Configure Microsoft Entra ID for Humind

This guide explains how to configure:

• single sign-on with Microsoft Entra ID;
• optional automatic user provisioning with SCIM 2.0.

Humind uses a multitenant Microsoft application managed by Humind. You do not need to create your own App registration.

Before you start

Prepare the following:

• owner access to the Humind company, or help from a Humind platform administrator;
• a Microsoft administrator who can grant tenant-wide consent and configure enterprise application provisioning;
• the Microsoft Entra tenant ID in GUID format;
• the work email domain or domains used by teammates;
• one or two pilot users;
• a dedicated disposable user for the full SCIM lifecycle test.

Microsoft Entra automatic provisioning and group assignment require an appropriate Microsoft Entra ID license, generally P1 or P2. Direct user assignment is sufficient for the initial pilot.

SSO, SCIM, and Humind permissions

These three responsibilities remain separate:

System	Responsibility
Microsoft Entra SSO	Proves the user's corporate identity when they sign in
Microsoft Entra SCIM	Creates, updates, disables, and reactivates users assigned to the enterprise application
Humind	Owns company membership, company ownership, roles, and the permission matrix

SCIM is optional. Enabling it does not disable manual Humind invitations and does not put every user in the Entra tenant in scope.

The generated Tenant URL contains /scim/v2 because Humind implements version 2.0 of the SCIM standard. This is not version 2 of the Humind provisioning feature.

Domains never grant access

Email domains only route sign-in to the correct tenant. Without SCIM, a user must already be a Humind company member or have a pending invitation. With SCIM, the user must first be actively provisioned into the company.

Part 1: Configure single sign-on

1. Find the tenant ID

1. Sign in to the Microsoft Entra admin center.
2. Open Entra ID > Overview > Properties.
3. Copy the Tenant ID. It is a GUID, for example 11111111-2222-3333-4444-555555555555.

Microsoft also documents this process in How to find your Microsoft Entra tenant ID.

2. Save the connection in Humind

1. Open Settings > Company > Single sign-on.
2. Select Microsoft Entra ID.
3. Paste the tenant ID.
4. Add the allowed work email domains, one per line and without @.
5. Turn on Allow Microsoft sign-in.
6. Keep Require Microsoft for this company turned off during the pilot.
7. Save.

Changing the tenant ID after a successful validation clears the validation and ends the affected teammates' sessions. You must then grant consent again if necessary and run a new pilot.

3. Grant administrator consent

In the Microsoft setup section in Humind:

1. Select Open admin consent.
2. Sign in with an administrator account from the configured tenant.
3. Check the application name and application ID.
4. Review the permissions, then accept them for the organization.

Humind requests only the OpenID Connect identity scopes openid, profile, and email. It does not request Microsoft Graph directory, mail, file, or group permissions.

See Grant tenant-wide admin consent to an application.

4. Assign the pilot users in Microsoft

1. In the Entra admin center, open Entra ID > Enterprise applications > All applications.
2. Search for Humind B2B SSO - Production. You can also use the application ID displayed in Humind.
3. Under Properties, set Assignment required? to Yes.
4. Open Users and groups > Add user/group.
5. Assign one or two pilot users directly.

See Assign a user or group to an enterprise application.

5. Prepare the Humind users

Until SCIM is enabled, every pilot user must already be a company member or have a pending Humind invitation.

In Settings > Company > Teammates, check that each pilot:

• uses the same work email in Humind and Microsoft;
• belongs to the expected company or has a pending invitation;
• has the expected Humind role.

6. Test every configured domain

For each email domain configured in Humind:

1. Return to Settings > Company > Single sign-on.
2. Select Test Microsoft login.
3. Sign in with the exact pilot email entered at the beginning of the test.
4. Check that Microsoft applies the expected MFA and Conditional Access policies.
5. Check that the user reaches the correct Humind company with the expected role.
6. Confirm that the domain is shown as verified.

