​
Overview

Connect your fileAI workspace to Microsoft Entra ID (formerly Azure AD) so your team signs in with the Microsoft work account they already use. Passwords, MFA and Conditional Access stay in your Entra tenant. fileAI never sees a password. You can also turn on SCIM provisioning, so Entra sends your groups to fileAI and you can decide which group gets which fileAI role.

Single sign-on

Staff sign in with Sign in with Microsoft Entra. No separate fileAI password.

Your security policies apply

Your MFA and Conditional Access rules run on every sign-in.

Group-based roles

Map Entra groups to the fileAI Admin or Participant role.

Nothing stored from Microsoft

fileAI keeps no Microsoft tokens. Sign-in creates a normal fileAI session.

​
Before you start

You need two people, or one person who is both:
The Entra admin approval in step 3 opens in the fileAI Owner’s browser. If the Owner is not an Entra admin, do steps 2 to 4 together on a call so the Entra admin can sign in on the Microsoft page when it appears.
Use the fileAI site for your region throughout:

​
Part 1: Connect your workspace

1

Copy your Tenant ID from Microsoft Entra

Sign in to the Microsoft Entra admin center and open Identity > Overview. Copy the Tenant ID.It looks like xxxxxxxx-xxxx-xxxx-xxxx-xxxxxxxxxxxx.
2

Open your workspace settings in fileAI

Sign in to fileAI as the workspace Owner. Click the workspace name at the top left, then Settings > Details.Under Microsoft Entra Integration, click Connect to Microsoft Entra.
3

Enter the Tenant ID and approve on Microsoft

Paste the Tenant ID and continue. You are taken to a Microsoft Permissions requested page.The Entra admin signs in on this page (use Use another account if needed) and clicks Accept. This approves fileAI once for everyone in your organisation, so your staff will not see a consent screen.
4

Check that it says Connected

Microsoft sends you back to Settings > Details. Microsoft Entra Integration now shows Connected.The Owner also sees a new Microsoft Entra SCIM Provisioning section with a SCIM Tenant URL and SCIM Secret token. You only need these for Part 3.

​
Part 2: Sign in

Anyone in your Entra tenant can now open your region’s sign-in page and click Sign in with Microsoft Entra.
  1. Pick your work account on the Microsoft screen.
  2. Complete your password and MFA as usual.
  3. You land in the fileAI dashboard.
The first sign-in creates the person’s fileAI account and adds them to your workspace as a Participant, unless their Entra group is mapped to Admin (see Part 4).
Sign in with Microsoft Entra is for connected workspaces. Sign in with Microsoft SSO is a plain Microsoft account login and does not join anyone to your workspace.

​
Part 3: Turn on SCIM provisioning (optional)

SCIM sends your Entra groups to fileAI so you can map them to roles in Part 4. Do this in the Microsoft Entra admin center, as an Entra admin.
1

Create an enterprise application for fileAI

Go to Identity > Applications > Enterprise applications > New application > Create your own application.Enter a name such as fileAI SCIM, choose Integrate any other application you don’t find in the gallery (Non-gallery), and click Create.
2

Assign users and groups

In the new application, open Users and groups > Add user/group. Add the groups you want fileAI to know about.
3

Connect provisioning to fileAI

Open Provisioning and click Connect your application (or Get started). Set provisioning mode to Automatic if asked.Copy the SCIM Tenant URL and SCIM Secret token from fileAI (Settings > Details, Owner only) into Tenant URL and Secret token. Click Test connection, then Create (or Save).
4

Start provisioning

On the provisioning overview, click Start provisioning.The first cycle usually takes 10 to 20 minutes. After that, Entra syncs about every 40 minutes. Check progress under Provisioning logs.
Treat the SCIM Secret token like a password. Paste it only into Microsoft Entra, and never share it by email or chat.

​
Part 4: Map Entra groups to fileAI roles

Once SCIM has sent your groups, go to fileAI Settings > Details and click Map user roles. For each Entra group, choose Admin or Participant and save. Roles are applied when a person signs in. Anyone not in a group mapped to Admin joins as Participant. If you see User roles unavailable, please proceed with SCIM provisioning, finish Part 3 and wait for the first provisioning cycle.

​
Removing access

Blocking or deleting a user in Microsoft Entra stops them from signing in to fileAI with Microsoft. To remove them from your workspace as well, go to Settings > Members in fileAI and remove them.

​
Troubleshooting

The ID was mistyped or copied from the wrong place. Copy the Tenant ID from Identity > Overview in the Entra admin center. Do not use a domain name or an application ID.
One Entra tenant can be connected to one fileAI workspace per region. Contact fileAI support if you need to move it to a different workspace.
The person who signed in on the Microsoft page is not an Entra admin. Repeat Part 1 and have someone with one of the admin roles listed in Before you start sign in on that page.
The Microsoft approval was cancelled or not finished. Click Connect to Microsoft Entra again and complete the approval.
The person’s Entra tenant is not connected to a fileAI workspace in this region, or the sign-in took too long. Check you are on the right regional sign-in page, then try again. If it keeps happening, ask your workspace Owner to confirm Part 1 shows Connected.
Copy the SCIM Tenant URL and SCIM Secret token again from fileAI, with no extra spaces, and retry. If it still fails, send the error message to fileAI support.