Enable Microsoft Entra ID SAML and SCIM in Lucid

Set up the Lucid for admin management app in Microsoft Entra ID

1. Log in to Azure.
2. From the home page, click Entra ID from the navigation menu on the left-hand side.
3. Select Enterprise Applications from the navigation menu on the left-hand side.
4. Click +New application at the top-left of the page.
5. Search “Lucid” and select the Lucid (All Products) tile.
   • We recommend if you are planning to use SCIM, that you label this app in Entra ID as “Lucid for admin management” as if you decide to also leverage SCIM, there are two Lucid apps that we recommend.
6. Click Create.

The app created here is used for both SAML and SCIM.

Configure the SAML integration for Lucid via Azure Portal

To configure the SAML integration for Lucid via Azure Portal, follow these steps:

In Azure:

1. Select Entra ID from the navigation menu on the left-hand side of the Azure home page.
2. Select Enterprise Applications from the navigation menu on the left-hand side.
3. Open the Lucid (All Products) app and rename it to "Lucid for admin management".
4. In the app, navigate to ”Set up Single Sign-on" .
5. Under Single Sign-on Mode, select SAML.
6. Select Edit on your Basic SAML Configuration. 
7. Change the Entity ID to "lucidchart.com".
   • The default is “lucid.app”, which won’t work.
8. If you are on a commercial environment, update the Reply URLs and Sign on URL to match the following: 
   • Default Reply URL link: https://lucid.app/saml/sso/<yourdomainnamehere>
   • Secondary Reply URL link: https://www.lucidchart.com/saml/sso/<yourdomainnamehere>
   • Sign on URL link: https://lucid.app/saml/sso/<yourdomainnamehere> 
     
     
9. If you are in the FedRAMP environment, refer to the FedRAMP overview article for your Sign on URL and the Default Reply URL you should use.
10. Click Save.
11. Confirm that the User Identifier is “user.userprincipalname”. 
    • All basic attributes and claims should be set up already by default.
12. Click Save.
13. Under “Federation Metadata XML” select Download to retrieve the IdP metadata. 
    • Do not open the XML file (metadata). You will upload the saved file into Lucid.

In Lucid:

1. Select Admin.
2. Click Security in the left-hand menu.
3. From the dropdown options, click Authentication.

4. Select Configure to the right of the “Allow SAML authentication” option to navigate to your SAML Activation page in Lucid.

   • You will not be able to enable SAML until you have populated your domain and uploaded metadata.

     

5. Under “Lucidchart Sign in URL”, enter your Domain name.
   
6. Click Save Changes.
7. Scroll down on the SAML Activation page of Lucidchart and click Add Identity Provider.
8. Upload the XML file (metadata) that you downloaded from Entra ID.
   • If you already have IdP metadata from Entra ID that was previously uploaded into Lucid and need to update it, follow the instructions in our SAML overview article.
9. Click Test SAML connection to verify that Lucid is properly communicating with Microsoft Entra ID.
   • The connection will only work if the Lucid  for admin management app has been assigned to your test user in Entra ID. You can assign the app to users in the Assignments section of the app page. To do so, navigate to “Users and Groups” on the left hand side and click Assign. 
10. Navigate back to the Security page. 
11. Check the box next to “Allow SAML authentication”.
12. Click Save changes.
    

After enabling SAML in Lucid, a account admin will need to provide a one-time authorization within the Microsoft Entra ID console to finalize the connection. Until this is granted, users attempting to log in may be prompted to contact their administrator.

You have the option to use encrypted assertions for the identity providers you add for SAML to your Lucid account. To learn more, refer to our SAML overview article.

Create users upon login with SAML

Once you have configured SAML with Microsoft Entra ID for your Lucid account, you can set up Just-In-Time provisioning so that users assigned Lucid access in Entra ID who do not have a Lucid account will have an account created for them upon their first log-in.

Note: For JIT provisioning to work as intended, you should have domain control enabled and have the user verification method set to SAML.

To enable new user creation for users assigned to the application:

1. Navigate to the “Properties” tab in your Lucid  for admin management application page within Entra ID.
2. Scroll to the bottom of the page and toggle the “User Assignment Required?” to ”No”. 
3. Click Save.
4. Select Users and groups from the Manage menu. 
5. Select and assign users and/or groups to access the Lucid  for admin management application.

