Skip to main content

​
Overview

Entri supports enterprise single sign-on (SSO) and SCIM 2.0 for the Entri dashboard. SSO lets your team sign in to the dashboard through your identity provider, such as Okta, Microsoft Entra ID, or Google Workspace, using SAML 2.0. SCIM lets your identity provider manage who has access: assigning a user to the Entri application creates their dashboard account, and unassigning them removes it. You can use SSO on its own, or add SCIM so accounts are created and removed automatically. Neither is enabled by default; contact your Entri account manager to enable them for your organization.

​
Single sign-on

​
Service provider details

Entri works with any SAML 2.0 identity provider, such as Okta, Microsoft Entra ID, or Google Workspace. Use these values when you create a SAML application for Entri in your identity provider.

​
SSO attribute mapping

Entri identifies each user by email address.
If your identity provider does not send an email attribute, Entri uses the SAML Name ID as the email address, so set the Name ID format to EmailAddress.

​
SSO setup

1

Create an application for Entri in your identity provider

Create a SAML 2.0 application using the service provider details above and map the email attribute.
2

Send your identity provider details to Entri

Send your Entri account manager or support@entri.com the following:
  • Your IdP metadata URL or metadata XML file.
  • The email domains your team uses to sign in, for example example.com.
3

Assign users

Assign the users who need dashboard access to the Entri application in your identity provider. Entri confirms when SSO is enabled for your organization.
SSO does not create dashboard accounts. Each user also needs an Entri dashboard account with the same email address, either invited by an Entri admin or created automatically with SCIM provisioning. Users without a dashboard account can’t sign in to Entri through SSO.

​
Signing in

  1. Go to dashboard.entri.com and select Continue with SSO.
  2. Enter your work email address. You are redirected to your identity provider.
  3. Sign in to your identity provider. You are returned to the Entri dashboard.

​
Multi-factor authentication

For SSO sign-ins, authentication and multi-factor authentication (MFA) are handled entirely by your identity provider. Entri never receives your users’ identity provider credentials, so the MFA policy you enforce in your identity provider, including phishing-resistant methods such as FIDO2 security keys, applies to every SSO sign-in to Entri.

​
SSO troubleshooting

​
SCIM provisioning

​
What SCIM does

Roles and permissions are not synced through SCIM. Every provisioned user starts as an Analyst. An Entri admin changes roles in the dashboard after the user is created. Role, group, and custom attributes sent by your identity provider are ignored.
Groups are not supported. Only the User resource is available, so group push has no effect. Deactivating a user removes the account rather than suspending it, and there is no inactive state.

​
Setup

1

Copy your SCIM credentials from the Entri dashboard

Open the SCIM settings in the Entri dashboard and copy the SCIM base URL and the bearer token. The token is shown in full, so store it somewhere safe.
2

Create a SCIM integration in your identity provider

Add a SCIM 2.0 provisioning integration for Entri and paste the base URL and token. Authentication is an HTTP bearer token sent in the Authorization header.
3

Map attributes

Map the attributes listed below and leave all others unmapped. Enable provisioning for create, update, and deactivate.
4

Assign users

Assign users or groups to the Entri application. Each user appears in the Entri dashboard once your identity provider runs its next sync.
The bearer token expires 180 days after it is generated. Generate a new token in the Entri dashboard before it expires and update your identity provider. Requests with an expired token fail with 403.

​
Attribute mapping

Entri reads three attributes from each user.

​
Endpoints

The base URL is https://api.goentri.com/integration/scim/v2.

​
Troubleshooting

​
Frequently Asked Questions

​
Do existing dashboard users need to be migrated to SSO?

No. Entri matches SSO sign-ins to dashboard accounts by email address, so a user’s first SSO sign-in uses their existing account, role, and data.

​
How do I remove a user’s access if I don’t use SCIM?

Remove the user from the Entri application in your identity provider, and also remove them in the Entri dashboard. Removing a user only in your identity provider stops SSO sign-in, but their dashboard account remains until an Entri admin removes it. With SCIM, unassigning the user removes the dashboard account automatically.