What Microsoft Entra ID Manages
| Capability | Description |
|---|---|
| SAML SSO | Members sign in to ClosedLoop AI through Microsoft Entra ID. |
| Just-in-time provisioning | ClosedLoop AI can create a Member account after Microsoft Entra ID verifies the user. |
| SCIM 2.0 provisioning | Microsoft Entra ID can create, update, and deactivate users in a ClosedLoop AI workspace. |
| Group provisioning | Microsoft Entra ID can create groups and update group membership through SCIM. |
Prerequisites
- A Microsoft Entra ID admin account with permission to create Enterprise Applications.
- A ClosedLoop AI workspace admin account on the Enterprise plan.
- Your ClosedLoop AI workspace ID. ClosedLoop AI shows this value during setup.
- The correct ClosedLoop AI region for your workspace.
Region URLs
| Region | Login URL | API URL |
|---|---|---|
| US | https://app.closedloop.sh/auth | https://api.closedloop.sh |
| EU | https://eu.app.closedloop.sh/auth | https://eu.api.closedloop.sh |
Setup Guide
Step 1: Open Microsoft Entra ID setup in ClosedLoop AI
Step 1: Open Microsoft Entra ID setup in ClosedLoop AI
- Sign in to ClosedLoop AI as a workspace admin.
- Go to Integrations > Microsoft Entra ID.
- Keep this page open. You will copy the generated SAML and SCIM values into Microsoft Entra ID.
Step 2: Create a non-gallery Enterprise Application
Step 2: Create a non-gallery Enterprise Application
- In Microsoft Entra admin center, go to Identity > Applications > Enterprise applications.
- Click New application.
- Click Create your own application.
- Set the name to ClosedLoop AI.
- Choose Integrate any other application you don’t find in the gallery.
- Create the application.
Step 3: Configure SAML single sign-on
Step 3: Configure SAML single sign-on
In the Enterprise Application, go to Single sign-on and choose SAML.
ClosedLoop AI starts sign-in from the email screen and then redirects the user to Microsoft Entra ID.
| Microsoft Entra ID field | Value |
|---|---|
| Identifier (Entity ID) | The Identifier from ClosedLoop AI |
| Reply URL (Assertion Consumer Service URL) | The Reply URL from ClosedLoop AI |
| Sign on URL | The ClosedLoop AI login URL for your region |
| Relay State | Leave blank |
| Logout URL | Leave blank |
Step 4: Configure SAML attributes
Step 4: Configure SAML attributes
Use these SAML claims.
Download or copy the SAML signing certificate, then copy the Microsoft Entra Identifier and Login URL.
| Claim | Source attribute |
|---|---|
http://schemas.xmlsoap.org/ws/2005/05/identity/claims/emailaddress | user.mail or user.userprincipalname |
http://schemas.xmlsoap.org/ws/2005/05/identity/claims/givenname | user.givenname |
http://schemas.xmlsoap.org/ws/2005/05/identity/claims/surname | user.surname |
Step 5: Save Microsoft Entra ID values in ClosedLoop AI
Step 5: Save Microsoft Entra ID values in ClosedLoop AI
- Return to Integrations > Microsoft Entra ID in ClosedLoop AI.
- Paste the Microsoft Entra Identifier.
- Paste the Microsoft Entra Login URL.
- Paste the Microsoft Entra signing certificate.
- Keep Enable Microsoft Entra ID sign-in on.
- Keep JIT provisioning on if members should be created on first Microsoft Entra ID sign-in.
- Click Save Microsoft Entra ID setup.
Step 6: Configure SCIM provisioning
Step 6: Configure SCIM provisioning
In Microsoft Entra ID, open the ClosedLoop AI Enterprise Application and go to Provisioning.For a private non-gallery Enterprise Application, use the standard Secret Token setup:
If your Microsoft Entra ID screen shows OAuth client credential fields instead, use:
Test the connection, then save the provisioning configuration.
| Microsoft Entra ID field | Value |
|---|---|
| Provisioning Mode | Automatic |
| Tenant URL | The SCIM base URL from ClosedLoop AI |
| Secret Token | The generated ClosedLoop AI Secret Token |
| Microsoft Entra ID field | Value |
|---|---|
| Token endpoint | The SCIM OAuth token endpoint from ClosedLoop AI |
| Client ID | The generated ClosedLoop AI Client ID |
| Client secret | The generated ClosedLoop AI Client secret |
| Scope | scim.read scim.write |
Step 7: Assign users and groups
Step 7: Assign users and groups
Assign the users and groups who should access ClosedLoop AI to the Enterprise Application.Microsoft Entra ID provisions assigned users and groups into ClosedLoop AI. Users removed from the application are deactivated in the workspace.
Supported SCIM Features
| Feature | Supported |
|---|---|
| Create users | Yes |
| Read users | Yes |
| Update users | Yes |
| Deactivate users | Yes |
| Group create/read/update/delete | Yes |
| Group membership PATCH | Yes |
| Change password | No |
SCIM /Bulk | No |
userName value as the user’s email address. Use an email-formatted username in Microsoft Entra ID mappings.
Testing
After configuration:- Assign one test user to the ClosedLoop AI Enterprise Application in Microsoft Entra ID.
- Run Provision on demand or wait for the provisioning cycle.
- Open the ClosedLoop AI login URL for your region.
- Enter the test user’s email address.
- Confirm ClosedLoop AI redirects the user to Microsoft Entra ID.
- Complete sign-in and confirm the user returns to ClosedLoop AI.
Troubleshooting
| Symptom | Fix |
|---|---|
| Test connection fails | Confirm the SCIM base URL includes your ClosedLoop AI workspace ID and that the client secret was copied immediately after generation. |
| The user is not allowed into ClosedLoop AI | Confirm the user is assigned to the Enterprise Application, and JIT provisioning is enabled or the user already exists in the workspace. |
| ClosedLoop AI cannot match the user’s email | Confirm the email claim and SCIM userName mapping use an email address. |
| Group membership does not appear | Confirm the user is assigned to the application and is a member of the pushed group in Microsoft Entra ID. |
Support
For help configuring Microsoft Entra ID with ClosedLoop AI, contactsupport@closedloop.sh.
Open ClosedLoop AI US
Configure Microsoft Entra ID in a US workspace
Open ClosedLoop AI EU
Configure Microsoft Entra ID in an EU workspace