Shortest Path
Most teams can configure Microsoft Entra ID with this flow:| Step | Where | What to do |
|---|---|---|
| 1 | ClosedLoop AI | Open Integrations > Microsoft Entra ID and click Copy setup sheet. |
| 2 | Microsoft Entra ID | Create a private Enterprise Application named ClosedLoop AI. |
| 3 | Microsoft Entra ID | Configure SAML with the Identifier, Reply URL, and Sign on URL from ClosedLoop AI. |
| 4 | ClosedLoop AI | Paste the Microsoft Entra Identifier, Login URL, and signing certificate, then save. |
| 5 | Microsoft Entra ID | Configure provisioning with the SCIM Tenant URL and Secret Token from ClosedLoop AI. |
| 6 | Microsoft Entra ID | Assign users and groups, then run Provision on demand for one test user. |
Send This to IT
If a separate identity admin owns Microsoft Entra ID, send them the setup sheet from ClosedLoop AI. It includes:- SAML Identifier, Reply URL, and Sign on URL.
- Required SAML attribute claim names.
- SCIM Tenant URL.
- Secret Token after you save the ClosedLoop AI setup.
- OAuth fallback fields only if the Entra provisioning screen asks for client credentials.
Recovery Path
Keep one ClosedLoop AI workspace owner signed in until SSO and provisioning tests pass. If a configuration change blocks sign-in, a signed-in workspace owner can return to Integrations > Microsoft Entra ID, turn off Enable Microsoft Entra ID sign-in, and save. If every workspace owner is locked out, contactsupport@closedloop.sh with your workspace ID and region. ClosedLoop AI support can help disable the broken SSO requirement for the workspace.
Prerequisites
- A Microsoft Entra ID admin account with permission to create Enterprise Applications.
- A ClosedLoop AI workspace admin account on the Enterprise plan.
- Your ClosedLoop AI workspace ID. ClosedLoop AI shows this value during setup.
- The correct ClosedLoop AI region for your workspace.
Region URLs
| Region | Login URL | API URL |
|---|---|---|
| US | https://app.closedloop.sh/auth | https://api.closedloop.sh |
| EU | https://eu.app.closedloop.sh/auth | https://eu.api.closedloop.sh |
What Microsoft Entra ID Manages
| Capability | Description |
|---|---|
| SAML SSO | Members sign in to ClosedLoop AI through Microsoft Entra ID. |
| Just-in-time provisioning | ClosedLoop AI can create a Member account after Microsoft Entra ID verifies the user. |
| SCIM 2.0 provisioning | Microsoft Entra ID can create, update, and deactivate users in a ClosedLoop AI workspace. |
| Group provisioning | Microsoft Entra ID can create groups and update group membership through SCIM. |
Setup Guide
Step 1: Open Microsoft Entra ID setup in ClosedLoop AI
Step 1: Open Microsoft Entra ID setup in ClosedLoop AI
- Sign in to ClosedLoop AI as a workspace admin.
- Go to Integrations > Microsoft Entra ID.
- Click Copy setup sheet if an identity admin will configure Entra for you.
- Keep this page open. You will copy generated SAML and SCIM values into Microsoft Entra ID.
Step 2: Create a non-gallery Enterprise Application
Step 2: Create a non-gallery Enterprise Application
- In Microsoft Entra admin center, go to Identity > Applications > Enterprise applications.
- Click New application.
- Click Create your own application.
- Set the name to ClosedLoop AI.
- Choose Integrate any other application you don’t find in the gallery.
- Create the application.
Step 3: Configure SAML single sign-on
Step 3: Configure SAML single sign-on
In the Enterprise Application, go to Single sign-on and choose SAML.
ClosedLoop AI starts sign-in from the email screen and then redirects the user to Microsoft Entra ID.
| Microsoft Entra ID field | Value |
|---|---|
| Identifier (Entity ID) | The Identifier from ClosedLoop AI |
| Reply URL (Assertion Consumer Service URL) | The Reply URL from ClosedLoop AI |
| Sign on URL | The Sign on URL from ClosedLoop AI |
| Relay State | Leave blank |
| Logout URL | Leave blank |
Step 4: Configure SAML attributes
Step 4: Configure SAML attributes
Use these SAML claims.
Download or copy the SAML signing certificate, then copy the Microsoft Entra Identifier and Login URL.
| Claim | Source attribute |
|---|---|
http://schemas.xmlsoap.org/ws/2005/05/identity/claims/emailaddress | user.mail or user.userprincipalname |
http://schemas.xmlsoap.org/ws/2005/05/identity/claims/givenname | user.givenname |
http://schemas.xmlsoap.org/ws/2005/05/identity/claims/surname | user.surname |
Step 5: Save Microsoft Entra ID values in ClosedLoop AI
Step 5: Save Microsoft Entra ID values in ClosedLoop AI
- Return to Integrations > Microsoft Entra ID in ClosedLoop AI.
- Paste the Microsoft Entra Identifier.
- Paste the Microsoft Entra Login URL.
- Paste the Microsoft Entra signing certificate.
