After completing these steps, you should have a working directory sync and SSO integration between Lookout and Microsoft Entra.

For context, directory syncing is required for SSO to function. This is because the users must be synchronised with the correct IDs in Lookout to resolve them during login.

We recommend doing an audit on the emails you are expecting to be able to SSO against the users you have already added to Lookout. This is to prevent Configuring SSO and Directory Syncing with Entra and Lookout Self serve - User created with wrong email which can be difficult to merge if a user starts using the erroneously created user.

You can get a report of the users from Entra by navigating to the group you are going to assign to the application clicking Members > Bulk Operations > Download Members

Create a report in Lookout with the data export category Profiles and export emails. You can also limit it to staffers and/or helpers.

Use a tool like Excel or Google Sheets to find any missing emails that don’t have matches.

Identify any emails that don’t match and update them in Lookout.

Create a new enterprise application in your organisation's Entra.

Create your own application and call it “Lookout”.

Click on Single Sign On and choose SAML.

Navigate to the Settings menu. Under the Developers section, there will be a link to Single sign-on.

Edit the configuration. The provider name should be the name of your IdP - e.g. Microsoft or Google. The Metadata URL you copied earlier goes in the provided metadata field. Click on “Save”.

Click on “Build SSO infrastructure” and wait for it to complete.

Once provisioning is complete, you will be provided:

Generate a directory syncing secret

Edit the “Basic SAML Configuration” and add the Identifier and Reply URL provided.

In the section Attributes & Claims, remove all attributes except Unique User Identifier. Add idp_user_id attribute and map it to user.objectid.

Configure Entra to verify SAML requests from Lookout.

Configure Entra to sign tokens issued for Lookout.

For SSO to work, the users must be “provisioned” (synced) from the IdP (Entra) to Lookout.

Enable provisioning in the Enterprise Application - Click ‘Get Started’.

Use automatic mode, and add the URL + token provided by Lookout. Test the connection to make sure it works.

Configure the provisioning user mapping so that externalId points to objectId.

Users or groups must be “assigned” to the application before they will be provisioned. Alternatively, this can be done using groups.

Click Overview and click “Start provisioning”. This may take up to an hour to complete. Check for errors if it does not.

Provisioning in Entra should now be automatic. When users are added/removed/deactivated, they should mirror in Lookout. Check the provisioning overview for details.

Enable your SSO sign in:

Single Sign On should now work, if the user has been provisioned properly. Please be aware it may take up to 24 hours for certificates to be available if you receive errors regarding certificates.

If you cannot proceed to the Microsoft Login flow after configuring the certificates correctly, it means the signing certificate (SAML verification certificate) is incorrect.

If you cannot return to Lookout after completing the login with Microsoft, it means the encryption certificate (Token encryption) is incorrect.

Groups can only sync through automatic provisioning, allowing up to an hour for automatic provisioning to work. Group syncing doesn’t work well with provisioning on demand.

This can happen if a profile is created in Lookout with an email different from your identity provider's.

We recommend:

There are two avenues to reacting to SCIM events.

Disabling SSO does not turn off SCIM syncing. To prevent syncing, rotate the SCIM credential by pressing “Regenerate secret”. The SCIM credential will need to be updated once you are ready to start syncing again.