EntraID - Tenent Configuration Guide - OIDC for cross-platform support

Purpose

This customer-facing guide explains what a customer administrator must configure in their own Microsoft Entra tenant to enable SecureSafe OIDC sign-in and SCIM provisioning.

Important: No Customer App Registration Required

For the multitenant OIDC model, the customer does not create a separate App Registration, client secret, or redirect URI for OIDC. SecureSafe provides the multitenant application. The customer grants consent, which creates an Enterprise Application / Service Principal in the customer tenant.

What the Customer Configures

Step 2 – Assign Users and Roles

• Open Entra admin centre > Enterprise applications > SecureSafe.
• Under Manage > Properties, set Assignment required? to Yes. Without this setting, any user in the tenant can attempt to sign in to the application. SecureSafe accepts only provisioned users, so this acts as defence in depth rather than the primary access control.
• Assign the users who should access SecureSafe.
• If roles are available, assign exactly one SecureSafe role per user: PLAN_OWNER or PLAN_USER.
• Avoid assigning users without a role if SecureSafe expects role information at sign-in.

Step 3 – Configure SCIM Provisioning

This configuration defines which user parameters Entra ID passes to SecureSafe. Entra ID will sync with SecureSafe every 40 minutes. SCIM provisioning is independent of the SSO protocol and is configured identically whether SAML or OIDC is used.

Configure Provisioning

For the provisioning we need to define the endpoints, tenant bearer token, and user attribute mapping.

• Click on Enterprise applications > SecureSafe.

• Click on Manage > Provisioning > Get started.
• Two screens for the same thing can appear:
  • 1)

• • 2)

• Set Provisioning Mode to: Automatic
• Provide the SCIM settings:
  • SCIM endpoint: <SECURE_SAFE_SCIM_URL>
  • Secret Token: <BEARER_TOKEN>
• Test Connection. It should pass if the SCIM endpoints are reachable.
• Click Save.
• Refresh the page to see the applied changes.

(SCIM settings saved after a successful connection test)

Provisioning Scope

SecureSafe does not support syncing groups. Group provisioning must be disabled in the created application.

• Click on Provisioning Microsoft Entra ID Groups
• Disable and Save (a page refresh may be needed to update the status).

(Group provisioning disabled under Microsoft Entra ID Groups)

User Attribute Mapping

SecureSafe needs only a subset of the Entra ID user attributes. For some of these a specific mapping is required.

• Click on Provisioning Microsoft Entra ID Users

(Attribute mapping under Provisioning > Microsoft Entra ID Users)

• Delete any other existing mapping so that only the attributes below are configured: userName, active, email, preferredLanguage, name.givenName, name.familyName, externalId, and userType.

The specific mapping of a property can be defined by clicking Edit. It is recommended to save after each property mapping.

Mapping userName

In SecureSafe, user names cannot be updated. The user name should therefore only be sent during creation.

• Click Edit userName
• Set this property to be sent Only during object creation

(preferredLanguage mapped as a constant value)

• Set this property to be sent Only during object creation

(Apply this mapping set to Only during object creation)

• Click Ok.

Mapping externalId

The external id should be sent only during creation, and the object id is used as the external id.

• Click Edit externalId
• Set this property to be sent Only during object creation

(Apply this mapping set to Only during object creation)

• Click Ok.

Mapping userType

The user type carries the SecureSafe app role assigned in Entra: PLAN_OWNER or PLAN_USER. A user holds exactly one of these roles, not both.

• Click on Add new Mapping

(Add new mapping under the attribute mapping list)

• Define mapping type as Expression and use the following expression: SingleAppRoleAssignment([appRoleAssignments])
• Target with userType (if this target does not exist it has to be created in Entra ID).
• Click Ok.

(userType mapped with the SingleAppRoleAssignment expression)

• Check that everything is correct and save.

(Final attribute mapping summary before saving)

Enable Provisioning

Once everything is configured, you can start provisioning. Entra ID will then manage SecureSafe users based on your tenant's data.

• Add Users and Groups to the application.
• Test provisioning on demand by selecting a valid user for the application and checking that provisioning works for a sample user.

(Provision on demand for a sample user)

• Click on Provisioning > Overview > Start provisioning

(Provisioning > Overview > Start provisioning)

(Provisioning running with the initial sync in progress)

Step 4 – Configure OIDC SSO

For the multitenant OIDC model there is no customer-side OIDC configuration. Redirect URIs, client secrets, and API permissions are managed on SecureSafe's multitenant App Registration. OIDC sign-in is enabled once consent has been granted (Step 1), users have been assigned with roles (Step 2), and provisioning is running (Step 3).

In SecureSafe, only provisioned users are allowed to log in. OIDC authentication is therefore limited to accounts that have been synchronised and authorised in advance via SCIM, which keeps access tightly controlled.

Step 5 – Verify Sign-In

• Use a provisioned test user assigned to the SecureSafe Enterprise Application.
• Start sign-in from the SecureSafe SSO entry point.
• Authenticate with Entra ID.
• Confirm that the user returns to SecureSafe with a valid session and that their role inside SecureSafe matches their PLAN_OWNER or PLAN_USER assignment.

If sign-in fails, first confirm consent (Step 1), user and role assignment (Step 2), and provisioning (Step 3). Entra ID sign-in logs (Monitoring > Sign-in logs on the tenant) record the failure reason in the AADSTS error code, which is the fastest way to localise the problem. Issues on the SecureSafe multitenant application itself, such as redirect URI or client secret problems, must be raised with the SecureSafe team.