Enterprise

Microsoft Entra ID

Configure Microsoft Entra ID (formerly Azure Active Directory) for enterprise SSO using SAML 2.0 or OpenID Connect.

Prerequisites

You need admin access to your Microsoft Entra ID tenant and an AccessIQ Professional or Enterprise plan.

Step 1: Register Application in Entra ID

Go to Azure Portal → Microsoft Entra ID → App registrations
Click "New registration"
Enter a name (e.g., "AccessIQ SSO")
Select "Accounts in this organizational directory only"
Set Redirect URI to:https://auth.accessiq.io/callback/oidc
Click "Register"

Step 2: Configure Client Secret

In your app registration, go to "Certificates & secrets"
Click "New client secret"
Add a description and select expiry period
Copy the secret value immediately (it won't be shown again)

Step 3: Configure in AccessIQ

Configure Entra ID via APIbash

curl -X POST https://api.accessiq.io/v1/organizations/YOUR_ORG/identity-providers \
  -H "Authorization: Bearer YOUR_API_KEY" \
  -H "Content-Type: application/json" \
  -d '{
    "type": "oidc",
    "name": "Microsoft Entra ID",
    "enabled": true,
    "config": {
      "clientId": "YOUR_APPLICATION_CLIENT_ID",
      "clientSecret": "YOUR_CLIENT_SECRET",
      "issuer": "https://login.microsoftonline.com/YOUR_TENANT_ID/v2.0",
      "scopes": ["openid", "profile", "email"],
      "attributeMapping": {
        "email": "email",
        "name": "name",
        "picture": "picture"
      }
    },
    "domains": ["yourcompany.com"]
  }'

Required Entra ID Values

Field	Where to Find
`clientId`	App registration → Overview → Application (client) ID
`tenantId`	App registration → Overview → Directory (tenant) ID
`clientSecret`	App registration → Certificates & secrets

Optional: Configure SCIM Provisioning

Enable automatic user provisioning from Entra ID:

In Azure Portal, go to Enterprise Applications → Your App
Click "Provisioning" → "Get started"
Set Provisioning Mode to "Automatic"
Enter SCIM endpoint:https://api.accessiq.io/scim/v2/organizations/YOUR_ORG
Enter your SCIM API token for authentication
Test connection and save

Testing the Integration

Test IdP Connectionbash

curl -X POST https://api.accessiq.io/v1/organizations/YOUR_ORG/identity-providers/IDP_ID/test \
  -H "Authorization: Bearer YOUR_API_KEY"

# Response
{
  "success": true,
  "message": "Connection successful",
  "metadata": {
    "issuer": "https://login.microsoftonline.com/...",
    "supportedScopes": ["openid", "profile", "email"],
    "userInfoEndpoint": "https://graph.microsoft.com/oidc/userinfo"
  }
}

Domain Verification

For security, configure domain restrictions to ensure only users from your verified domains can authenticate via this IdP.