SAML single sign-on, SCIM provisioning and the Security administrator

Sign people in through your directory with SAML 2.0 — its metadata imported, every assertion signed, encrypted assertions if you require them — and decide per connection whether TRANXACT still asks its own second step. Let the directory create, change and deactivate people through SCIM 2.0 with a token shown once. Both are run by the Security administrator role and nothing else.

Onde encontrar

• Platform › Access & Security › Access › Single Sign-On, and Provisioning (SCIM) beside it.
• Your role must name the screen itself: “Your role must name Single Sign-On to open it: a grant on every Platform screen does not reach who may sign in.” The shipped role is Security administrator; Administrator reaches both too.
• A service account, an assumed identity or an accountant session cannot change either: “Single sign-on and provisioning are managed by a person signed in as themselves.”

Add a SAML 2.0 connection

1. Choose Add a connection. Give a Connection code (short, unique, never changes), a Name, Protocol SAML 2.0 and the Vendor — for example <ENTRA>, <Contoso Entra ID>, <Microsoft>.
2. Save the connection first: its own Service provider entity ID, Assertion consumer service (ACS) URL and certificate are made then. The card’s For the identity provider panel lists Entity ID, ACS URL, Metadata URL and Test sign-in to give whoever configures the directory; SP metadata downloads the same as a file.
3. Bring the directory’s side in: paste its metadata address and choose Import from URL (it must be https), or Or paste the metadata XML and Import XML. “Identity provider metadata imported.” fills Issuer / entity ID, Sign-on URL and the Signing certificate.
4. Choose the options: Require encrypted assertions (the directory encrypts to this connection’s certificate), Sign the request, Accept sign-ins started at the identity provider (off by default), Single logout, and Clock skew allowed (seconds, 0 to 300, default 60).
5. Under Who it lets in, fill the Attribute map, for example {"email":"mail","full_name":"displayName","groups":"groups"}, a Button label, and whether to Create a sign-in for new people (they are given a sign-in that reaches Help & Support only, marked “Created at first sign-in” under Users).
6. Under Email domains, Claim domain <contoso.com>, put the TXT record shown in your DNS and choose Check the TXT record: “<contoso.com> verified: the TXT record is in place.”
7. Map Directory groups to roles if you want: a group named here gives its role at sign-in and takes it away when the directory stops naming the group. Never the Administrator role, and only roles you hold yourself.
8. Save connection, then Enable. Until Issuer / entity ID, Service provider entity ID, ACS URL, Sign-on URL and Signing certificate are filled the card says “Before this can be enabled: …”.

Assertions must always be signed, addressed to this connection and used once; there is no switch to accept an unsigned one. Test SSO routing on the same screen takes an e-mail address and says which connection will sign it in and why (Routed, No connection, Domain unverified, Connection off, Incomplete).

Multi-factor sign-in: After the directory

What people see at sign-in

• After typing an address on a verified domain the sign-in page shows the connection’s button — “Sign in with <Microsoft>” — and “Your company signs you in through <Microsoft>. Use the password below only if you were given one here.”
• A refusal comes back to the sign-in page, for example “This connection accepts only encrypted assertions.”, “This SAML assertion has already been used. Start again.” or “<j.doe@contoso.com> has no TRANXACT account in this company.”
• Signing out of a connection with Single logout signs the person out of the directory too.

Provisioning (SCIM)

1. Give the directory the Tenant URL shown on the screen (it ends in /scim/v2).
2. Make a token: name it after the directory, for example <Microsoft Entra ID>, and give Days (1 to 730; blank: until revoked). Choose Make a token, copy it — “it is shown once and cannot be read back” — and choose I have copied it.
3. The directory can now create, change and deactivate people whose addresses are on a verified single sign-on domain, and push groups. Under Groups and the roles they give, choose Roles for each group it pushed.
4. Rotate makes a new token and stops the old one at once; Revoke stops it. What the directory did lists every change it made.

• Deactivating somebody in the directory switches their account off and ends all their sessions at once; the account and its history stay.
• An account an administrator switched off cannot be switched back on by SCIM, administrators are never changed through SCIM, and passwords are not set through it.
• Every SCIM, token, connection and domain change is audited, and that audit cannot be switched off.

The Security administrator role

Security administrator (security-admin) may add, change, display and delete on Single Sign-On and Provisioning (SCIM), and nothing else. It may map directory groups only to roles it holds itself, never to Administrator. It is a different role from Security & AI Governance Admin, which sets AI Settings.