Set up Single Sign-On (SSO) and SCIM with SecurityScorecard and Microsoft Entra ID

Configure SSO with Microsoft Entra ID

Follow these steps to configure SAML-based SSO with SecurityScorecard as the Service Provider (SP) and Microsoft Entra ID as the Identity Provider (IdP).

Step 1. Create a new application in Microsoft Entra ID

1. Sign in to the Microsoft Entra admin center.
2. Go to Enterprise Applications.
   
3. In the Microsoft Entra App Gallery, select Create your own application, and name it SecurityScorecard.
   
4. Confirm the new application appears under All Applications.

Step 2: Configure user attributes and claims

Map the required user attributes between SecurityScorecard and Microsoft Entra ID so they align with SecurityScorecard’s SSO requirements.

Step 3: Configure Single Sign-On (SAML)

1. Open the newly created application.
2. From the Overview page, select Set up Single Sign-On and choose SAML.

3. In Basic SAML Configuration, enter the following values provided by SecurityScorecard:

   Field	Value
   Metadata URL	https://platform-api.securityscorecard.io/v1/saml/metadata/service-provider
   Assertion Consumer Service, sometimes referred to as Single sign on URL	https://platform-api.securityscorecard.io/v1/saml/responses (HTTP-POST)
   Entity ID, sometimes referred to as Audience URI (SP Entity ID)	https://platform-api.securityscorecard.io/saml2/service-provider

For more information, see this article.

Step 4: Download and upload federation metadata

After completing the Basic SAML Configuration:

1. Download the Federation Metadata XML file from Microsoft Entra ID. 
   
2.  In SecurityScorecard, go to your profile avatar and select My Settings.
3. Select Single Sign-On (SSO) settings > Configure and upload the metadata file. For more information, see this article.

Optional: Configure SecurityScorecard SSO manually

If you prefer manual configuration instead of uploading metadata:

1. Enter the ACS URL and Entity ID from Microsoft Entra ID directly into SecurityScorecard's SAML settings. 
2. Refer to the SecurityScorecard article for specific instructions.

Step 5: Test SSO

Test the configuration by signing in with a Microsoft Entra ID test user to confirm authentication completes successfully.

Configure SCIM provisioning

SecurityScorecard supports SCIM provisioning from Microsoft Entra ID for users and groups, including role assignment.

Step 1: Connect SecurityScorecard to SCIM in Microsoft Entra ID

1. In Microsoft Entra ID, go to Enterprise applications.

2. Select the SecurityScorecard custom application you created earlier.

3. From the left navigation, go to Manage > Provisioning > Get started > Connect your application.
   

4. Enter the following values:

   • Tenant URL: https://platform-api.securityscorecard.io/scim/v2/

   • Secret token: Use the SCIM API token generated in the SecurityScorecard platform.
     

5. Select Test connection to test your settings.

Step 2: Create app roles in APP Registrations

SCIM role provisioning requires app roles to be defined at the application level.

1. In Microsoft Entra ID, search for App registrations and select the SecurityScorecard application.

2. Under Manage, select App roles.
   

3. Select Create app role to create the following roles:
    

   Name	Value
   CUSTOMER_ADMIN	CUSTOMER_ADMIN
   VRM	VRM
   USER	USER
   GUEST	GUEST

Step 3: Assign roles to users

1. Go to Enterprise Applications and select the SecurityScorecard application.
2. Open Users and groups and select one or more users.
3. Select Edit assignment.
4. Under Select a role, choose the appropriate role.
5. Click Select and then Assign.

Step 4: Create the sscRoles custom attribute for user provisioning

1. In Enterprise applications, go to the SecurityScorecard application and select Provisioning.
2. Select Get started > Add scoping filters.
3. Choose Provision Microsoft Entra ID Users.
4. Select Show advanced options and then select Edit attribute list for customappsso.
5. Create a new attribute:
   • Name: sscRoles
   • Required: Enabled
     
6. Select Save.

Step 5: Map app roles to the sscRoles attribute

1. After saving the attribute list, select Add new mapping.

2. Enter the following values:

   Field	Value
   Mapping type	Expression
   Expression	SingleAppRoleAssignment([appRoleAssignments])
   Target attribute	sscRoles

3. Select Save.
4. Confirm that all attributes are moved, except for the following:
   • userName
   • active
   • displayName
   • emails[type eq "work"].value
   • name.givenName
   • name.familyName
   • name.formmated
   • sscRoles

Note: SecurityScorecard requires the following fields to be populated per user in Entra ID. If any are missing, provisioning will fail for that user:

• userPrincipalName
• displayName
• mail
• givenName
• surname

To update a user:

1. Go to Identity > All users.
2. Select the user.
3. Select Edit properties.
4. Populate First name and Last name (if missing).
   
5. Save your changes.

Step 7: Provision users on demand

1. Return to Enterprise applications and go to SecurityScorecard > Provisioning.
2. Select Provision on demand.
3. Choose the user you want to provision.
4. Click Provision.

A success message appears once provisioning completes.

Step 8: Enable group provisioning with sscRoles

To provision groups, the sscRoles attribute must also be added to group provisioning.

1. In Enterprise applications, go to SecurityScorecard > Provisioning.
2. Select Get started > Add scoping filters.
3. Choose Provision Microsoft Entra ID Groups.
4. Enable Show advanced options and then select Edit attribute list for customappsso.
5. Create a new attribute with the following:
   • Name: sscRoles
   • Required: Enable
     
6. Save your changes.

Step 9: Map app roles to the sscRoles attribute (Groups)

1. Once the new attribute is saved, select Add new mapping.
2. Enter the following values:
   • Mapping Type: Expression
   • Expression: SingleAppRoleAssignment([appRoleAssignments])
   • Target attribute: sscRoles
     
3. Select Save.