# Microsoft Entra ID (SSO and SCIM) Source: https://docs.file.ai/docs-user-guide/account/microsoft-entra-id > Let your team sign in to fileAI with their Microsoft work accounts, and sync Entra groups to fileAI roles. ## On this page * [Overview](#overview) * [Before you start](#before-you-start) * [Part 1: Connect your workspace](#part-1-connect-your-workspace) * [Part 2: Sign in](#part-2-sign-in) * [Part 3: Turn on SCIM provisioning (optional)](#part-3-turn-on-scim-provisioning-optional) * [Part 4: Map Entra groups to fileAI roles](#part-4-map-entra-groups-to-fileai-roles) * [Removing access](#removing-access) * [Troubleshooting](#troubleshooting) Account # Microsoft Entra ID (SSO and SCIM) Copy pageCopy page Let your team sign in to fileAI with their Microsoft work accounts, and sync Entra groups to fileAI roles. Copy pageCopy page ## [​ ](#overview) Overview Connect your fileAI workspace to **Microsoft Entra ID** (formerly Azure AD) so your team signs in with the Microsoft work account they already use. Passwords, MFA and Conditional Access stay in your Entra tenant. fileAI never sees a password. You can also turn on **SCIM provisioning**, so Entra sends your groups to fileAI and you can decide which group gets which fileAI role. ## Single sign-on Staff sign in with **Sign in with Microsoft Entra**. No separate fileAI password. ## Your security policies apply Your MFA and Conditional Access rules run on every sign-in. ## Group-based roles Map Entra groups to the fileAI **Admin** or **Participant** role. ## Nothing stored from Microsoft fileAI keeps no Microsoft tokens. Sign-in creates a normal fileAI session. ## [​ ](#before-you-start) Before you start You need two people, or one person who is both: Who Why **fileAI workspace Owner** Only the Owner can connect the workspace and see the SCIM token. **Microsoft Entra admin** Must approve fileAI for your whole organisation. Roles that can do this: **Global Administrator**, **Privileged Role Administrator**, **Cloud Application Administrator** or **Application Administrator**. The Entra admin approval in step 3 opens in the **fileAI Owner’s browser**. If the Owner is not an Entra admin, do steps 2 to 4 together on a call so the Entra admin can sign in on the Microsoft page when it appears. Use the fileAI site for your region throughout: Region Sign-in page United States [orion.file.ai](https://orion.file.ai) Singapore [orion.sg.file.ai](https://orion.sg.file.ai) Australia [orion.au.file.ai](https://orion.au.file.ai) Japan [orion.jp.file.ai](https://orion.jp.file.ai) ## [​ ](#part-1-connect-your-workspace) Part 1: Connect your workspace 1 Copy your Tenant ID from Microsoft Entra Sign in to the [Microsoft Entra admin center](https://entra.microsoft.com) and open **Identity** > **Overview**. Copy the **Tenant ID**.It looks like `xxxxxxxx-xxxx-xxxx-xxxx-xxxxxxxxxxxx`. 2 Open your workspace settings in fileAI Sign in to fileAI as the workspace **Owner**. Click the workspace name at the top left, then **Settings** > **Details**.Under **Microsoft Entra Integration**, click **Connect to Microsoft Entra**. 3 Enter the Tenant ID and approve on Microsoft Paste the Tenant ID and continue. You are taken to a Microsoft **Permissions requested** page.The **Entra admin** signs in on this page (use **Use another account** if needed) and clicks **Accept**. This approves fileAI once for everyone in your organisation, so your staff will not see a consent screen. 4 Check that it says Connected Microsoft sends you back to **Settings** > **Details**. **Microsoft Entra Integration** now shows **Connected**.The Owner also sees a new **Microsoft Entra SCIM Provisioning** section with a **SCIM Tenant URL** and **SCIM Secret token**. You only need these for Part 3. ## [​ ](#part-2-sign-in) Part 2: Sign in Anyone in your Entra tenant can now open your region’s sign-in page and click **Sign in with Microsoft Entra**. 1. Pick your work account on the Microsoft screen. 2. Complete your password and MFA as usual. 