Skip to main content

Microsoft Entra ID integration

Let your team sign in to Canny with Microsoft Entra ID (formerly Azure AD) and automatically revoke access for offboarded employees

Written by Canny

Overview

Let your teammates sign in to Canny with one click using Microsoft Entra ID, limit private boards to your organization, and automatically revoke access for offboarded employees.

Benefits

  • Manage access securely via Entra ID single sign-on (SSO)

  • Easy login access for your team

  • Automatically revoke access for offboarded employees

How to set up Microsoft Entra ID

Before you begin

  • Entra ID is only available on the Business plan in Canny. Just start a chat or email sales@canny.io to get a quote!

  • Owner-level admin permissions in Canny are required to connect the integration

  • You will also need to be an admin in Microsoft

Connecting the integration

  1. In Canny, go to Settings → Integrations → Microsoft Entra ID (open the settings page).

  2. Click Connect with Microsoft Entra ID.

  3. Back in Canny, you see Microsoft Entra ID connected with your organization's name.

Connecting adds an app called Canny under Enterprise applications in your Entra ID admin center. Microsoft uses it for sign-in.

Require admins to sign in with Microsoft

Turn on Enforce Microsoft Entra ID login to make every admin sign in with Entra ID before they can use the admin view. Email and password sign-in stops working for admins.

  1. Sign out of Canny and sign back in with Microsoft, so your own session uses Entra ID.

  2. On the Microsoft Entra ID settings page, turn on Enforce Microsoft Entra ID login.

  3. Click Save.

Warning: when you save, every admin who didn't sign in with Microsoft is signed out straight away, including you. Do step 1 first, and make sure your other admins can sign in with an Entra ID account.

Restrict private boards to your organization

A custom access board can require people to sign in with Entra ID. Anyone who signs in with an account from your Entra ID organization's verified domains gets access.

  1. In Canny, go to Settings → Boards and open the board.

  2. Set it up as a custom access board and choose Microsoft Entra ID as the way people verify.

  3. Repeat for each board that should be limited to your organization.

Admins listed on the Admins page can always see every board. This setting is for the people outside your admin team who leave feedback.

Set up automatic offboarding

Automatic offboarding uses SCIM provisioning: Microsoft Entra ID tells Canny when someone is disabled or removed, and Canny revokes their access. It works on every Entra ID plan, including Free, and takes about 10 minutes.

Canny uses SCIM only to remove access. It never creates Canny accounts or admins.

In Canny: get your tenant URL and token

  1. On the Microsoft Entra ID settings page, under Automatically revoke access from offboarded employees, click Set up SCIM.

  2. Copy the Tenant URL and the Secret token. The token is shown only once, so keep it somewhere safe until you've finished.

In Microsoft Entra ID: create the provisioning app

Sign in to the Microsoft Entra admin center as an Application Administrator or higher.

3. Go to Enterprise applications → New application → Create your own application.

4. Name it Canny SCIM provisioning, choose Integrate any other application you don't find in the gallery, and click Create.

In Microsoft Entra ID: connect it to Canny

5. In the new app, go to Provisioning and click New configuration.

6. Fill in:

7. Click Test connection, then Create.

In Microsoft Entra ID: map the Microsoft object ID

8. Go to Attribute mapping and open the Users tab.

9. Edit the row whose target attribute is externalId. Change its source attribute from mailNickname to objectId, then save.

This lets Canny recognize people even when their Canny email differs from their Entra ID email.

In Microsoft Entra ID: choose who's covered

10. Go to Scoping filters.

11. Under Scope settings, open the Groups tab and set Enable group provisioning to Disabled.

12. Under Scope by assignment, choose Sync only assigned users and groups, then Review and create.

13. Go to Users and groups, click Add user/group, and assign the people whose access Canny should manage.

Test it, then start provisioning

14. Go to Provision on demand, pick one assigned person, and click Provision. Entra ID shows each step and reports that the user was created.

15. In Canny, the SCIM section now says Microsoft Entra ID is syncing (1 person).

16. Back in Entra ID, open the app's Overview and click Start provisioning.

In Canny: choose what to revoke

  1. Under When someone is offboarded, turn on Revoke admin account, Revoke private board access, or both.

  2. Click Save.

When someone is offboarded, Canny always signs them out. With both settings off, they keep their admin account and private board access.

Switch an existing integration to SCIM

If you connected Entra ID before October 2026, offboarding runs through the Microsoft account of the admin who connected it. Switching to SCIM means Canny stores no Microsoft credentials, and offboarding keeps working if that admin leaves. Your current offboarding keeps running until you finish the switch.

  1. On the Microsoft Entra ID settings page, find Switch offboarding to SCIM and click Start switch.

  2. Copy the Tenant URL and Secret token, then follow the steps in Set up automatic offboarding above, starting from In Microsoft Entra ID: create the provisioning app.

  3. When Canny shows Microsoft Entra ID is syncing, click Finish switch and confirm.

  4. Remove the old permissions in Microsoft Entra ID (see section below).

Finishing the switch deletes the Microsoft credentials Canny stored for your organization. Your boards, Microsoft sign-in requirement and offboarding settings stay exactly as they were. Don't uninstall and reconnect the integration to switch: uninstalling resets your boards' verification.

If Canny shows Offboarding has stopped, the original connection no longer works. Set up SCIM to turn offboarding back on; once Entra ID is syncing, click Finish switch to remove the old connection.

Remove the old permissions in Microsoft Entra ID

After you finish the switch, Microsoft still lists the directory permissions the original connection used. Remove them so Canny can no longer be granted access to your directory.

  1. In the Microsoft Entra admin center, go to Enterprise applications and open Canny. This is the sign-in app, not the Canny SCIM provisioning app you created.

  2. Go to Security → Permissions and open the Admin consent tab.

  3. For each of these permissions, open the ⋯ menu and choose Revoke permission:

    • Directory.Read.All

    • Group.Read.All

    • User.Read.All

    • Organization.Read.All

    • offline_access

Keep openid, email, profile and User.Read. Canny uses them for Microsoft sign-in, and removing them makes everyone approve Canny again.

FAQ and troubleshooting

How quickly does Canny revoke access?

Microsoft Entra ID syncs about every 40 minutes. To apply one person's change right away, use Provision on demand on the Canny SCIM provisioning app.

Why are there two Canny apps in Enterprise applications?

Canny is created when your organization first signs in to Canny, and handles Microsoft sign-in. Canny SCIM provisioning is the app you created for offboarding. Keep both.

Does SCIM create Canny accounts or admins?

No. Canny stores a record of each synced person and only uses it to revoke access.

Who does Canny revoke?

People whose email or Microsoft account matches the synced user and who have used your Canny workspace. Canny only matches addresses on your organization's verified domains, so guest accounts from other organizations aren't revoked through SCIM.

The test connection is failing, what's wrong?

Check that the Tenant URL is exactly https://api.canny.io/api/scim/v2 and that you used the latest token. If you've lost the token, generate a new one in Canny.

The provisioning logs show errors for groups, what's wrong?

Canny doesn't support group provisioning. Set Enable group provisioning to Disabled under Scoping filters → Scope settings → Groups.

Why is a user not signed out after being disabled?

Check that they're assigned to the Canny SCIM provisioning app, that the externalId mapping uses objectId, and that their email is on one of your organization's verified domains.

Related Articles:

Did this answer your question?