Humind company is rejected until it is invited here;
5. a manual user outside the assigned scope remains unchanged.

To test account linking and updates unambiguously:

1. directly assign an existing Humind member who is not the company owner to Humind B2B SCIM - Production;
2. run Provision on demand for that user;
3. confirm in Humind that only one member still uses that address and that the role is unchanged;
4. immediately provision the same user again without changing the user;
5. confirm that Entra skips the write with Modified attributes (skipped) and SkipReason: RedundantExport;
6. temporarily change the test user's first name and display name in Entra;
7. provision the user again and confirm that Entra reports an update;
8. confirm the new values in Humind, restore the original values in Entra, and provision once more;
9. sign in to Humind with Microsoft again and confirm that the same account, company, and permissions are preserved.

To test a new account created entirely from Entra:

1. create a test user under Entra ID > Users without an additional Azure role, group, or license;
2. confirm that no Humind account uses that address yet;
3. assign the user to Humind B2B SCIM - Production;
4. run Provision on demand and confirm that Entra reports a successful creation;
5. confirm in Humind that exactly one account was created, password sign-in is disabled, and the configured default role was applied;
6. then assign the same user to Humind B2B SSO - Production with the Humind User role;
7. sign in with Microsoft and confirm that Humind opens the account created by SCIM, then creates the SSO identity link without a duplicate.

“created in customappsso” message

During the first link, Entra can report that the user was created in customappsso. This means that the SCIM resource was created. If the address already belonged to a member of this company, Humind links that resource to the existing account instead of creating a duplicate.

Limits of Provision on demand

Microsoft's on-demand action provisions one user at a time. It does not validate the complete disabled, deleted, and unassigned lifecycle.

Second pass: Continuous provisioning

Start continuous provisioning with only one assigned disposable user. Then validate:

1. creation does not produce a duplicate when Entra retries;
2. a new user receives the configured default Humind role;
3. an existing member or pending invitation keeps their current Humind role;
4. disabling or unassigning the user removes access only to this company;
5. assigning or reactivating the same user restores access to the same account without a duplicate;
6. attempting to deprovision the company owner produces a clear error.

Check the result in:

• Settings > Company > Teammates;
• the Entra provisioning logs;
• the sign-in flow for the reactivated pilot.

See Check the status of user provisioning.

Only expand the assignment scope after all pilot checks pass.

Stop or roll back SCIM

To stop future synchronization:

1. stop the provisioning job in Humind B2B SCIM - Production;
2. select Disable SCIM in Humind to revoke the token.

Disabling SCIM preserves existing Humind accounts, memberships, invitations, roles, permissions, and history. It also removes the inactive SCIM lifecycle lock so those users can be managed manually again.

To rotate credentials, generate a new token in Humind, paste it into Entra, test the connection, then restart provisioning. The old token stops working as soon as it is rotated.

Troubleshooting

Test Connection fails

• Confirm that you pasted the current Tenant URL and token without leading or trailing spaces.
• If the token was rotated, replace the old token in Entra.
• Confirm that SCIM is still enabled in Humind.

The user is not in scope

• Confirm that the user is assigned directly or through an assigned group in Humind B2B SCIM - Production.
• Confirm that the scope is Sync only assigned users and groups.
• Allow time for Entra assignment changes to propagate.

Provisioning could create a duplicate

• Confirm that objectId maps to externalId.
• Remove any mailNickname to externalId mapping.
• Confirm that mail is populated and matches the expected work address.

A deprovisioning change is not visible

Provision on demand does not test the complete deprovisioning lifecycle. Start the limited continuous pilot and inspect the Entra provisioning logs.

The role remains Operator after selecting Supervisor in the SSO application

The former SSO roles were access labels only and never changed company authorization. Replace the legacy SSO assignment with Humind User. Then set the company role in Settings > Company > Teammates, or choose the expected default role before creating new users through SCIM.

Automatic provisioning is unavailable in Humind

Enable and save Microsoft sign-in first. Then complete a successful pilot login for every configured domain. Keep the same tenant and domains when generating the SCIM credentials.

Automatic provisioning is unavailable in the SSO application

This is expected for Humind B2B SSO - Production because Microsoft does not enable generic automatic provisioning on the service principal created from an OpenID Connect App registration. Create the separate non-gallery Humind B2B SCIM - Production application described in this guide.

Microsoft does not authorize sign-in

AADSTS50105 means that Microsoft blocked the user because assignment is required and the user is not assigned to Humind B2B SSO - Production. Assignment to the SCIM application does not replace this SSO assignment. Directly assign the user or an authorized group to the SSO application, then try again.

If the user is already assigned, confirm that no Conditional Access policy blocks them.

Humind says the user has not been invited

Without SCIM, invite the user or add them as a company member. With SCIM, confirm that the user's SCIM resource is active before their first Microsoft sign-in.

Return to password sign-in

The company owner or a Humind platform administrator can turn off Require Microsoft for this company, then save.

• Existing password-capable users can use their password again.
• Accounts created as SSO-only remain SSO-only.
• Humind roles and permissions stay unchanged.

To remove the Microsoft connection entirely, first disable enforcement and SCIM. Humind preserves the remaining accounts and company memberships.