3. You land in the fileAI dashboard. The first sign-in creates the person’s fileAI account and adds them to your workspace as a **Participant**, unless their Entra group is mapped to **Admin** (see Part 4). **Sign in with Microsoft Entra** is for connected workspaces. **Sign in with Microsoft SSO** is a plain Microsoft account login and does not join anyone to your workspace. ## [​ ](#part-3-turn-on-scim-provisioning-optional) Part 3: Turn on SCIM provisioning (optional) SCIM sends your Entra **groups** to fileAI so you can map them to roles in Part 4. Do this in the Microsoft Entra admin center, as an Entra admin. 1 Create an enterprise application for fileAI Go to **Identity** > **Applications** > **Enterprise applications** > **New application** > **Create your own application**.Enter a name such as `fileAI SCIM`, choose **Integrate any other application you don’t find in the gallery (Non-gallery)**, and click **Create**. 2 Assign users and groups In the new application, open **Users and groups** > **Add user/group**. Add the groups you want fileAI to know about. 3 Connect provisioning to fileAI Open **Provisioning** and click **Connect your application** (or **Get started**). Set provisioning mode to **Automatic** if asked.Copy the **SCIM Tenant URL** and **SCIM Secret token** from fileAI (**Settings** > **Details**, Owner only) into **Tenant URL** and **Secret token**. Click **Test connection**, then **Create** (or **Save**). 4 Start provisioning On the provisioning overview, click **Start provisioning**.The first cycle usually takes 10 to 20 minutes. After that, Entra syncs about every 40 minutes. Check progress under **Provisioning logs**. Treat the **SCIM Secret token** like a password. Paste it only into Microsoft Entra, and never share it by email or chat. ## [​ ](#part-4-map-entra-groups-to-fileai-roles) Part 4: Map Entra groups to fileAI roles Once SCIM has sent your groups, go to fileAI **Settings** > **Details** and click **Map user roles**. For each Entra group, choose **Admin** or **Participant** and save. Roles are applied when a person signs in. Anyone not in a group mapped to **Admin** joins as **Participant**. If you see _User roles unavailable, please proceed with SCIM provisioning_, finish Part 3 and wait for the first provisioning cycle. ## [​ ](#removing-access) Removing access Blocking or deleting a user in Microsoft Entra stops them from signing in to fileAI with Microsoft. To remove them from your workspace as well, go to **Settings** > **Members** in fileAI and remove them. ## [​ ](#troubleshooting) Troubleshooting The provided Tenant ID does not exist in Microsoft Entra The ID was mistyped or copied from the wrong place. Copy the **Tenant ID** from **Identity** > **Overview** in the Entra admin center. Do not use a domain name or an application ID. This Tenant ID is already bound to a workspace One Entra tenant can be connected to one fileAI workspace per region. Contact fileAI support if you need to move it to a different workspace. Microsoft says 'Need admin approval' The person who signed in on the Microsoft page is not an Entra admin. Repeat Part 1 and have someone with one of the admin roles listed in **Before you start** sign in on that page. Settings still shows Not connected The Microsoft approval was cancelled or not finished. Click **Connect to Microsoft Entra** again and complete the approval. 'Oops, please try to Login again!' after signing in The person’s Entra tenant is not connected to a fileAI workspace in this region, or the sign-in took too long. Check you are on the right regional sign-in page, then try again. If it keeps happening, ask your workspace Owner to confirm Part 1 shows **Connected**. SCIM Test connection fails Copy the **SCIM Tenant URL** and **SCIM Secret token** again from fileAI, with no extra spaces, and retry. If it still fails, send the error message to fileAI support. [ Billing ](/docs-user-guide/account/billing) [linkedin](https://www.linkedin.com/company/file-ai)[x](https://x.com/fileAI_)[youtube](https://www.youtube.com/@file_AI) [Powered byThis documentation is built and hosted on Mintlify, a developer documentation platform](https://www.mintlify.com?utm_campaign=poweredBy&utm_medium=referral&utm_source=undefined)