Shortest Path
Most teams can configure Microsoft Entra ID with this flow:Send This to IT
If a separate identity admin owns Microsoft Entra ID, send them the setup sheet from ClosedLoop AI. It includes:- SAML Identifier, Reply URL, and Sign on URL.
- Required SAML attribute claim names.
- SCIM Tenant URL.
- Secret Token after you save the ClosedLoop AI setup.
- OAuth fallback fields only if the Entra provisioning screen asks for client credentials.
Recovery Path
Keep one ClosedLoop AI workspace owner signed in until SSO and provisioning tests pass. If a configuration change blocks sign-in, a signed-in workspace owner can return to Integrations > Microsoft Entra ID, turn off Enable Microsoft Entra ID sign-in, and save. If every workspace owner is locked out, contactsupport@closedloop.sh with your workspace ID and region. ClosedLoop AI support can help disable the broken SSO requirement for the workspace.
Prerequisites
- A Microsoft Entra ID admin account with permission to create Enterprise Applications.
- A ClosedLoop AI workspace admin account on the Enterprise plan.
- Your ClosedLoop AI workspace ID. ClosedLoop AI shows this value during setup.
- The correct ClosedLoop AI region for your workspace.
Region URLs
What Microsoft Entra ID Manages
Setup Guide
Step 1: Open Microsoft Entra ID setup in ClosedLoop AI
Step 1: Open Microsoft Entra ID setup in ClosedLoop AI
- Sign in to ClosedLoop AI as a workspace admin.
- Go to Integrations > Microsoft Entra ID.
- Click Copy setup sheet if an identity admin will configure Entra for you.
- Keep this page open. You will copy generated SAML and SCIM values into Microsoft Entra ID.
Step 2: Create a non-gallery Enterprise Application
Step 2: Create a non-gallery Enterprise Application
- In Microsoft Entra admin center, go to Identity > Applications > Enterprise applications.
- Click New application.
- Click Create your own application.
- Set the name to ClosedLoop AI.
- Choose Integrate any other application you don’t find in the gallery.
- Create the application.
Step 3: Configure SAML single sign-on
Step 3: Configure SAML single sign-on
In the Enterprise Application, go to Single sign-on and choose SAML.
ClosedLoop AI starts sign-in from the email screen and then redirects the user to Microsoft Entra ID.
Step 4: Configure SAML attributes
Step 4: Configure SAML attributes
Use these SAML claims.
Download or copy the SAML signing certificate, then copy the Microsoft Entra Identifier and Login URL.
Step 5: Save Microsoft Entra ID values in ClosedLoop AI
Step 5: Save Microsoft Entra ID values in ClosedLoop AI
- Return to Integrations > Microsoft Entra ID in ClosedLoop AI.
- Paste the Microsoft Entra Identifier.
- Paste the Microsoft Entra Login URL.
- Paste the Microsoft Entra signing certificate.
- Keep Enable Microsoft Entra ID sign-in on.
- Keep JIT provisioning on if members should be created on first Microsoft Entra ID sign-in.
- Click Save Microsoft Entra ID setup.
Step 6: Configure SCIM provisioning
Step 6: Configure SCIM provisioning
In Microsoft Entra ID, open the ClosedLoop AI Enterprise Application and go to Provisioning.Use the standard Secret Token setup:
If your Microsoft Entra ID screen shows OAuth client credential fields instead of a Secret Token field, use the advanced fields from ClosedLoop AI:
Test the connection, then save the provisioning configuration.
Step 7: Assign users and groups
Step 7: Assign users and groups
Assign the users and groups who should access ClosedLoop AI to the Enterprise Application.Microsoft Entra ID provisions assigned users and groups into ClosedLoop AI. Users removed from the application are deactivated in the workspace.If Entra sends no role value for an existing user, ClosedLoop AI preserves that user’s current workspace role. This prevents an existing workspace admin from being downgraded during first provisioning.
Recommended Attribute Mapping
Use the default Microsoft Entra ID mappings unless your directory stores email somewhere else. Many Microsoft tenants useuserPrincipalName as the login name, but that value is not always the user’s mailbox address.
ClosedLoop AI stores both the SCIM
userName and work email as workspace-scoped identity aliases. If userName is a UPN such as person@tenant.onmicrosoft.com and work email is person@company.com, the user can still be matched safely during SAML sign-in.
Role Mapping
ClosedLoop AI supports two provisioned workspace roles:
If Microsoft Entra ID omits
roles, ClosedLoop AI keeps the user’s existing workspace role. New users are created as Member by default. Use role mapping only if Entra should actively manage ClosedLoop AI workspace admin/member assignments.
Supported SCIM Features
Testing
After configuration:- Assign one test user to the ClosedLoop AI Enterprise Application in Microsoft Entra ID.
- Run Provision on demand for that user or wait for the provisioning cycle.
- Open the ClosedLoop AI login URL for your region.
- Enter the test user’s email address.
- Confirm ClosedLoop AI redirects the user to Microsoft Entra ID.
- Complete sign-in and confirm the user returns to ClosedLoop AI.
- Remove the user assignment and confirm the user is deactivated in ClosedLoop AI if lifecycle deactivation is part of your rollout.
Troubleshooting
Microsoft References
Support
For help configuring Microsoft Entra ID with ClosedLoop AI, contactsupport@closedloop.sh.
Open ClosedLoop AI US
Configure Microsoft Entra ID in a US workspace
Open ClosedLoop AI EU
Configure Microsoft Entra ID in an EU workspace