Run at least one successful pilot for every configured domain. Humind unlocks SCIM credentials only when all current domains have been verified.

7. Require Microsoft sign-in, when ready

After the pilot succeeds:

1. Turn on Require Microsoft for this company.
2. Review the confirmation.
3. Save.

Humind then blocks password sign-in for this company and ends current company sessions. It preserves accounts, invitations, roles, permissions, and history.

Keep Microsoft optional during the SCIM pilot

Complete the SCIM creation, update, deprovisioning, and reactivation tests before requiring Microsoft sign-in for the whole company.

Part 2: Configure automatic SCIM provisioning

How existing users are handled

SCIM uses the immutable Entra objectId and the normalized work email to link users safely.

Situation before provisioning	Humind behavior
Existing member of this company	Links the existing account without a duplicate
Pending invitation to this company	Consumes the invitation and preserves its role
New user	Creates a password-disabled Humind account with the applicable role
Account that belongs only to another Humind company	Rejects provisioning until that account is explicitly invited to this company
Account invited here and already used in another company	Links the same global account and preserves the other company membership
Manual member or invitation outside Entra scope	Leaves it unchanged
Company owner disabled or unassigned in Entra	Returns an error until ownership is transferred

Deprovisioning removes only the membership of the company managed by this SCIM endpoint. It does not delete the global Humind account or memberships in other companies.

1. Generate the Tenant URL and token

In Settings > Company > Single sign-on:

1. Open Automatic user provisioning.
2. Choose the default Humind role.
3. Select Generate and enable.
4. Copy the Tenant URL and secret token immediately.

The default role is used when Entra does not send an application role for a new user, or when Entra explicitly removes the mapped role. An existing member or pending invitation keeps its current role when the SCIM request does not contain a role.

Store the token securely

Humind displays the raw token only once. Do not paste it into support tickets, chat messages, or logs. If it is lost or exposed, rotate it. Rotation immediately invalidates the previous token.

2. Create the Entra provisioning configuration

1. In the Entra admin center, open Enterprise applications > Humind B2B SSO - Production.
2. Open Provisioning.
3. Create a new automatic provisioning configuration.
4. Paste the Humind Tenant URL and secret token under Admin Credentials.
5. Select Test Connection.

A successful test confirms that Entra can authenticate to the company-specific Humind endpoint. As part of this test, Entra can query a user that does not exist. Humind returns an HTTP 200 response with an empty SCIM list, as expected by Microsoft.

See Provision users and groups with SCIM.

3. Configure the required attribute mappings

Under the user attribute mappings, configure these values explicitly:

Microsoft Entra attribute or expression	Humind SCIM attribute	Notes
objectId	externalId	Set externalId as the matching attribute
userPrincipalName	userName	Required
mail	emails[type eq "work"].value	Required; populate mail for every provisioned user
givenName	name.givenName	Required
surname	name.familyName	Required
Switch([IsSoftDeleted], , "False", "True", "True", "False")	active	Active unless the Entra object is soft-deleted

Delete the default mailNickname to externalId mapping if it is present. Humind requires the immutable Entra objectId, which is also the identity used during Microsoft sign-in.

Before the pilot, check that every user's mail attribute is populated and matches the work address expected in Humind.

4. Optionally manage Humind roles from Entra

To manage built-in Humind roles from Entra, add:

Microsoft Entra expression	Humind SCIM attribute
SingleAppRoleAssignment([appRoleAssignments])	roles[primary eq "True"].value

Humind exposes these application roles:

• Humind.Admin;
• Humind.Operator;
• Humind.Supervisor.

Assign at most one effective Humind application role to a user across direct and group assignments. Conflicting roles are rejected.

Role behavior is:

• a supported Entra role takes priority;
• an existing member or invitation role is preserved when Entra sends no role;
• an explicitly removed Entra role applies the configured default role;
• an unrelated update that omits roles preserves the current Humind role;
• an Entra role never demotes the company owner.

