Microsoft Entra ID integration
Sign in to Maskflare with Microsoft Entra ID and provision with SCIM
Connect Microsoft Entra ID to the Maskflare console with OpenID Connect or SAML single sign-on, enforce it for your domain, and provision members with SCIM 2.0.
- Single sign-on with OpenID Connect or SAML 2.0, for people at an email domain you have verified with a DNS TXT record
- Enforce single sign-on: removes the Maskflare passwords of everyone at that domain, except one break-glass owner you choose
- SCIM 2.0 provisioning of users and groups from an Entra ID enterprise application
- Roles from groups: map each pushed Entra group to Admin, Security, Developer or Auditor, with a default for everyone else
If your company runs on Microsoft 365, Entra ID is where accounts, groups and conditional access already live. Connecting it to Maskflare means console access follows the same joiner and leaver process as everything else.
Single sign-on sends people at your verified email domain to Entra ID to sign in. SCIM provisioning lets Entra ID add, update and remove Maskflare members and set their role from groups. Use either one or both.
What it does
- Single sign-on with OpenID Connect or SAML 2.0, for people at an email domain you have verified with a DNS TXT record
- Enforce single sign-on: removes the Maskflare passwords of everyone at that domain, except one break-glass owner you choose
- SCIM 2.0 provisioning of users and groups from an Entra ID enterprise application
- Roles from groups: map each pushed Entra group to Admin, Security, Developer or Auditor, with a default for everyone else
- Provisioned groups and the department attribute can scope policy exceptions
Set up Microsoft Entra ID with Maskflare
Microsoft Entra ID signs people in to the Maskflare console over OpenID Connect or SAML 2.0, and can provision members and roles over SCIM 2.0. You set it up in the console under Settings.
Single sign-on
- In the Maskflare console, open Settings, then Single sign-on. Under 1. Verify your domains, enter your email domain and select Add domain, create the DNS TXT record the console shows, then select Verify.
- In the Microsoft Entra admin center, open Entra ID, App registrations, then New registration. Name it, choose Single tenant only, set the platform to Web and the redirect URI to the Redirect URI / ACS URL shown under 2. Connect your identity provider in Maskflare, then select Register.
- On the app's Overview page, copy the Application (client) ID and the Directory (tenant) ID. Under Certificates & secrets, select New client secret and copy its value.
- Under Token configuration, add the optional claims email, given_name and family_name to the ID token, so Maskflare receives each person's email address and name.
- If the app requires assignment, open it under Enterprise apps and assign the people or groups who should use Maskflare under Users and groups.
- In Maskflare, set Protocol to OpenID Connect. Enter a Name on the sign-in page, choose the Domain, and enter the Discovery URL (https://login.microsoftonline.com/YOUR_TENANT_ID/v2.0/.well-known/openid-configuration), the Client ID and the Client secret. Select Send people of this domain to the identity provider, then Save identity provider.
- Sign in as a test user. Then, under 3. Enforce single sign-on, choose a Break-glass owner and select Enforce single sign-on. This deletes the Maskflare passwords of everyone at the domain except that owner's.
Provisioning with SCIM (optional)
- In Maskflare, open Settings, then User provisioning and select Create token. Copy the SCIM base URL and the token now: the token is shown once.
- In the Entra admin center, create a non-gallery enterprise application (Enterprise apps, New application, Create your own application), open its Provisioning page and set the mode to Automatic.
- Enter the SCIM base URL as the Tenant URL and the token as the Secret Token, then select Test Connection. Maskflare requires the token as a bearer token in the Authorization header.
- In the attribute mappings, map userName to an attribute that holds the person's email address, and keep the group mapping on. Optionally map department. Assign the people and groups, then start provisioning.
- Back in Maskflare, under Roles from groups, add a mapping from each group name to a role, and choose what Everyone else gets. A person in several mapped groups gets the strongest role.
What data is shared
- At sign-in, Entra ID sends Maskflare the person's email address, first name and last name (the email, given_name and family_name claims). They are refreshed at every sign-in.
- Through SCIM, Entra ID sends the user name (email address), given and family name, whether the account is active, an external ID, the department if mapped, and group names with their members.
- Maskflare sends Entra ID nothing about AI traffic. Entra ID only sees the sign-in redirect.
- Prompts, files, detected values and traffic metadata are never part of this connection.
Good to know
- SCIM never changes an owner. An owner can't be deactivated, deleted or given another role by provisioning.
- Deactivating someone in Entra ID disables them in Maskflare, ends their sessions and flags the app keys they created for review.
- New people are created only at your verified domains.
- What the SCIM endpoint supports: Users and Groups, create, read, replace, patch and delete, and filters of the form attribute eq value. It does not support bulk operations, sorting, ETags or password changes.
- To use SAML instead of OpenID Connect, choose SAML 2.0 as the Protocol and enter the app's federation metadata URL. Maskflare expects signed assertions and the email address as the Name ID.
- Directory sync from Entra ID (Microsoft Graph with a tenant ID, client ID and client secret) exists in the platform service and reads users, departments and groups every 15 minutes, including nested group members. The console screen to connect it is not released yet, so it isn't self-service today.
Vendor documentation
Frequently asked questions
Does Maskflare support Entra ID with SAML?
Yes. The single sign-on page offers OpenID Connect and SAML 2.0. For SAML, enter the federation metadata URL of your Entra enterprise application.
Can Entra groups decide who is an admin in Maskflare?
Yes, through SCIM. Push the groups to Maskflare and map each to Admin, Security, Developer or Auditor under Roles from groups. Owners are never changed by provisioning.
What if Entra ID is down?
When you enforce single sign-on you choose a break-glass owner who keeps their Maskflare password, so one owner can still sign in.
Why can't Entra create a new user?
Maskflare creates new people only at email domains you have verified under Single sign-on. Verify the domain first.
Other identity integrations
See it on your own data
Try Maskflare free.
Bring your hardest prompts.
28-day free trial or 10,000 requests, whichever comes first. Point one app at the gateway or enroll a few laptops,
and watch what gets masked. Or talk to us first.
- SOC 2 Type II: In progress
- ISO 27001: In progress
- EU hosting by default · on-premises available
- Prompts and files never stored
- Never used to train AI models
- GDPR · nDSG · DPA available
- Trust center →