Connecting Azure AD / Entra ID to Landfall

Two independent connections, both configured from Landfall's Settings → Security screen: Entra ID as your organization's sign-in provider (OIDC), and Entra ID as the source of truth for who's on your team (SCIM, via an Enterprise Application's provisioning feature).

What you'll need

• An Entra ID role that can register applications (Application Administrator or Global Administrator).
• An admin seat on your Landfall organization.
• Entra ID P1/P2 (or equivalent) for the automatic SCIM provisioning feature — a free tenant can still be used for manual sign-in only.

Part 1 — Sign-in (OIDC)

1. Entra admin center → App registrations → New registration

   Name it "Landfall". Under Supported account types, choose single tenant unless you specifically want to allow sign-in from other Entra tenants too.

   entra.microsoft.com/.../App registrations/RegisterApp

   🖼Entra ID's "Register an application" form.

2. Redirect URI (platform: Web)

   Open Landfall's Settings → Security → Single sign-on panel first for the exact value to paste as the Web redirect URI:

   https://<your-landfall-domain>/o/<your-org-slug>/auth/sso/callback

3. Create a client secret, copy the tenant/client IDs

   Under Certificates & secrets, create a new client secret and copy its value immediately — Entra never shows it again either. The issuer Landfall needs is:

   https://login.microsoftonline.com/<tenant-id>/v2.0

   Paste the display name, issuer, the app's Application (client) ID, and the client secret into Landfall's Single sign-on panel and save.

4. Run a test sign-in, then activate

   Click Run a test sign-in, complete it as yourself, then Activate for everyone — required before any teammate can sign in through this provider.

Part 2 — User provisioning (SCIM)

1. Enable SCIM in Landfall first

   In Landfall's Settings → Security → SCIM provisioning panel, click Enable SCIM. Copy the base URL and the one-time bearer token.

2. Entra admin center → Enterprise applications → New application → Create your own application

   Choose "Integrate any other application you don't find in the gallery (Non-gallery)". This is a separate object from the app registration in Part 1, even though it can share the same name.

3. Provisioning tab → Automatic

   Open the new enterprise application's Provisioning tab, set mode to Automatic, and expand Admin Credentials.

   entra.microsoft.com/.../Provisioning/Overview

   🖼Entra ID's Provisioning "Admin Credentials" panel with Tenant URL and Secret Token fields, plus the "Test Connection" button.

4. Paste the base URL and token, test the connection

   Set Tenant URL to the base URL from Landfall's panel and Secret Token to the bearer token — Entra sends it as Authorization: Bearer <token>. Click Test Connection, save, then set Provisioning Status to On.

5. Assign users or groups, and map a group to a Landfall role (optional)

   Under the enterprise application's Users and groups, assign who should be provisioned — Entra provisions only assigned users/groups, unlike some other providers' "sync everyone" default. To grant a specific role, add a matching row in Landfall's SCIM panel (group name → role key); an unmapped group falls back to Landfall's default role.

Entra ID console steps last verified against Microsoft's own documentation: 2026-09-11.