Import employees and groups from Microsoft Entra ID over SCIM and set up single sign-on, step by step, with an enterprise application you create in Entra.
Entra sends Cimento the people and groups you assign to a Cimento enterprise application and keeps them up to date over SCIM. The same application sets up SAML single sign-on, so assigned employees can sign in to Cimento through Entra.
An Entra Application Administrator, Cloud Application Administrator or Global Administrator, to create the application and set up provisioning and single sign-on.
A Cimento user with the Admin role, to reveal the secret token in step 4. Integrations admins can do every other step.
An email address on everyone you’ll assign. Cimento matches people by email, so each person needs the Email field set on their Entra account.
Microsoft Entra ID P1 or P2 if you want to assign groups. With Microsoft Entra ID Free, you assign people one at a time.
Your organization’s email domains registered with Cimento. Single sign-on only covers those domains, so ask your Cimento contact to add any that are missing.
Your organization connects one directory, and switching to another later needs Cimento support. As soon as you click Begin Setup, employees come from Entra: you can no longer add or upload employees in Cimento, or edit their names, email addresses, status or departments.
Go to Admin → Integrations → Employee data. Under Directory provider, choose Microsoft Entra ID and click Begin Setup. The setup guide opens at Before you start. Read it, then click Next.
2
Create the application
Click Open the Microsoft Entra admin center. Go to Entra ID › Enterprise apps (Enterprise applications in the Azure portal) and click New application, then Create your own application. Name it Cimento, choose Integrate any other application you don’t find in the gallery (Non-gallery) and click Create. The application’s Overview page opens after a few seconds. Back in Cimento, click Next.
Enterprise applications › New application
Name the application, choose Non-gallery and click Create
3
Assign people
In the Cimento application, open Users and groups and click Add user/group. Choose the people and groups who should use Cimento, then click Select and Assign. Assign yourself too, so you can sign in to Cimento through Entra. Entra only sends direct members of a group you assign, not members of groups nested inside it. Back in Cimento, click Next.
Users and groups › Add user/group
Pick the people to assign, then click Select and Assign
4
Connect provisioning
In the Cimento application, open Provisioning and click Connect your application. If you see Get started instead, click it and set Provisioning Mode to Automatic. Keep Bearer authentication. From Cimento’s Provisioning step, copy the Tenant URL into Entra, then click Copy next to Secret Token and paste it into Entra’s Secret token field. Click Test connection, and when it succeeds, click Create or Save. You don’t need to change the attribute mappings.
Open Provisioning from the application's menu
Bearer authentication, the Tenant URL and the Secret Token, shown in the older Provisioning layout
5
Start provisioning
On the provisioning Overview, click Start provisioning. In the older layout, set Provisioning Status to On and click Save. Keep the scope at Sync only assigned users and groups. Entra syncs about every 40 minutes. To check it right away, use Provision on demand with your own account. Back in Cimento, click Next.
6
Set up single sign-on
In the Cimento application, open Single sign-on and choose SAML. Click Edit in Basic SAML Configuration. Click Add identifier and paste the Identifier (Entity ID) from Cimento’s Single sign-on step. Click Add reply URL and paste the Reply URL (Assertion Consumer Service URL). Leave Sign on URL, Relay State and Logout Url empty, and click Save.
Single sign-on › SAML
Add the Identifier and the Reply URL; leave the optional fields empty
7
Send email addresses as the user identifier
In Attributes & Claims, click Edit, then the Unique User Identifier (Name ID) claim. Set Name identifier format to Email address, Source to Attribute and Source attribute to user.mail, and click Save. Back in Cimento, click Next.
Click the Unique User Identifier (Name ID) claim
Email address format, Attribute source, user.mail
8
Turn on single sign-on
Single sign-on adds a way to sign in; it doesn’t replace email sign-in links. Everyone can still sign in with a link sent to their work email. Signing in through Entra works only for people assigned to the Cimento application who are already in Cimento, so finish steps 3 to 5 first.
On Entra’s Single sign-on page, copy the App Federation Metadata Url from SAML Certificates. Paste it into Cimento’s Metadata URL step and click Save configuration. When Cimento shows SSO configured, people with an address in your domains can click Sign in on Cimento’s sign-in page to sign in through Entra, or Sign in with email to get a sign-in link.
Copy the App Federation Metadata Url from SAML Certificates
9
Verify
In Cimento’s Verify step, click Test connection. It checks that single sign-on is connected to your Entra tenant and activates the integration. Then try it yourself: open My Apps and select Cimento, or enter your work email on Cimento’s sign-in page and click Sign in. Entra’s Test connection in step 4 is the check for provisioning, and Entra’s Provisioning logs show each person it sent.
Cimento uses each employee’s primary email, name, title, department, manager and phone numbers, and mirrors the groups you assign. See What Okta and Microsoft Entra ID send for how each attribute maps and what happens when someone leaves.
The secret token lets Entra create, update and deactivate employees in Cimento, so store it like a password. To stop Entra from updating Cimento, click Stop provisioning on the provisioning Overview (in the older layout, set Provisioning Status to Off), or delete the enterprise application.
Assistant
Responses are generated using AI and may contain mistakes.
