Skip to main content

Microsoft Entra ID

Enterprise plan. Owner and Admin. You will also need someone who can edit the Entra enterprise app.

What you set up​

  1. Staff sign in to Bruchim with Entra (SSO).
  2. Entra provisioning creates, updates, and deactivates people on Users.
  3. Optional: Entra Office location sets Host locations and Primary location.

Turn on SSO​

  1. Workspace switcher → Manage organization → Security.
  2. Add and verify your domain (DNS TXT).
  3. Choose Microsoft Entra, finish SAML, test, then turn the connection on.

You should see SSO with Active and your domain. That tab does not include Directory Sync.

Only Owners and Admins can open Security.

Bruchim Staff (email [email protected]): if Security is missing, ask us to enable enterprise SSO. Include the workspace name.

Staff then use the usual Bruchim sign-in with their work account. See SSO and directory sync.

Turn on Directory Sync​

Self-serve UI coming soon. You cannot turn this on from Manage organization.

  1. Email [email protected] after SSO is Active. Ask Bruchim Staff to enable Directory Sync. Include the workspace name and domain.
  2. We reply with a provisioning URL (Tenant URL) and a secret token. You only get the token once. Store it like a password.
  3. If people should appear only from Entra, not on first sign-in, say that in the email.

In Entra​

Open the Microsoft Entra admin center → Enterprise applications → the Bruchim app.

  1. Provisioning → Provisioning Mode: Automatic.
  2. Admin Credentials: Tenant URL and Secret token from our email.
  3. Test Connection, then Save.
  4. Provisioning Status: On, then Save.
  5. Assign the users or groups who should exist in Bruchim.
  6. Provision on demand for one person who has a work email, then check Users in Bruchim.

Keep the default mapping from mail to the work email. Entra must send a work email, not only a user name.

People from Directory Sync show a Directory sync badge. They join as Employee unless you already invited them with another role. Entra or organization Member is not the Bruchim role. Change Owner, Admin, Location Manager, or Reception on Users.

If they are in Entra but not on Users​

  1. Confirm they are assigned to the enterprise app and provisioning succeeded.
  2. Have them sign in to Bruchim once.
  3. If they still do not appear, email [email protected] with the workspace name and their work email.

Map Office location to a host site​

Bruchim maps a short attribute name (usually office), not the Entra field name physicalDeliveryOfficeName.

Bruchim Staff​

Email [email protected] and ask to map Office location to host sites. Include the workspace name.

We:

  1. Create the attribute (name office).
  2. Send you the target attribute to add in Entra (paste it exactly).
  3. Finish the mapping on our side after you have provisioned someone who has Office filled in.

You (Entra)​

On the app’s Attribute mapping page (Users):

  1. Open Advanced options (or Show advanced options on the older mapping page).
  2. Edit attribute list for the app. If that link is missing, ask us; we will send the Azure URL that unlocks the schema editor.
  3. Add a String attribute whose name is the target we sent.
  4. Save.
  5. Add attribute mapping: Direct. Source physicalDeliveryOfficeName (Office location). Target: that same name. Apply Always. Do not use it as a matching attribute.
  6. Save. Use Refresh if the new target does not appear yet.

You can leave the default row that also maps Office location to the formatted work address. Do not use addresses for host mapping in Bruchim.

Provision on demand a user whose Office location is not blank. An empty Office is not sent, so the mapping cannot be tested.

Then reply to the support thread so we can finish the connection-side map.

If the target we sent never appears, tell us. We can have you map Office location to enterprise organization (already in Entra’s target list) instead.

You (Bruchim)​

Settings → General → Host locations for provisioned people:

  1. From an identity-provider attribute.
  2. Attribute key: office (or the name we confirmed).
  3. Add mapping. Attribute value must match Entra exactly (for example Toronto HQ).
  4. Pick the Bruchim location.
  5. Set If the value is not mapped to a fallback location, or leave it as All locations.

Directory-synced people get this on every sync. See Host and Admin locations.