SSO & SCIM
Set up SAML 2.0 single sign-on and SCIM user provisioning through one Microsoft Entra enterprise application
Route sign-in through your identity provider with SAML 2.0 single sign-on, and optionally keep your user list in sync automatically with SCIM provisioning. Both are configured on a single Microsoft Entra enterprise application — you create it once for SSO, then turn SCIM on for the same application.
Available to enterprise-tier (sales-managed) organisations, and only to users with the
general_enterprise_settings update permission. SCIM provisioning is an additional capability
that DeutschlandGPT enables for your organisation.
1. Create the enterprise application in Microsoft Entra
- Sign in to the Microsoft Entra admin center.
- Go to Identity → Applications → Enterprise applications → New application → Create your own application.
- Name it (for example "DeutschlandGPT"), choose Integrate any other application you don't find in the gallery (Non-gallery), and create it.
You configure SAML SSO on this application below, and — if you use it — SCIM on the same application.
2. Configure SAML single sign-on
Verify a domain (in DeutschlandGPT)
SSO stays locked until at least one domain is verified. On the Single Sign-On settings page, add each domain your users sign in with (for example example.com), then publish the TXT record shown to your DNS provider and re-check.
| Action | Description |
|---|---|
| Add domain | Enter a domain, then copy the TXT record to your DNS provider |
| Re-check | Run a fresh DNS lookup once the record is published |
| Remove | Remove a verified domain. Only possible while SSO is disabled |
Register DeutschlandGPT in Entra
In your enterprise application, open Single sign-on → SAML and fill in the Basic SAML Configuration with DeutschlandGPT's read-only Service provider values (shown on the SSO settings page):
| Entra field (Basic SAML Configuration) | DeutschlandGPT value |
|---|---|
| Identifier (Entity ID) | Entity ID |
| Reply URL (ACS URL) | ACS URL |
| Sign on URL | Sign-on URL |
Connect your identity provider (in DeutschlandGPT)
Back on the SSO settings page, paste your Entra app's federation metadata URL (recommended — it fills the fields automatically) or enter the values by hand.
| Field | Description |
|---|---|
| IdP metadata URL | URL to your IdP's SAML metadata XML. Fills the fields automatically |
| SSO login URL | Your IdP's SAML 2.0 endpoint |
| IdP entity ID | The issuer or entity ID from your IdP |
| IdP public certificate | Your IdP's signing certificate, in PEM format |
Enable SSO
Click Enable SAML 2.0. You need a verified domain, and you must confirm two checkboxes.
Confirm the IdP is reachable and the configuration is correct before you enable — otherwise users may not be able to sign in. Existing sessions stay active; new sign-ins go through the IdP. To end current sessions immediately, use Force logout of all sessions below.
3. Enable SCIM provisioning (same application)
SCIM keeps your user list in sync automatically: new employees are created the moment they are assigned in Entra, and departing ones are deactivated. SCIM requires SSO — set up SSO first (above) and reuse the same enterprise application.
While SCIM is active, manual user invitations inside DeutschlandGPT are disabled — all user management happens through Entra.
Create the SCIM token (in DeutschlandGPT)
On the SCIM settings page, create the Microsoft Entra provisioning token, then copy the SCIM URL (the Tenant URL) and the Secret Token. The token is shown only once — store it safely.
Connect Entra to DeutschlandGPT
In your enterprise application, open Provisioning → Connect your application and enter:
- Tenant URL — the SCIM URL from DeutschlandGPT.
- Secret Token — the secret token from DeutschlandGPT.
- Click Test connection, then Save.
Attribute mapping
Open Provisioning → Mappings → Provision Microsoft Entra ID Users. Keep only the mappings below and delete every other default mapping — Entra ships extras (employee ID, and so on) that DeutschlandGPT ignores.
| DeutschlandGPT (SCIM) attribute | Entra source |
|---|---|
| userName | userPrincipalName |
| active | Switch([IsSoftDeleted], , "False", "True", "True", "False") |
| displayName | displayName |
| emails[type eq "work"].value | mail |
| name.givenName | givenName |
| name.familyName | surname |
| name.formatted | Join(" ", [givenName], [surname]) |
| externalId | mailNickname |
Save the mappings, assign the users and groups you want provisioned to the application, then set provisioning On.
Departing employees (deprovisioning)
When you remove the app assignment in Entra, disable the account, or delete the user, SCIM deactivates the account in DeutschlandGPT and automatically releases the license it held. The entry stays visible in the member list as Inactive — inactive members cannot sign in and consume no license.
An inactive account can be deleted permanently under Settings → Organization → Members (requires the "delete users" permission). Deleted accounts lose all access immediately and are irreversibly removed, together with their data, after 30 days.
While SCIM is active, only members that have already been deprovisioned in Entra (status Inactive) can be deleted. Revoke access in Entra first — otherwise the next synchronization run simply re-creates the account.
Sign SAML requests (optional hardening)
Turn on Sign AuthnRequests to have the service provider sign outgoing authentication requests with the platform's private key. This is available only when a signing key is configured server-side.
Turn on Require signed SAML assertions to reject any assertion that arrives unsigned from your IdP.
Force logout of all sessions
Sign out every active session across the organisation at once. Use this after a suspected credential leak or when you need to enforce a policy change.