SSO Integration

Microsoft 365 SSO and Entra ID Integration for Peoplifi

Peoplifi supports enterprise-grade SAML 2.0 SSO with Microsoft 365 and Entra ID (formerly Azure AD). SCIM-based user provisioning keeps Peoplifi in sync with your Entra directory automatically, and approved time-off syncs to employee Outlook calendars. Group-based role mapping lets you control Peoplifi permissions from Entra, and Conditional Access policies (MFA, compliant device, named locations) flow through the SAML assertion so your existing zero-trust policies apply.

Try Peoplifi Free for 7 Days

How it works

  1. IT admin creates an Enterprise Application in Entra ID using the Peoplifi gallery template
  2. SAML 2.0 is configured with Peoplifi's ACS URL and Entity ID
  3. SCIM provisioning is enabled, syncing users and groups from Entra to Peoplifi automatically
  4. Employees sign in at peoplifi.com/login → Continue with Microsoft
  5. Time-off approvals push events to each employee's Outlook calendar

Features

SAML 2.0 SSO with Microsoft 365 / Entra ID / Azure AD
SCIM 2.0 automated user provisioning and deprovisioning
Group-based role mapping (Entra group → Peoplifi role)
Outlook calendar sync for approved time-off
Conditional Access supported (MFA, compliant device, named locations)
Audit logs for SSO events (SAML assertions, SCIM changes)
Just-in-time (JIT) account creation
Automated deprovisioning when an employee is offboarded in Entra

Setup Guide

  1. In Entra ID, go to Enterprise Applications → New Application and search for Peoplifi
  2. Configure SAML: Peoplifi provides the ACS URL and Entity ID on the setup screen
  3. Upload the Entra ID SAML metadata XML into Peoplifi
  4. Enable SCIM provisioning and paste the Peoplifi tenant URL + bearer token into Entra
  5. Assign users or groups to the Peoplifi app in Entra
  6. Test SSO by signing in from peoplifi.com/login with Continue with Microsoft
  7. Optionally enable Conditional Access for the Peoplifi application

Frequently Asked Questions

Is SCIM required or optional?

Optional. You can run SAML-only SSO without SCIM, but SCIM is strongly recommended for organizations with frequent joiner/mover/leaver events — it eliminates manual user management in Peoplifi.

Does this support Conditional Access?

Yes. Peoplifi respects all Entra ID Conditional Access policies: MFA requirements, compliant device checks, and named location restrictions all flow through the SAML assertion.

Can we restrict access to specific Entra groups?

Yes. In Entra ID, assign only specific users or groups to the Peoplifi Enterprise Application. Only those users will be provisioned into Peoplifi via SCIM.

What about Microsoft 365 GCC or GCC High?

GCC is supported on Business and Enterprise plans. GCC High and DoD environments require an enterprise contract — contact sales for details.

Is Power BI integration available?

Peoplifi exposes a Reporting API that you can connect to Power BI via a generic OData connector. A native Power BI app is on the roadmap.

How does this work with hybrid Azure AD / on-prem AD environments?

The integration uses cloud-based Entra ID (formerly Azure AD) for SCIM and SAML SSO. Hybrid customers running Azure AD Connect to sync from on-prem Active Directory will see those synced users available for SCIM provisioning to Peoplifi. The integration doesn't directly read on-prem AD.

Are Conditional Access policies enforced?

Yes. Because Peoplifi delegates authentication entirely to Entra ID via SAML, any Conditional Access policy you configure in Entra ID — MFA requirements, named-location restrictions, device compliance, sign-in-risk-based policies — applies automatically to Peoplifi sign-ins.

Deep dive: Microsoft 365

Why Microsoft 365 SSO matters for US enterprises

Microsoft 365 (formerly Office 365) is one of the most-deployed enterprise productivity suites in the US — particularly common in financial services, healthcare, government and government-contracting, manufacturing, and large corporates. For HR-tech adoption, integrating with Microsoft 365 / Entra ID provides several enterprise-grade benefits: SAML 2.0 SSO with Conditional Access enforcement; SCIM 2.0 user lifecycle automation; group-based role mapping through Microsoft 365 groups or Entra ID security groups; integration with Microsoft Teams for HR communications; and alignment with the security frameworks US enterprises have already deployed.

SAML 2.0 architecture and Entra ID integration

The Peoplifi-M365 integration uses SAML 2.0 federated authentication through Entra ID. When an employee attempts to sign in to Peoplifi, the application redirects to Entra ID; Entra ID applies any configured Conditional Access policies (MFA, device compliance, location restrictions, sign-in risk evaluation); on success, Entra ID returns a signed SAML assertion to Peoplifi which creates a session. The Peoplifi app is available in the Entra ID Application Gallery, simplifying setup compared to manual SAML configuration. Users can launch Peoplifi from their MyApps portal or sign in directly at Peoplifi's URL. The configuration is straightforward through the Enterprise Applications interface.

SCIM 2.0 for lifecycle automation

Beyond authentication, the integration supports SCIM 2.0 for full user lifecycle automation. New hires added to Entra ID groups (typically 'Peoplifi Users') are auto-provisioned in Peoplifi within minutes with name, email, manager, department, and other configured attributes. Profile changes flow automatically: department transfers, manager changes, title updates. Deprovisioning is the most security-critical workflow — when an employee is offboarded in Entra ID, their Peoplifi access is suspended within minutes, preventing the orphaned-account exposure that less-integrated stacks struggle with. SCIM provisioning is configured through Entra ID's Enterprise Applications interface with the Peoplifi tenant URL and bearer token.

Conditional Access and security policy enforcement

One of the most valuable benefits of Microsoft 365 integration is Conditional Access policy enforcement. US enterprise customers typically have sophisticated Conditional Access configurations including (1) **MFA requirements** — universal or risk-based MFA. (2) **Named-location restrictions** — limiting sign-ins to corporate office IP ranges or approved geographies. (3) **Device-compliance enforcement** — only managed and compliant devices can access SaaS apps. (4) **Sign-in-risk evaluation** — Microsoft Defender for Identity flags suspicious sign-in patterns. (5) **Application-specific policies** — different policies for different SaaS applications based on data sensitivity. Because Peoplifi delegates authentication entirely to Entra ID, all these policies apply to Peoplifi sign-ins automatically.

Microsoft Teams integration

For US customers using Microsoft Teams as their primary collaboration platform, Peoplifi integrates with Teams for HR communications similar to the Slack integration. Features include leave-request slash commands within Teams chat, approval notifications via Teams adaptive cards, weekly out-of-office summaries posted to designated Teams channels, and birthday/anniversary announcements. The Teams integration uses the same OAuth-based authentication as the SSO integration, supporting the identity model US enterprise customers already trust.

Ready to connect Microsoft 365 to Peoplifi?

Start free 7-day trial