> ## Documentation Index
> Fetch the complete documentation index at: https://closedloop.sh/docs/llms.txt
> Use this file to discover all available pages before exploring further.

# Microsoft Entra ID

> Connect Microsoft Entra ID to ClosedLoop AI with SAML SSO and SCIM provisioning.

Connect Microsoft Entra ID to ClosedLoop AI so workspace members sign in through your Microsoft identity provider and admins can manage user lifecycle from Entra.

<Tip>Use the ClosedLoop AI values generated inside your workspace. They are region-aware and include the correct workspace ID.</Tip>

## What Microsoft Entra ID Manages

| Capability                | Description                                                                               |
| ------------------------- | ----------------------------------------------------------------------------------------- |
| SAML SSO                  | Members sign in to ClosedLoop AI through Microsoft Entra ID.                              |
| Just-in-time provisioning | ClosedLoop AI can create a Member account after Microsoft Entra ID verifies the user.     |
| SCIM 2.0 provisioning     | Microsoft Entra ID can create, update, and deactivate users in a ClosedLoop AI workspace. |
| Group provisioning        | Microsoft Entra ID can create groups and update group membership through SCIM.            |

## Prerequisites

* A Microsoft Entra ID admin account with permission to create Enterprise Applications.
* A ClosedLoop AI workspace admin account on the Enterprise plan.
* Your ClosedLoop AI workspace ID. ClosedLoop AI shows this value during setup.
* The correct ClosedLoop AI region for your workspace.

## Region URLs

| Region | Login URL                           | API URL                        |
| ------ | ----------------------------------- | ------------------------------ |
| US     | `https://app.closedloop.sh/auth`    | `https://api.closedloop.sh`    |
| EU     | `https://eu.app.closedloop.sh/auth` | `https://eu.api.closedloop.sh` |

## Setup Guide

<AccordionGroup>
  <Accordion icon="key-round" title="Step 1: Open Microsoft Entra ID setup in ClosedLoop AI">
    1. Sign in to ClosedLoop AI as a workspace admin.
    2. Go to **Integrations** > **Microsoft Entra ID**.
    3. Keep this page open. You will copy the generated SAML and SCIM values into Microsoft Entra ID.
  </Accordion>

  <Accordion icon="building" title="Step 2: Create a non-gallery Enterprise Application">
    1. In Microsoft Entra admin center, go to **Identity** > **Applications** > **Enterprise applications**.
    2. Click **New application**.
    3. Click **Create your own application**.
    4. Set the name to **ClosedLoop AI**.
    5. Choose **Integrate any other application you don't find in the gallery**.
    6. Create the application.
  </Accordion>

  <Accordion icon="shield-check" title="Step 3: Configure SAML single sign-on">
    In the Enterprise Application, go to **Single sign-on** and choose **SAML**.

    | Microsoft Entra ID field                   | Value                                       |
    | ------------------------------------------ | ------------------------------------------- |
    | Identifier (Entity ID)                     | The **Identifier** from ClosedLoop AI       |
    | Reply URL (Assertion Consumer Service URL) | The **Reply URL** from ClosedLoop AI        |
    | Sign on URL                                | The ClosedLoop AI login URL for your region |
    | Relay State                                | Leave blank                                 |
    | Logout URL                                 | Leave blank                                 |

    ClosedLoop AI starts sign-in from the email screen and then redirects the user to Microsoft Entra ID.
  </Accordion>

  <Accordion icon="users" title="Step 4: Configure SAML attributes">
    Use these SAML claims.

    | Claim                                                                | Source attribute                        |
    | -------------------------------------------------------------------- | --------------------------------------- |
    | `http://schemas.xmlsoap.org/ws/2005/05/identity/claims/emailaddress` | `user.mail` or `user.userprincipalname` |
    | `http://schemas.xmlsoap.org/ws/2005/05/identity/claims/givenname`    | `user.givenname`                        |
    | `http://schemas.xmlsoap.org/ws/2005/05/identity/claims/surname`      | `user.surname`                          |

    Download or copy the SAML signing certificate, then copy the Microsoft Entra **Identifier** and **Login URL**.
  </Accordion>

  <Accordion icon="save" title="Step 5: Save Microsoft Entra ID values in ClosedLoop AI">
    1. Return to **Integrations** > **Microsoft Entra ID** in ClosedLoop AI.
    2. Paste the Microsoft Entra **Identifier**.
    3. Paste the Microsoft Entra **Login URL**.
    4. Paste the Microsoft Entra signing certificate.
    5. Keep **Enable Microsoft Entra ID sign-in** on.
    6. Keep **JIT provisioning** on if members should be created on first Microsoft Entra ID sign-in.
    7. Click **Save Microsoft Entra ID setup**.

