Skip to content
English
Sign in
Contact us
  • There are no suggestions because the search field is empty.

How do I set up SAML and SCIM for Microsoft Entra ID?

This guide walks you through connecting Moxso to Microsoft Entra ID using SAML (single sign-on) and SCIM (automated user provisioning). You'll set up both in a single enterprise application.

SAML lets your admins and employees log into Moxso using their Microsoft Entra ID credentials. No separate Moxso password required.

SCIM keeps your Moxso users and groups in sync with Microsoft Entra ID automatically. When someone joins, changes departments, or leaves your organization, Entra ID pushes those changes to Moxso without any manual work.

Enabling SCIM makes user and group management in Moxso read-only. Once SCIM is active, you can no longer add or edit users manually, and you can no longer manage groups directly in Moxso. All user and group management must happen in Microsoft Entra ID. Make sure your Entra ID directory is accurate before you enable SCIM.

 

How it works

The setup has two parts that build on each other. SAML handles authentication (how admins log in) and SCIM handles provisioning (how users and groups stay up to date). Both are configured within the same enterprise application in Microsoft Entra ID.

Before you begin

Check the following before starting:

  • Your organization's domains are verified in Moxso. Go to Settings and check the Verified domains section. Domains must show a Verified status. Moxso only syncs users whose email addresses match a verified domain.
  • You've decided which Entra ID users or groups to sync. We recommend starting with a small test group to verify the setup before rolling it out to everyone.

Part 1: Set up SAML

Step 1: Start the SAML provider setup in Moxso

  1. In Moxso, go to Settings > SAML single sign-on.
  2. Click Add provider.
  3. Under Require SAML for, select Admin users.
  4. Enter a Name for the provider, for example Microsoft Entra ID.
  5. Set Provider to Microsoft Entra ID.
  6. Scroll down to SAML configuration.

Copy the following values. You'll need them in the next step:

Value

Where it goes in Microsoft Entra ID

Metadata URL

Identifier (Entity ID)

ACS URL

Reply URL (Assertion Consumer Service URL)

Login URL

Sign on URL

Leave the form open. You'll return to it shortly.

SAML Initial Setup Screen

Step 2: Create the Moxso app in Microsoft Entra ID

  1. In the Microsoft Entra admin center, go to Entra ID > Enterprise apps.
  2. Click New application.
  3. Click Create your own application.
  4. Enter a name, for example Moxso.
  5. Select Integrate any other application you don't find in the gallery (Non-gallery).
  6. Click Create.

Entra create your own app

Step 3: Configure SAML in Microsoft Entra ID

  1. In the Moxso app, go to Single sign-on in the left panel.
  2. Select SAML.
  3. Under Basic SAML Configuration, click Edit.
  4. Enter the following values:
    • Identifier (Entity ID): paste the Metadata URL from Moxso.
    • Reply URL (Assertion Consumer Service URL): paste the ACS URL from Moxso.
    • Sign on URL: paste the Login URL from Moxso.
  5. Click Save.

Entra saml config

Step 4: Get the App Federation Metadata URL from Microsoft Entra ID

  1. On the SAML-based Sign-on page, scroll down to SAML Certificates.
  2. Copy the App Federation Metadata URL.

Step 5: Complete the SAML setup in Moxso

  1. Go back to the Add provider form you opened in step 1.
  2. Scroll down to Create from metadata URL.
  3. Paste the App Federation Metadata URL into the App federation metadata URL field. Using the metadata URL is the recommended method. Moxso fetches the IdP entity ID, login URL, and certificate automatically, which reduces the chance of configuration errors.
  4. Click Fetch metadata.
  5. Toggle Enable provider on.
  6. Click Save provider.

To set up SSO for employees (Hub users in Moxso), repeat steps 1 to 5 and select Hub users instead of Admin users in step 1.

Part 2: Set up SCIM

Step 6: Assign users or groups in Microsoft Entra ID

  1. In the Moxso app in the Microsoft Entra admin center, go to Users and groups in the left panel.
  2. Click Add user/group.
  3. Select the users or groups you want to sync and click Select.
  4. Click Assign.

 

For your first sync, assign a small test group. Two or three users is enough. Verify they appear correctly in Moxso before assigning everyone.

Step 7: Create a SCIM connection in Moxso

  1. In Moxso, go to Settings > SCIM connections.
  2. Click Create connection.
  3. Enter a Connection name, for example Microsoft Entra ID.
  4. Set Provider to Microsoft Entra ID.
  5. Select Admin user.
  6. Turn Enabled on.
  7. Click Create connection.

The Provisioning endpoint section now shows your Tenant URL:

https://api.moxso.com/scim/v2

Keep this page open.

Step 8: Generate a SCIM token

Microsoft Entra ID needs a token to authenticate with Moxso.

  1. Scroll down to the SCIM provisioning tokens section on the same page.
  2. Click Create token.
  3. Enter a token name, for example Microsoft Entra ID provisioning.
  4. Click Create token.

A SCIM token created dialog appears with your secret token.

Copy this token now. It's only shown once. If you close this dialog without copying the token, you'll need to delete it and create a new one.

Copy the token and store it somewhere you can access in the next step.

Moxso SCIM Create TOken screen

Step 9: Configure SCIM in Microsoft Entra ID

  1. In the Moxso app in the Microsoft Entra admin center, go to Provisioning in the left panel.
  2. Click New configuration.
  3. Under Admin credentials, fill in the following:
    • Select authentication method: select Bearer authentication.
    • Tenant URL: https://api.moxso.com/scim/v2
    • Secret token: paste the token you copied in step 8.
  4. Click Test connection to verify the connection works.
  5. Click Create.

Entra scim admin credentials

Step 10: Update attribute mapping

By default, Microsoft Entra ID maps externalId to id. You need to change this to objectId.

  1. In the Moxso app, go to Provisioning > Attribute mapping in the left panel.
  2. Under Attribute Mappings, find the row where the customappsso Attribute column shows externalId.
  3. Click Edit on that row.
  4. Change the Microsoft Entra ID Attribute value to objectId.
  5. Click Save.

Entra attribute mapping

Step 11: Start provisioning

  1. In the Moxso app, go to Provisioning > Overview in the left panel.
  2. Click Start provisioning.

The first sync runs in the background. Once complete, go to User management in Moxso to confirm your test users appear with the correct attributes.

To set up provisioning for employees, repeat steps 7 to 11 and select Employee instead of Admin user in step 7.

Sync schedule

After the first sync, Microsoft Entra ID pushes changes to Moxso automatically, typically every 40 minutes. You can trigger a manual sync at any time using Provision on demand in the Microsoft Entra admin center.

Common questions

What happens to existing Moxso users when I first enable SCIM?
 Users whose email addresses match users in Microsoft Entra ID are linked automatically. Users who exist in Moxso but not in Entra ID remain as-is until you deactivate or remove them manually. Once SCIM is enabled you'll need to manage that from Microsoft Entra ID.

Can I use SAML without SCIM?
 Yes. SAML for admin login and SCIM for provisioning are independent. You can set up SAML alone if you want single sign-on without automated user sync.

What happens if I disable the SCIM connection?
 Disabling the SCIM connection restores manual user and group management in Moxso. Existing users are not removed. Future changes in Microsoft Entra ID will no longer sync until you re-enable it.

A user changed their department in Microsoft Entra ID. Does that update in Moxso?
 Yes, if provisioning is active. The change syncs on the next automatic or manual sync.

Can I prevent specific users from being managed by SCIM?
 Not at the individual user level. SCIM manages all users assigned to the Moxso app in Microsoft Entra ID. To exclude a user, remove them from the app assignment.