Microsoft Entra

Connect Microsoft Entra to emisar: an app registration signs people in with the oid claim, and a separate enterprise application provisions the directory.

The sections below build two objects in order — sign-in first, then the directory.

Single sign-on#

Connecting an identity provider is a paid feature. Only available on Team & Enterprise.

1. 1

   In emisar

   Start the connection.

   Open Team → Single sign-on → Add provider and choose Microsoft Entra ID. Leave the page open: the callback URL on it is what Entra asks for next, and Entra's values come back here at the end.

   emisar · Add provider

   Expand

2. 2

   In Entra

   Register the application.

   In the Microsoft Entra admin center go to App registrations → New registration. Under Redirect URI choose the Web platform and enter emisar's callback:

   Redirect URI Copy

   https://emisar.dev/sign_in/sso/callback

   Microsoft Entra admin center · Register an application

   Expand

3. 3

   In Entra

   Create a client secret.

   Certificates & secrets → New client secret. Copy the Value column, not Secret ID — the value is shown once and is unrecoverable afterwards.

   Microsoft Entra · Certificates & secrets

   Expand

4. 4

   In Entra

   Copy the client and tenant IDs.

   The registration's Overview blade carries both values emisar needs to identify your tenant: Application (client) ID is the client ID, and Directory (tenant) ID is what goes into the issuer URL.

   Microsoft Entra · App registration overview

   Expand

5. 5

   In emisar

   Paste them into the connection.

   Back on the connection you opened in step 1, the client ID is the Application (client) ID and the secret is the one from step 3. Build the issuer from your tenant ID:

   Issuer URL Copy

   https://login.microsoftonline.com/YOUR-TENANT-ID/v2.0

   The trailing /v2.0 is what selects Entra's v2.0 endpoint; without it you get v1.0 tokens. The identifier claim already reads oid — Entra hands every application a different sub, so oid is the only id that also matches what directory sync sends. Tick Enabled, save, and sign in.

   emisar · Add provider

   Expand

Directory sync#

Sign-in is above and stands on its own. This half is what makes Entra the authority on who exists: it provisions people into emisar and, the part that matters on an offboard, removes their access when the directory says they are gone. Only available on Enterprise.

You need the connection's SCIM base URL and bearer token — enabling directory sync shows where both come from.

1. 1

   In Entra

   Create the enterprise application.

   Provisioning does not live on the app registration you made for sign-in — it needs a separate object. Go to Enterprise applications → New application → Create your own application, name it emisar, and choose Integrate any other application you don't find in the gallery.

   Microsoft Entra · Browse App Gallery

   Expand

2. 2

   In Entra

   Point it at emisar.

   On the new application's Provisioning blade set Provisioning Mode to Automatic, then fill in the two values emisar gave you — the SCIM base URL as Tenant URL and the bearer as Secret Token:

   Tenant URL Copy

   https://emisar.dev/scim/v2

   Microsoft Entra · Enterprise application provisioning

   Expand

   Press Test Connection. Entra probes the endpoint for a user that cannot exist, using a random GUID, and expects an empty result rather than an error — emisar answers that correctly, so a failure here means the URL or the token is wrong, not the schema. Save.

   Microsoft Entra · New provisioning configuration

   Expand

3. 3

   In Entra

   Remap externalId to objectId.

   Open Manage → Attribute mapping and change the source attribute feeding externalId from mailNickname to objectId. On a tenant still using Entra's older provisioning screens, the same setting lives under Mappings → Provision Microsoft Entra ID Users.

   Microsoft Entra · Attribute mapping

   Expand

   Microsoft Entra · Edit Attribute Mapping

   Expand

   Do not skip this. Entra's default is mailNickname, which is not guaranteed to exist, is not guaranteed to be unique, and can change — and it is not the value your sign-in connection identifies people by. With oid on the SSO side and mailNickname here, the same person arrives as two different identities: one provisioned by the directory, one created when they sign in. objectId is the same immutable id the oid claim carries, so the two halves converge.

4. 4

   In Entra

   Assign the people to sync.

   Under Users and groups, assign whoever should exist in emisar. Then, on Provisioning → Settings, set Scope to Sync only assigned users and groups and turn Provisioning Status on. Scope is a separate choice from the assignment, and it defaults to syncing everyone — leave it there and Entra pushes your whole directory into emisar no matter who you assigned. Entra syncs on its own schedule — roughly every 40 minutes — so the first members appear under Synced users on the emisar connection after that cycle, not instantly. Their Entra groups become mappable to roles below.

   Entra · Users and groups

   Expand

Next: map directory groups to emisar roles so access follows your IdP — role mapping.