    ClosedLoop AI generates the SCIM client ID and client secret after saving.
  </Accordion>

  <Accordion icon="refresh-cw" title="Step 6: Configure SCIM provisioning">
    In Microsoft Entra ID, open the ClosedLoop AI Enterprise Application and go to **Provisioning**.

    For a private non-gallery Enterprise Application, use the standard Secret Token setup:

    | Microsoft Entra ID field | Value                                        |
    | ------------------------ | -------------------------------------------- |
    | Provisioning Mode        | `Automatic`                                  |
    | Tenant URL               | The **SCIM base URL** from ClosedLoop AI     |
    | Secret Token             | The generated ClosedLoop AI **Secret Token** |

    If your Microsoft Entra ID screen shows OAuth client credential fields instead, use:

    | Microsoft Entra ID field | Value                                                |
    | ------------------------ | ---------------------------------------------------- |
    | Token endpoint           | The **SCIM OAuth token endpoint** from ClosedLoop AI |
    | Client ID                | The generated ClosedLoop AI **Client ID**            |
    | Client secret            | The generated ClosedLoop AI **Client secret**        |
    | Scope                    | `scim.read scim.write`                               |

    Test the connection, then save the provisioning configuration.
  </Accordion>

  <Accordion icon="users" title="Step 7: Assign users and groups">
    Assign the users and groups who should access ClosedLoop AI to the Enterprise Application.

    Microsoft Entra ID provisions assigned users and groups into ClosedLoop AI. Users removed from the application are deactivated in the workspace.
  </Accordion>
</AccordionGroup>

## Supported SCIM Features

| Feature                         | Supported |
| ------------------------------- | --------- |
| Create users                    | Yes       |
| Read users                      | Yes       |
| Update users                    | Yes       |
| Deactivate users                | Yes       |
| Group create/read/update/delete | Yes       |
| Group membership PATCH          | Yes       |
| Change password                 | No        |
| SCIM `/Bulk`                    | No        |

ClosedLoop AI uses the SCIM `userName` value as the user's email address. Use an email-formatted username in Microsoft Entra ID mappings.

## Testing

After configuration:

1. Assign one test user to the ClosedLoop AI Enterprise Application in Microsoft Entra ID.
2. Run **Provision on demand** or wait for the provisioning cycle.
3. Open the ClosedLoop AI login URL for your region.
4. Enter the test user's email address.
5. Confirm ClosedLoop AI redirects the user to Microsoft Entra ID.
6. Complete sign-in and confirm the user returns to ClosedLoop AI.

## Troubleshooting

| Symptom                                     | Fix                                                                                                                                      |
| ------------------------------------------- | ---------------------------------------------------------------------------------------------------------------------------------------- |
| Test connection fails                       | Confirm the SCIM base URL includes your ClosedLoop AI workspace ID and that the client secret was copied immediately after generation.   |
| The user is not allowed into ClosedLoop AI  | Confirm the user is assigned to the Enterprise Application, and JIT provisioning is enabled or the user already exists in the workspace. |
| ClosedLoop AI cannot match the user's email | Confirm the email claim and SCIM `userName` mapping use an email address.                                                                |
| Group membership does not appear            | Confirm the user is assigned to the application and is a member of the pushed group in Microsoft Entra ID.                               |

## Support

For help configuring Microsoft Entra ID with ClosedLoop AI, contact `support@closedloop.sh`.

<CardGroup cols={2}>
  <Card title="Open ClosedLoop AI US" icon="log-in" href="https://app.closedloop.sh/integrations/microsoft-entra-id">
    Configure Microsoft Entra ID in a US workspace
  </Card>

  <Card title="Open ClosedLoop AI EU" icon="log-in" href="https://eu.app.closedloop.sh/integrations/microsoft-entra-id">
    Configure Microsoft Entra ID in an EU workspace
  </Card>
</CardGroup>