Skip to main content

Microsoft Entra ID

Enterprise plan. Owner and Admin. You will also need someone who can edit the Entra enterprise app.

What you set up​

  1. Staff sign in to Bruchim with Entra (SSO).
  2. Entra provisioning creates, updates, and deactivates people on Users.
  3. Optional: Entra Office location sets Host locations and Primary location.

Directory Sync does not change Bruchim roles. New people join as Employee. Promote Owner, Admin, Location Manager, or Reception on Users. Owners and Admins keep Manage organization → Security.

Turn on SSO​

  1. Workspace switcher → Manage organization → Security.
  2. Add and verify your domain, choose Microsoft Entra, finish SAML, test, then turn the connection on.

You should see SSO with Active and your domain. That tab does not include Directory Sync.

You can also add a connection from Settings → General → Add connection.

Only Owners and Admins can open Security.

Bruchim Staff (email [email protected]): if Security is missing, ask us to enable enterprise SSO. Include the workspace name. Then sign out and in once.

Staff then use the usual Bruchim sign-in with their work account. SSO needs Enterprise. If you leave that plan, Entra sign-in stops until you upgrade again.

Turn on Directory Sync​

You cannot turn this on from Settings.

Bruchim Staff (email [email protected]): after SSO is Active, ask us to enable Directory Sync. Include the workspace name and domain. If people should appear only from Entra, not on first sign-in, say that in the email.

You: we reply with a provisioning URL (Tenant URL) and a secret token. You only get the token once. Store it like a password. Then paste those into Entra.

In Entra​

Open the Microsoft Entra admin center → Enterprise applications → the Bruchim app.

  1. Provisioning → Provisioning Mode: Automatic.
  2. Admin Credentials: Tenant URL and Secret token from our email.
  3. Test Connection, then Save.
  4. Provisioning Status: On, then Save.
  5. Assign the users or groups who should exist in Bruchim.
  6. Provision on demand for one person who has a work email, then check Users in Bruchim.

Keep the default mapping from mail to the work email. Entra must send a work email, not only a user name.

People from Directory Sync show a Directory sync badge, including when primary location is blank. They join as Employee unless you already invited them with another role. Promote Owner or Admin on Users. They keep Manage organization → Security.

If they are in Entra but not on Users​

  1. Confirm they are assigned to the enterprise app and provisioning succeeded.
  2. Have them sign in to Bruchim once.
  3. If they still do not appear, email [email protected] with the workspace name and their work email.

Map Office location to a host site​

Bruchim maps a short attribute name (usually office), not the Entra field name physicalDeliveryOfficeName.

Bruchim Staff​

Email [email protected] and ask to map Office location to host sites. Include the workspace name.

We:

  1. Create the attribute (name office).
  2. Send you the target attribute to add in Entra (paste it exactly).
  3. Finish the mapping on our side after you have provisioned someone who has Office filled in.

You (Entra)​

On the app's Attribute mapping page (Users):

  1. Open Advanced options (or Show advanced options on the older mapping page).
  2. Edit attribute list for the app. If that link is missing, ask us; we will send the Azure URL that unlocks the schema editor.
  3. Add a String attribute whose name is the target we sent.
  4. Save.
  5. Add attribute mapping: Direct. Source physicalDeliveryOfficeName (Office location). Target: that same name. Apply Always. Do not use it as a matching attribute.
  6. Save. Use Refresh if the new target does not appear yet.

You can leave the default row that also maps Office location to the formatted work address. Do not use addresses for host mapping in Bruchim.

Provision on demand a user whose Office location is not blank. An empty Office is not sent, so the mapping cannot be tested.

Then reply to the support thread so we can finish the connection-side map.

If the target we sent never appears, tell us. We can have you map Office location to enterprise organization (already in Entra's target list) instead.

You (Bruchim)​

Settings → General → Single sign-on & directory sync:

  1. Open Primary location and Host locations. They can use different rules.
  2. From an identity-provider attribute.
  3. Attribute key: office (or the name we confirmed).
  4. Add mapping. Attribute value must match Entra exactly (for example Toronto HQ).
  5. Pick the Bruchim location. On Host locations, Add location if they should host at more than one site.
  6. Set If the value is not mapped to a fallback, or leave No primary / All locations.

Directory-synced people get this on every sync. See Host and Admin locations.