> ## Documentation Index > Fetch the complete documentation index at: https://developers.entri.com/llms.txt > Use this file to discover all available pages before exploring further. # SSO and SCIM Provisioning > Sign in to the Entri dashboard through your identity provider with SAML 2.0, and provision users with SCIM 2.0. ## Overview Entri supports enterprise single sign-on (SSO) and SCIM 2.0 for the Entri dashboard. SSO lets your team sign in to the dashboard through your identity provider, such as Okta, Microsoft Entra ID, or Google Workspace, using SAML 2.0. SCIM lets your identity provider manage who has access: assigning a user to the Entri application creates their dashboard account, and unassigning them removes it. You can use SSO on its own, or add SCIM so accounts are created and removed automatically. Neither is enabled by default; contact your Entri account manager to enable them for your organization. ## Single sign-on ### Service provider details Entri works with any SAML 2.0 identity provider, such as Okta, Microsoft Entra ID, or Google Workspace. Use these values when you create a SAML application for Entri in your identity provider. | Setting | Value | | - | - | | Audience URI (SP Entity ID) | `urn:amazon:cognito:sp:us-east-2_6VSMTm0Rc` | | Single sign-on URL (ACS URL) | `https://entridashboard.auth.us-east-2.amazoncognito.com/saml2/idpresponse` | | Name ID format | `EmailAddress` | ### SSO attribute mapping Entri identifies each user by email address. | Attribute | Required | Notes | | - | - | - | | `email` | Yes | Must match the email address of the user's Entri dashboard account. | > [!NOTE] > > If your identity provider does not send an `email` attribute, Entri uses the SAML Name ID as the email address, so set the Name ID format to `EmailAddress`. ### SSO setup **1. Create an application for Entri in your identity provider** Create a SAML 2.0 application using the service provider details above and map the `email` attribute. **2. Send your identity provider details to Entri** Send your Entri account manager or [support@entri.com](mailto:support@entri.com) the following: * Your IdP metadata URL or metadata XML file. * The email domains your team uses to sign in, for example `example.com`. **3. Assign users** Assign the users who need dashboard access to the Entri application in your identity provider. Entri confirms when SSO is enabled for your organization. > [!WARNING] > > SSO does not create dashboard accounts. Each user also needs an Entri dashboard account with the same email address, either invited by an Entri admin or created automatically with [SCIM provisioning](#scim-provisioning). Users without a dashboard account can't sign in to Entri through SSO. ### Signing in 1. Go to [dashboard.entri.com](https://dashboard.entri.com) and select **Continue with SSO**. 2. Enter your work email address. You are redirected to your identity provider. 3. Sign in to your identity provider. You are returned to the Entri dashboard. ### Multi-factor authentication For SSO sign-ins, authentication and multi-factor authentication (MFA) are handled entirely by your identity provider. Entri never receives your users' identity provider credentials, so the MFA policy you enforce in your identity provider, including phishing-resistant methods such as FIDO2 security keys, applies to every SSO sign-in to Entri. ### SSO troubleshooting | Symptom | Cause | | - | - | | **Continue with SSO** shows `Invalid email` | SSO is not yet enabled for that email domain. Contact Entri to add the domain. | | Your identity provider signs you in, but Entri shows a sign-in error | The user does not have a dashboard account, the email sent by your identity provider does not match their dashboard email, or the user is not part of your organization in Entri. Invite the user or provision them with SCIM, and check the `email` attribute mapping. | ## SCIM provisioning ### What SCIM does | Action in your identity provider | Result in Entri | | - | - | | Assign a user to the Entri application | A dashboard user is created with the **Analyst** role. No invitation email is sent. The user signs in through SSO. | | Change the user's email address | The dashboard user's email is updated. | | Unassign or deactivate the user | The dashboard user is deleted. Reassigning the user creates a new account with the Analyst role. | | Delete the user | The dashboard user is deleted. | > [!WARNING] > > Roles and permissions are not synced through SCIM. Every provisioned user starts as an Analyst. An Entri admin changes roles in the dashboard after the user is created. Role, group, and custom attributes sent by your identity provider are ignored. > [!NOTE] > > Groups are not supported. Only the User resource is available, so group push has no effect. Deactivating a user removes the account rather than suspending it, and there is no inactive state. ### Setup **1. Copy your SCIM credentials from the Entri dashboard** Open the SCIM settings in the Entri dashboard and copy the **SCIM base URL** and the **bearer token**. The token is shown in full, so store it somewhere safe. **2. Create a SCIM integration in your identity provider** Add a SCIM 2.0 provisioning integration for Entri and paste the base URL and token. Authentication is an HTTP bearer token sent in the `Authorization` header. **3. Map attributes** Map the attributes listed below and leave all others unmapped. Enable provisioning for create, update, and deactivate. **4. Assign users** Assign users or groups to the Entri application. Each user appears in the Entri dashboard once your identity provider runs its next sync. > [!WARNING] > > The bearer token expires **180 days** after it is generated. Generate a new token in the Entri dashboard before it expires and update your identity provider. Requests with an expired token fail with `403`. ### Attribute mapping Entri reads three attributes from each user. | SCIM attribute | Required | Entri field | | - | - | - | | `userName` | Yes | The user's email address, used to sign in. | | `emails[type eq "work"].value` | No | The same email address as `userName`. | | `active` | No | Setting this to `false` deletes the user. | ### Endpoints The base URL is `https://api.goentri.com/integration/scim/v2`. | Method | Path | Notes | | - | - | - | | `GET` | `/Users` | Supports `filter=userName eq "email"`, `startIndex`, and `count`. Maximum `count` is 100. | | `POST` | `/Users` | Returns `400` if the email already belongs to a user in your organization. | | `GET` | `/Users/{id}` | Returns a single user. | | `PUT` | `/Users/{id}` | Updates `userName` and `active`. | | `PATCH` | `/Users/{id}` | Supports `replace` and `add` operations on `userName`, `emails`, and `active`. | | `DELETE` | `/Users/{id}` | Returns `204`. | | `GET` | `/ServiceProviderConfig` | Describes supported features. Bulk operations, sorting, ETags, and password changes are not supported. | | `GET` | `/ResourceTypes` | Lists the User resource type. | | `GET` | `/Schemas` | Returns the User schema. | ### Troubleshooting | Symptom | Cause | | - | - | | Every request returns `403` | The token has expired or was regenerated. Copy the current token from the dashboard into your identity provider. | | Assignment fails with `User already exists` | The email already belongs to a dashboard user in your organization. Remove the existing user in the dashboard, or unassign and reassign the user in your identity provider. | | A user was created with the wrong role | Expected. Roles are set in the dashboard, not by SCIM. | | A deactivated user is missing from the dashboard | Expected. Deactivation deletes the account. | ## Frequently Asked Questions ### Do existing dashboard users need to be migrated to SSO? No. Entri matches SSO sign-ins to dashboard accounts by email address, so a user's first SSO sign-in uses their existing account, role, and data. ### How do I remove a user's access if I don't use SCIM? Remove the user from the Entri application in your identity provider, and also remove them in the Entri dashboard. Removing a user only in your identity provider stops SSO sign-in, but their dashboard account remains until an Entri admin removes it. With SCIM, unassigning the user removes the dashboard account automatically.