Custom Humind roles cannot currently be assigned from Entra.

5. Limit the provisioning scope

1. Keep Assignment required? set to Yes.
2. Set Scope to Sync only assigned users and groups.
3. Disable provisioning of group objects. Humind accepts user resources only.
4. Start with one directly assigned disposable user.

An assigned group can still define which users are in scope, but Humind does not create a corresponding group object.

Run a safe production pilot

The Humind SCIM endpoint is intentionally enabled only on the production API. Use a dedicated test company, assigned users, and disposable accounts. Do not require Microsoft sign-in during this pilot.

First pass: Provision on demand

Use Provision on demand to validate:

1. an existing company member is linked without a duplicate and keeps their role when no Entra role is sent;
2. a pending invitation is consumed without a duplicate and keeps its invitation role;
3. a new user receives a password-disabled account and the configured default role;
4. an account that belongs only to another Humind company is rejected until it is invited here;
5. a manual user outside the assigned scope remains unchanged.

Limits of Provision on demand

Microsoft's on-demand action provisions one user at a time. It does not validate application-role provisioning or the complete disabled, deleted, and unassigned lifecycle.

Second pass: Continuous provisioning

Start continuous provisioning with only one assigned disposable user. Then validate:

1. creation does not produce a duplicate when Entra retries;
2. assigning a supported application role updates the Humind role;
3. removing that application role applies the configured default role;
4. disabling or unassigning the user removes access only to this company;
5. assigning or reactivating the same user restores access to the same account without a duplicate;
6. attempting to deprovision the company owner produces a clear error.

Check the result in:

• Settings > Company > Teammates;
• the Entra provisioning logs;
• the sign-in flow for the reactivated pilot.

See Check the status of user provisioning.

Only expand the assignment scope after all pilot checks pass.

Stop or roll back SCIM

To stop future synchronization:

1. stop the Entra provisioning job;
2. select Disable SCIM in Humind to revoke the token.

Disabling SCIM preserves existing Humind accounts, memberships, invitations, roles, permissions, and history. It also removes the inactive SCIM lifecycle lock so those users can be managed manually again.

To rotate credentials, generate a new token in Humind, paste it into Entra, test the connection, then restart provisioning. The old token stops working as soon as it is rotated.

Troubleshooting

Test Connection fails

• Confirm that you pasted the current Tenant URL and token without leading or trailing spaces.
• If the token was rotated, replace the old token in Entra.
• Confirm that SCIM is still enabled in Humind.

The user is not in scope

• Confirm that the user is assigned directly or through an assigned group.
• Confirm that the scope is Sync only assigned users and groups.
• Allow time for Entra assignment changes to propagate.

Provisioning could create a duplicate

• Confirm that objectId maps to externalId.
• Remove any mailNickname to externalId mapping.
• Confirm that mail is populated and matches the expected work address.

A role update or deprovisioning is not visible

Provision on demand does not test roles or the complete deprovisioning lifecycle. Start the limited continuous pilot and inspect the Entra provisioning logs.

Automatic provisioning is unavailable in Humind

Enable and save Microsoft sign-in first. Then complete a successful pilot login for every configured domain. Keep the same tenant and domains when generating the SCIM credentials.

Microsoft does not authorize sign-in

Confirm that the user is assigned to the enterprise application and that no Conditional Access policy blocks them.

Humind says the user has not been invited

Without SCIM, invite the user or add them as a company member. With SCIM, confirm that the user's SCIM resource is active before their first Microsoft sign-in.

Return to password sign-in

The company owner or a Humind platform administrator can turn off Require Microsoft for this company, then save.

• Existing password-capable users can use their password again.
• Accounts created as SSO-only remain SSO-only.
• Humind roles and permissions stay unchanged.

To remove the Microsoft connection entirely, first disable enforcement and SCIM. Humind preserves the remaining accounts and company memberships.