- Keep Enable Microsoft Entra ID sign-in on.
- Keep JIT provisioning on if members should be created on first Microsoft Entra ID sign-in.
- Click Save Microsoft Entra ID setup.
Step 6: Configure SCIM provisioning
Step 6: Configure SCIM provisioning
In Microsoft Entra ID, open the ClosedLoop AI Enterprise Application and go to Provisioning.Use the standard Secret Token setup:
If your Microsoft Entra ID screen shows OAuth client credential fields instead of a Secret Token field, use the advanced fields from ClosedLoop AI:
Test the connection, then save the provisioning configuration.
| Microsoft Entra ID field | Value |
|---|---|
| Provisioning Mode | Automatic |
| Tenant URL | The SCIM Tenant URL from ClosedLoop AI |
| Secret Token | The generated ClosedLoop AI Secret Token |
| Microsoft Entra ID field | Value |
|---|---|
| Token endpoint | The SCIM OAuth token endpoint from ClosedLoop AI |
| Client ID | The generated ClosedLoop AI Client ID |
| Client secret | The generated ClosedLoop AI Client secret |
| Scope | scim.read scim.write |
Step 7: Assign users and groups
Step 7: Assign users and groups
Assign the users and groups who should access ClosedLoop AI to the Enterprise Application.Microsoft Entra ID provisions assigned users and groups into ClosedLoop AI. Users removed from the application are deactivated in the workspace.If Entra sends no role value for an existing user, ClosedLoop AI preserves that user’s current workspace role. This prevents an existing workspace admin from being downgraded during first provisioning.
Recommended Attribute Mapping
Use the default Microsoft Entra ID mappings unless your directory stores email somewhere else. Many Microsoft tenants useuserPrincipalName as the login name, but that value is not always the user’s mailbox address.
| ClosedLoop AI SCIM attribute | Recommended Microsoft Entra ID source |
|---|---|
userName | user.userprincipalname |
emails[type eq "work"].value | user.mail if populated, otherwise user.userprincipalname |
name.givenName | user.givenname |
name.familyName | user.surname |
displayName | user.displayname |
externalId | Microsoft Entra object ID, if available |
userName and work email as workspace-scoped identity aliases. If userName is a UPN such as person@tenant.onmicrosoft.com and work email is person@company.com, the user can still be matched safely during SAML sign-in.
Role Mapping
ClosedLoop AI supports two provisioned workspace roles:| SCIM role value | ClosedLoop AI role |
|---|---|
member | Member |
admin | Workspace admin |
roles, ClosedLoop AI keeps the user’s existing workspace role. New users are created as Member by default. Use role mapping only if Entra should actively manage ClosedLoop AI workspace admin/member assignments.
Supported SCIM Features
| Feature | Supported |
|---|---|
| Create users | Yes |
| Read users | Yes |
| Update users | Yes |
| Deactivate users | Yes |
| Group create/read/update/delete | Yes |
| Group membership PATCH | Yes |
| Change password | No |
SCIM /Bulk | No |
Testing
After configuration:- Assign one test user to the ClosedLoop AI Enterprise Application in Microsoft Entra ID.
- Run Provision on demand for that user or wait for the provisioning cycle.
- Open the ClosedLoop AI login URL for your region.
- Enter the test user’s email address.
- Confirm ClosedLoop AI redirects the user to Microsoft Entra ID.
- Complete sign-in and confirm the user returns to ClosedLoop AI.
- Remove the user assignment and confirm the user is deactivated in ClosedLoop AI if lifecycle deactivation is part of your rollout.
Troubleshooting
| Symptom | Fix |
|---|---|
| Test connection fails | Confirm the SCIM Tenant URL includes your ClosedLoop AI workspace ID and that the Secret Token was copied correctly after generation. |
| The user is not allowed into ClosedLoop AI | Confirm the user is assigned to the Enterprise Application, and JIT provisioning is enabled or the user already exists in the workspace. |
| ClosedLoop AI cannot match the user’s email | Confirm the SAML email claim is populated, and that SCIM sends both userName and work email when UPN differs from mailbox email. |
| Group membership does not appear | Confirm the user is assigned to the application and is a member of the pushed group in Microsoft Entra ID. |
| Users sign in but are not provisioned | Confirm Microsoft Entra ID provisioning is set to Automatic and that the user is assigned to the Enterprise Application. |
| SAML works but provisioning does not | Re-copy the SCIM Tenant URL and Secret Token from ClosedLoop AI. Use OAuth fields only if the Entra provisioning screen explicitly asks for them. |
| An admin became a member | Confirm Entra is not sending a member role entitlement for that user. If no role is sent, ClosedLoop AI preserves the existing role. |
| Workspace owners are locked out | Contact support@closedloop.sh with the workspace ID and region. |
Microsoft References
Support
For help configuring Microsoft Entra ID with ClosedLoop AI, contactsupport@closedloop.sh.
Open ClosedLoop AI US
Configure Microsoft Entra ID in a US workspace
Open ClosedLoop AI EU
Configure Microsoft Entra ID in an EU workspace