Microsoft Entra ID

Before you start#

• You need admin access to your Microsoft Entra ID (Azure AD) tenant.
• Vectis support completes the configuration on the Vectis side, so be ready to send them the details below.

Step 1: Register an application in Entra ID#

1. Open App registrations

   In the Azure Portal, go to Microsoft Entra ID → App registrations.

2. Create a registration

   Select New registration and set:

   • Name: Vectis SSO
   • Supported account types: "Accounts in this organizational directory only"
   • Redirect URI: choose Web and enter https://<your Vectis address>/sso/callback

3. Register

   Select Register, then note the Application (client) ID and the Directory (tenant) ID.

Step 2: Create a client secret#

1. Go to Certificates & secrets → Client secrets → New client secret.
2. Add a description, such as "Vectis SSO", and choose an expiry period.
3. Select Add and copy the secret value immediately. It isn't shown again.

Step 3: Configure API permissions#

1. Go to API permissions → Add a permission.
2. Select Microsoft Graph → Delegated permissions.
3. Add openid, profile, email and User.Read.
4. If you'll use group claims for role mapping, also add GroupMember.Read.All, which needs admin consent.
5. Select Grant admin consent for the permissions.

Step 4: Configure group claims (optional, for role mapping)#

1. Go to Token configuration → Add groups claim.
2. Select Security groups and/or All groups.
3. For the ID token, make sure Group ID is selected.
4. Select Add.

Step 5: Send the details to Vectis#

Send Vectis support:

• Name: a display name for the connection, such as "Contoso SSO".
• Tenant ID: the Directory (tenant) ID from step 1.
• Client ID: the Application (client) ID from step 1.
• Client secret: the secret value from step 2.
• Domain: your organisation's email domain, such as contoso.com.
• The enforcement mode you want, and whether new users should be created automatically on first sign-in (JIT provisioning).

Step 6: Verify your domain#

Vectis adds your email domain to the configuration and gives you a verification token. Create a DNS TXT record with that token, then let Vectis know so the domain can be verified.

SCIM provisioning#

To provision users automatically:

1. Ask Vectis support for a SCIM token and the SCIM base URL (it ends in /scim/v2). The token is shown only once, so store it safely.
2. In Entra ID, go to Enterprise applications, find Vectis, and open Provisioning.
3. Set the provisioning mode to Automatic.
4. Enter the SCIM base URL as the Tenant URL, and the SCIM token as the Secret Token.
5. Select Test Connection.
6. Configure attribute mappings and turn provisioning on.

See SCIM provisioning for the attributes Vectis uses.

Troubleshooting#