Set up Krisp SSO and SCIM for a single team with Microsoft Entra ID

This article describes how to set up single sign-on (SSO) and SCIM user provisioning for a single Krisp team using Microsoft Entra ID (formerly Azure Active Directory). SSO lets your users log in with your company credentials, and SCIM keeps team membership in sync with your identity provider (IdP). Krisp SSO is based on SAML 2.0.

Set this up in order: configure and verify SSO first, then enable SCIM provisioning. SCIM should be enabled only after SSO sign-in works.

Open your Krisp SSO settings

In your Admin Portal, go to Security >>> Authentication. Enable the Enable SSO toggle and click SAML to open the Configure SAML panel. You will copy values from this panel into Entra, and paste Entra values back into it later. This article refers to it as your Krisp Settings.

Configure Microsoft Entra ID for SSO

To connect Krisp to Microsoft Entra ID, add Krisp to your list of managed SaaS apps as a custom application, then set up SAML SSO.

Create the custom app

1. Log in to the Microsoft Entra admin center with your admin account at https://portal.azure.com/#home
2. Go to Microsoft Entra ID from the left sidebar.
   
   
3. Click + Add >>> Enterprise application.
   
   
4. To add Krisp as an application, click Create your own application.
5. Give it a name (for example, Krisp_app) and click Create. Keep the Non-gallery option.
   
   

Set up single sign-on

1. Go to Set up single sign on.
   
   
2. Select SAML as the single sign-on method.
   
   
3. Edit the Basic SAML Configuration box.
   
   

4. Fill in the following fields from your Krisp Settings:

   • Identifier (Entity ID): click Add identifier and copy the Your team slug value from Krisp Settings into the field.
   • Reply URL (Assertion Consumer Service URL): click Add reply URL and copy the Reply URL (Assertion Consumer Service URL) value from Krisp Settings into the field.
   • Sign on URL (optional): copy the Single Sign On URL value from Krisp Settings into the field.

   Save these settings.

5. Edit the User Attributes & Claims box. Do not modify the existing attributes and claims.
   
   
6. Click + Add new claim.

7. Set the following values, then Save the changes:

   • Name: Email
   • Source: Attribute
   • Source attribute: user.mail

   

8. Download the Certificate (Base64) from the SAML Signing Certificate box.
   
   

Complete the SSO setup in Krisp

Return to your Krisp Settings and fill in the following:

1. Copy the Your team slug value from Krisp Settings into the Audience URI and Identity Provider Issuer fields.
2. Open the downloaded certificate in a text editor and copy it into the X.509 certificate field.
3. Copy the Login URL value from the Set up Krisp_app box in your Entra settings into the Identity Provider Single Sign On URL field.
   
   
4. Click Configure in Krisp Settings.
   
   

Assign users

1. In Entra, go to Getting Started >>> Assign users and groups >>> Add User/Group.
   
   
2. Click None Selected.
3. Choose the existing users you want to assign to the application and click Select.
   
   
4. Click Assign to assign the selected users to the application.

The assigned users can now log in to the Krisp team account through SSO. Test sign-in with one or two accounts before rolling SSO out more widely.

Enable SCIM provisioning

1. In your Admin Portal, go to Security >>> Authentication and click SCIM to open the Configure SCIM panel.
2. Turn on the Enable SCIM toggle.
   
   
3. In Entra, open the Krisp application, go to the Provisioning section, and click New configuration or Connect your application.
   
   

4. Set the authentication method to Bearer authentication, then:

   • Tenant URL: copy the SCIM Endpoint from the Configure SCIM settings in Krisp.
   • Secret Token: copy the SCIM Token from the Configure SCIM settings in Krisp.

   Test the connection and click Save after success.
   
   

Assign users through SCIM

1. Go to the Users and groups section and click + Add user/group.
2. Pick the users you want to assign to your Krisp team, click Select for each, then click Assign.
3. On the application Overview page, click Start provisioning.
   
   

Once provisioning completes, the assigned users take up the available unassigned seats in your Krisp team.

Provision users on demand

To add specific users or groups right away without waiting for the next cycle, use provision on demand.

1. In the Krisp application in Entra, go to Provision on demand.
2. In Select a user or group, search for the user or group you want to provision.
3. Click Provision. For a group, you can provision up to 5 members at a time.

The only thing your users need to do is:

• Install the Krisp app on their device
• Use the Sign in with SSO flow after landing on account.krisp.ai, and authenticate in the IdP.

Unassign users through SCIM

1. Remove the user from the Krisp application or from your IdP account.
   
   
2. On the application Overview page, click Start provisioning.

Once provisioning completes, the removed user is unassigned from the seat they occupied in your Krisp team.

If SSO or SCIM errors occur

If sign-in or provisioning fails, collect the details below and send them to the Krisp team so we can investigate:

• SSO sign-in errors: capture the SAML assertion. If your users see an error while signing in, also share a network log file that captures the error.
• SCIM provisioning errors: in Entra, go to Monitor >>> Provisioning logs and export the logs covering the time the error occurred.