Single sign-on and directory sync cards
Entra ID and SCIM appear in the Hub, but they are configured in the Workspace portal.
Who can do thisTenant Admin
The Marketplace has two identity connectors: Microsoft Entra ID (SSO) and Directory provisioning (SCIM). They appear in the Hub so you can see the whole picture of what is connected, but you cannot set them up in the Hub. Single sign-on and directory sync are configured in the Workspace portal by a Tenant Admin.
The Integration Hub is in English only, so its labels are quoted in English in the Danish articles too.
The two cards
Open Marketplace and choose the category Identity & directory.
| Card | What it does | Where you set it up |
|---|---|---|
| Microsoft Entra ID (SSO) | "Let your team sign in to Juvaro with Microsoft Entra ID (SAML or OIDC)." Direction: Federation. | Workspace portal, SecurityAuthentication |
| Directory provisioning (SCIM) | "Auto-provision users and groups from your identity provider via SCIM 2.0." Direction: Inbound. | Workspace portal, SecurityIdentity sources |
The same category also has Google Workspace, which is marked Coming soon (Q1 2027).
Configure opens the portal
In place of Add, both cards have the link Configure ↗. It opens the Workspace portal's single sign-on settings in a new browser tab, on the Authentication page.
- For Entra ID single sign-on, carry on there. See Authentication and single sign-on.
- For SCIM, go on to Identity sources in the portal's left rail. See Identity sources.
If the Hub does not know the portal's address, the card shows the plain text "Configure in Tenant Management → Security" instead of a link. Open the portal from the Launch Pad and go to the Security group yourself.
Everyone sees Configure ↗, but the portal pages only open for a Tenant Admin. A member who follows the link gets a refusal from the portal.
The Status line in the details dialog
Click a card to open its details. Next to Works with, What it does, Data flow and Technical details, an identity card has a Status row that reads the current setup from the portal:
| Status text | Meaning |
|---|---|
| "Checking status…" | The Hub is asking the portal. For a Workspace Administrator this takes a moment. A member keeps seeing this text, because the status is only shown to administrators. |
| "Not configured yet" | Single sign-on or SCIM has not been set up in the portal. |
| "SSO - saml, enforced, 2 domains verified" | Single sign-on is set up. The line names the protocol in lower case (saml or oidc), says "enforced" or "not enforced", and counts the verified domains. |
| "SCIM - active, 48 users / 6 groups, last push 2 hours ago" | SCIM is set up. The line says "active" or "disabled", counts the users and groups provisioned, and says when the identity provider last pushed changes. |
The dialog only reads. To change anything, use Configure ↗.
Platform rows on the Connections page
When a workspace uses the portal's identity governance with HCM, Juvaro runs the user provisioning itself. Those jobs show on the Connections page in their own group, "Platform - run by Juvaro (N)", so you can see that they exist.
- Each row says "Runs on Juvaro's schedule" and has the status Not charged.
- The rows have no actions. They cannot be run, paused, opened or deleted in the Hub.
- Trying through an old link gives a message that starts "This integration is run by Juvaro for user provisioning and is managed in the workspace's single sign-on settings, so it cannot be …" and ends with what was refused, for example "deleted here." or "run from here."
- Their credentials show Managed by Juvaro on the Credentials page, and their runs show Not charged on the Usage page.
To change provisioning, a Tenant Admin uses Identity sources in the Workspace portal. See Identity sources.