Integrate Microsoft Entra ID SSO

Administrators only

Connect Microsoft Entra ID (formerly Azure Active Directory) to Tallyfy in about 30 minutes. Your users get automatic login and account creation - no separate passwords needed.

• Microsoft Entra ID administrator access
• A Tallyfy administrator account on any paid plan
• The Tallyfy SP values from the SSO wizard (shown when you pick Microsoft Entra ID)

1. Create a Microsoft Entra ID enterprise application
2. Configure SAML settings in both systems
3. Test the connection

You configure both Microsoft Entra ID and Tallyfy yourself. The Tallyfy SSO wizard is where you copy the SP values out and paste the Entra metadata back in.

Key points:

• Steps 1-7 are the one-time self-serve setup you run yourself across Tallyfy and Entra ID
• Steps 8-12 happen every time someone logs in
• No support ticket is needed to turn SSO on

1. Sign in to the Azure Portal ↗ with administrator credentials

2. Go to the Microsoft Entra ID service (may still show as Azure Active Directory in some interfaces)

3. Select Enterprise Applications from the Manage section

4. Click +New application

5. Choose Create your own application

   

1. Enter “Tallyfy” as the application name

2. Select Integrate any other application you don’t find in the gallery (Non-gallery)

3. Click Create

   

Assign users now or after setup - your choice:

1. In the application’s sidebar under Manage, select Single sign-on

2. Choose SAML as the sign-on method

   

1. Click Edit in the Basic SAML Configuration section.

   

2. In Tallyfy, go to Settings > Organization > Security > SSO.

3. Start a new connection and pick Microsoft Entra ID as the provider.

4. Copy the SP ACS URL and SP Entity ID shown on the first step of the wizard.

   

5. Copy Tallyfy’s SP ACS URL to Microsoft Entra ID’s Reply URL (Assertion Consumer Service URL) field.

6. Copy Tallyfy’s SP Entity ID to Microsoft Entra ID’s Identifier (Entity ID) field.

7. Click Save.

   

These must be exact - wrong names or capitalization will break user sync.

1. Configure Name Identifier (User ID): Click the Unique User Identifier (Name ID) row.

   

2. Select Persistent for Name identifier format.

3. Choose user.mail for Source attribute.

4. Click Save.

5. Configure First Name Attribute: Click the attribute row (typically user.givenname).

   

6. Set Name to: FirstName (capitalization matters).

7. Clear the Namespace field.

8. Set Source attribute to: user.givenname.

9. Click Save.

10. Configure Email attribute: Set Name to Email, clear Namespace, set Source attribute to user.mail. Click Save.

11. Configure Last Name attribute: Set Name to LastName, clear Namespace, set Source attribute to user.surname. Click Save.

Your final attribute config should look like this:

You need your Entra metadata. The simplest path is the metadata URL:

1. Go to the Set up section (it’s the SAML signing certificate area).

2. Copy the App Federation Metadata Url. Tallyfy can fetch this directly.

3. If you’d rather provide the values by hand, also copy the Login URL and Microsoft Entra ID Identifier, and download the Certificate (Base64).

   

Back in the Tallyfy SSO wizard (Settings > Organization > Security > SSO), move to the Enter IdP details step:

1. Metadata URL - paste the App Federation Metadata Url. Tallyfy fetches and parses it. Easiest option.

2. Manual entry - enter the Login URL, the Microsoft Entra ID Identifier, and the Certificate instead.

   

1. Run the wizard’s Test connection step and fix anything it flags.

2. Once the test passes, click Enable to turn SSO on.

   

1. Get your organization’s SSO login URL from the SSO wizard (it’s shown next to the connection)

2. Share this URL with your Microsoft Entra ID users

   

When users visit this URL:

• Existing Tallyfy users log in automatically
• New users from a verified domain get an account created on first login when auto-join is on. Verify your domain under the Domains tab first. See Domain verification.

Users can’t log in? Check these:

1. User is assigned to the Microsoft Entra ID application
2. Attribute mappings are exact (names and capitalization)
3. SAML certificate hasn’t expired
4. Users are using the SSO URL (not regular login)
5. Still stuck? Contact Tallyfy Support

SAML signs people in. SCIM keeps your directory in sync. With Entra provisioning on, Entra ID pushes user assignments and removals to Tallyfy automatically, so accounts track your directory and you stop paying for people who’ve left.

1. In Tallyfy, go to Settings > Organization > Security > SCIM and turn SCIM on
2. Copy the Base URL (this is the tenant URL) and the bearer token (the token shows once, so store it safely)
3. In Entra ID, open your Tallyfy enterprise app and go to the Provisioning tab, then set Provisioning Mode to Automatic
4. Under Admin Credentials, paste the Tallyfy Base URL into Tenant URL and the bearer token into Secret Token
5. Click Test Connection, save, then start provisioning

To map Entra groups to Tallyfy roles, provision groups whose names match Tallyfy’s reserved group names (for example tallyfy-admins). Full details are in SCIM provisioning.