Developer API
Developer APICompany Sign-InMicrosoft Entra ID

Company Sign-In with Microsoft Entra ID

Set up TagLogger company sign-in and directory sync with Microsoft Entra ID (Azure AD, Microsoft 365)

Before You Start

  • In TagLogger, open Settings, Company sign-in, pick Microsoft Entra ID (SAML), and choose Start setup. Or open the setup link your TagLogger owner sent you.
  • Verify your email domains first. See Company Sign-In.
  • You need an Entra role that can create enterprise applications, such as Cloud Application Administrator.

Create the App

  1. In the Microsoft Entra admin center, open Enterprise applications and choose New application, then Create your own application.
  2. Name it TagLogger, choose Integrate any other application you don’t find in the gallery (Non-gallery), and choose Create.
  3. Open Single sign-on and choose SAML.
  4. Under Basic SAML Configuration, choose Edit and paste the three values TagLogger shows:
Identifier (Entity ID)                       https://taglogger.com/sso/saml/<connection ID>
Reply URL (Assertion Consumer Service URL)   https://taglogger.com/__/auth/handler
Sign on URL                                  https://taglogger.com/login?sso=<connection ID>

Make the Identifier the default and save. The Sign on URL is what the TagLogger tile in My Apps opens, so users can start from either place.

Send the Email Address

  1. Under Attributes & Claims, choose Edit.
  2. Open Unique User Identifier (Name ID). Set the name identifier format to Email address. Set the source attribute to user.userprincipalname if your users’ sign-in names are their email addresses, otherwise user.mail.
  3. Choose Add new claim. Name it email, leave the namespace empty, and set the source attribute to user.mail.

The address Entra sends must be the one each person uses for TagLogger, at a verified domain.

Connect TagLogger to Entra

  1. Under SAML Certificates, copy the App Federation Metadata Url.
  2. In TagLogger, under Identity provider, choose Metadata URL, paste it, and save. TagLogger reads it daily, so a new Entra signing certificate is picked up by itself.
  3. Keep the certificate’s signing option at Sign SAML assertion, and leave Token encryption with no active certificate. TagLogger does not accept encrypted assertions.
  4. In Entra, open Users and groups and assign the people or groups who should use TagLogger.
  5. In TagLogger, choose Test sign-in and sign in as an assigned user at a verified domain. When the test passes, the owner turns the connection on.

Directory Sync

With directory sync, Entra adds people to TagLogger when you assign them and removes them when you unassign or disable them. In TagLogger, under Provisioning, choose Directory sync and Create token. Then in Entra:

  1. In the TagLogger app, open Provisioning and set the provisioning mode to Automatic.
  2. Under Admin Credentials, enter the tenant URL and the token as the secret token, then choose Test Connection and save.
Tenant URL     https://api.taglogger.com/scim/v2
Secret Token   <token from TagLogger>
  1. Under Mappings, leave Provision Microsoft Entra ID Groups on if access should follow groups, and assign those groups to the app. Turn it off if it should not.
  2. Under Settings, set the scope to Sync only assigned users and groups.
  3. Set the provisioning status to On and save. Entra’s first cycle can take a while; Provision on demand syncs one user right away.

Entra sends the user principal name as userName. A sign-in matches a synced user by that name or by email, so keep the Name ID and the email claim as above.

If many requests fail, Entra puts the provisioning job in quarantine and syncs less often. Check the provisioning logs in Entra, fix the cause, and restart provisioning.

See Also

Previous
Company Sign-In
Next
Okta