Microsoft Entra ID SSO: Setup guide and FAQ

With Microsoft Entra ID SSO, your organization's users sign in to Systam Studio with their own Microsoft account instead of a separate password. SSO doesn't create or remove users — the user has to already exist in Studio before their first SSO sign-in.

SSO vs. user provisioning (SCIM)

SSO and SCIM handle different things, and turning one on or off doesn't change the other's settings:

• SSO handles sign-in and confirms who the user is.
• SCIM (Entra sync) handles creating, updating, and removing users, workspace assignment, and contact details.

Most organizations get the best result from using both: SSO for sign-in, SCIM for keeping the user directory current.

Before you start

• If you don't see the full Microsoft Entra ID SSO extension under Extensions in Studio, contact Systam support — we need to enable it for your organization first.
• Users need to already exist in Studio, either created manually or through SCIM sync. SSO doesn't create accounts at sign-in.
• It helps if your Studio users' email addresses match the ones they sign in with on Microsoft.

Setting up SSO in Studio

1. Open Extensions → Microsoft Entra ID SSO (requires organization owner rights).
2. Copy your Directory (tenant) ID from the Microsoft Entra admin center, enter it in the Tenant ID field, and save.
3. Click Verify metadata. This confirms your tenant is reachable and its sign-in settings are available — it doesn't test an actual sign-in yet.
4. Click Grant admin consent. Your Microsoft Entra admin signs in and approves the permissions for the whole tenant.
5. Test sign-in with at least two existing users before enforcing SSO. Keep password sign-in available as a fallback during this step.
6. Once testing looks good, click Require single sign-on. Password sign-in is disabled after this, so the setting asks for a separate confirmation.

Changing your mind: Allow password sign-in removes the enforcement immediately while keeping your tenant and other SSO settings. Remove SSO settings clears your entire SSO configuration — this doesn't touch your SCIM/Entra sync settings.

What users see when signing in

• Sign-in always starts with an email address: the user enters it and clicks Continue.
• When SSO is optional, users see both password sign-in and a Sign in with Microsoft button.
• When SSO is enforced, users are sent straight to Microsoft after entering their email.
• If something goes wrong with optional SSO, password sign-in works as a fallback. If it goes wrong with enforced SSO, the user is sent back to the email step — at which point your organization owner can click Allow password sign-in to restore access quickly.

Account linking and what data updates

On the first SSO sign-in, the email or username confirmed by Microsoft is matched to an existing Studio user, and the account is linked from then on.

• Email and name update based on what Microsoft sends. A missing or empty value never erases data that's already stored.
• SSO doesn't bring in phone numbers, groups, roles, job title, department, or workspace assignments.

Bringing in phone numbers with SCIM

The SSO sign-in token isn't a reliable source for phone numbers, since it's built for sign-in, not ongoing directory sync. SCIM, on the other hand, updates user data continuously and supports phone numbers directly.

If you want phone numbers synced, map the relevant Entra field to phoneNumbers[type eq "work"].value or phoneNumbers[type eq "other"].value in your SCIM provisioning setup. The field is optional, and Systam normalizes the number to international format automatically.

Changing your Tenant ID or turning off SSO

Changing the Tenant ID breaks existing Microsoft account links — the new tenant needs to be verified, consented, and tested from scratch, the same as the first setup. Turning off SSO restores password sign-in but doesn't sign out users who are already logged in.

Checklist before requiring SSO

• Pilot users already exist in Studio, and their emails match their Microsoft accounts.
• Sign-in has been tested with at least two regular users.
• Everyone knows SSO doesn't create users or bring in phone numbers — SCIM handles those.
• There's a plan for what to do if something goes wrong (for example, Allow password sign-in).
• Your organization is ready for the moment password sign-in gets disabled.

Microsoft's documentation

• Admin consent →
• Customizing SCIM attribute mappings →

That covers setting up SSO. Reach out to support if any step needs more detail.