How users sign in

Once the integration is live, signing in from Microsoft My Apps works right away. Sign-in started from the swag store itself is switched on per store — it uses the same Entra configuration, we just need your Login URL (see the final step below).

Create the enterprise application

You'll need the Cloud Application Administrator or Application Administrator role. The whole setup takes about ten minutes.

1. Open the Microsoft Entra admin center at entra.microsoft.com.
2. Go to Entra ID → Enterprise apps → All applications and click + New application.
3. Click + Create your own application, then choose Integrate any other application you don't find in the gallery (Non-gallery).
4. Name it "Jaapi Swag Store" and create.
5. From the app's left sidebar, open Single sign-on and select the SAML tile.

SAML settings

On the SAML configuration page, edit each numbered section with the values below. Values must match exactly for authentication to work.

Section 1 — Basic SAML Configuration

Identifier (Entity ID)

https://store.jaapi.store

Reply URL (ACS URL)

https://store.jaapi.store/api/auth/signin/sso

Sign on URL

https://store.jaapi.store/auth/signin — used when users click your tile in Microsoft My Apps

Section 2 — Attributes & Claims

Click Unique User Identifier (Name ID) and configure:

Source attribute

user.mail

Name identifier format

Email

Optional user attributes

The SAML NameID (email) is the only required attribute. You can optionally send these from Section 2's Additional claims to populate the user's profile on first login.

Complete the integration

After finishing the SAML configuration, send Jaapi the information below so we can pin your IdP certificate and enable the SSO tile on your storefront.

1. Assign your test user to the application (Users and groups → Add user/group).
2. In Section 3 — SAML Signing Certificate, download Certificate (Base64). Azure AD signs with SHA-256 by default and the cert is valid for 3 years.
3. Sign in to myapps.microsoft.com as the test user and click your application's tile. The first attempt will fail — this is expected.
4. Email support@jaapi.store with:

   • Store domain: store.jaapi.store
   • The downloaded Certificate (Base64) file
   • (For storefront sign-in) Your Login URL from Section 4 — Set up [app name] — required to enable the SSO button on the storefront

Later certificate renewals are self-service: when Entra rotates your signing certificate, a store admin can paste the new one under SAML SSO in the store settings — no need to email us again.

Before you start

SSO decides how people sign in; SCIM decides who has an account in the first place. With provisioning enabled on the same enterprise application, Entra creates a store account when an employee is assigned the app, keeps their name and email in sync, and deactivates them when they're offboarded — so your store mirrors who's active in Entra, with no manual invites.

For the full list of supported endpoints, attributes and behaviours, see the SCIM 2.0 reference.

Generate a SCIM token

1. In your swag store, open Settings → API Tokens and create a token. Name it something like "Entra SCIM".
2. The token is shown once. Copy it straight into Entra's Secret Token field in the next step.

Enable provisioning on your enterprise app

1. Open the enterprise application you created above and select Provisioning from the left sidebar, then start a new configuration.
2. Set Provisioning Mode to Automatic.
3. Under Admin Credentials, enter the values below, click Test Connection, and save once it passes.

Tenant URL

https://store.jaapi.store/api/scim/v2

Secret Token

The token you generated in the previous step

Check the attribute mappings

Under Mappings → Provision Microsoft Entra ID Users, the defaults are close, with one thing to verify: userName must carry the user's email address, because it has to match the email your SAML sign-in sends (user.mail). Entra's default maps userPrincipalName → userName, which is fine only if UPNs equal email addresses in your tenant — otherwise change the source attribute to mail.

Beyond that, givenName, surname, displayName, emails and the active flag are all we consume — extra default mappings are ignored harmlessly. Leave Provision Microsoft Entra ID Groups disabled: Jaapi is the downstream system and uses a flat role model, so it doesn't consume groups.

Assign users and turn it on

1. Under Settings → Scope, keep Sync only assigned users and groups (the default) — it makes the app assignment the single switch that controls both sign-in and provisioning.
2. Assign the app to the group your new hires already land in (Users and groups → Add user/group).
3. Set Provisioning Status to On and save. Nothing is provisioned until this toggle is on.

Related guides