You can then customize Just-In-Time provisioning in the License settings section of your Lucid admin panel, depending on the access you want users to have. Here are the options:

• If you would like all users to come onto your Lucidchart account with full-edit licenses, choose the following settings:
  • Under the “Access eligibility” section, select Eligible for full access.
  • Under “Customized eligibility criteria”, select Instant access.
• If you want all users to come in as limited-access users, under the “Access eligibility” section select Only eligible for limited access.
  • Your users will still be able to request full-edit licenses. Depending on the “When a user requests a license” setting, you can have licenses be automatically granted to users upon their request, or you can have the requests turn into pending requests in your user list.

Configure SCIM for the Lucid Suite in Entra ID

You can use SCIM to create Lucid users before their first login and use Lucid organizational groups to assign them a Lucid Suite license. To provision users and groups, follow the steps below in the Lucid for admin management app you created. If you haven’t set up the Lucid for admin management app in Entra ID, you can see the steps in the section above.

Before configuring SCIM, complete the following in your Lucid account:

• Confirm that you are on an Enterprise account with an up-to-date pricing plan. To upgrade, contact sales.
• Make sure that auto-upgrade is enabled in your Licensing settings. This can be done only by account owners or admins with both the billing admin and account admin roles. 
  • You will be unable to generate bearer tokens to configure SCIM if this setting is not enabled. You may want to turn off auto-upgrade after generating bearer tokens to prevent unwanted licensing during the configuration process.

Once you have followed the pre-configuration steps listed above, you can configure both SCIM for admin management and SCIM for content access for the Lucid Suite in Entra ID by generating separate bearer tokens in Lucid and then using them in Entra ID To learn more about the differences and value of each app, refer to our SCIM overview for Lucid article.

Obtain bearer tokens and configure SCIM settings in Lucid

Before enabling SCIM provisioning in Entra ID, you need to obtain bearer tokens from Lucid. To do this:

1. Sign in to Lucid as an account owner or account admin.
2. Select Admin from the menu to the left.
3. Click App Integration from the left-hand navigation menu.
4. On the relevant SCIM tile, select Settings (or Install).
   • To set up both apps, you will need to separately follow the remaining steps for SCIM for admin management and SCIM for content access. You will generate a separate bearer token for each app.
5. Click Enable SCIM.
6. Click Save.
7. Click Generate Token.
   • If Generate Token is not clickable, ensure the “Automatically upgrade account when no more licenses are available” option is checked in your License settings and try again.
8. Copy the bearer token.
9. Under “Exclude groups from your identity provider”, click Edit to the far-right.
10. Type in the name of the “All Users Group” from Entra ID and any other groups you wish to exclude.
    • Your “All Users Group” will most likely be named something different and it must be an exact name match (case isn’t sensitive) with the name of your Microsoft Entra ID group.
11. Click Save.

Configure integration(s) and use bearer token(s) in Entra ID

Depending on whether you are looking to use SCIM for admin management, SCIM for content access, or both, the steps here will slightly differ.

Configuration for SCIM for admin management

To enable SCIM for admin management provisioning in Microsoft Entra ID, follow these steps:

1. Open the Lucid for admin management app.
2. Select Provisioning from the navigation menu on the left-hand side.
3. Click Get started.
4. From the “Provisioning Mode” dropdown, select Automatic.
5. Under “Admin Credentials”, enter https://users.lucid.app/scim/v2/azure under “Tenant URL”.
6. Enter the bearer token generated by Lucid from the SCIM for admin management under “Secret Token”.
7. Click Test Connection.
   
8. If the connection is successful, click Save.

Configuration for SCIM for content access

1. Log into Entra ID as an admin.
2. Select Entra ID from the navigation menu on the left-hand side of the Azure home page.
3. Select Enterprise Applications from the navigation menu on the left-hand side.
4. Create a new app from the Lucid (All Products) app and rename it to "Lucid for content access".
   • This will allow you to differentiate this Lucid app in Entra ID from the Lucid SCIM for admin management app that you may be using from the instructions above.
5. Select Provisioning from the navigation menu on the left-hand side.
6. Click Get started.
7. From the “Provisioning Mode” dropdown, select Automatic.
8. Under “Admin Credentials”, enter https://users.lucid.app/scim/v2/azure under “Tenant URL”.
9. Enter the bearer token under “Secret Token” using the token you obtained from the Lucid for content access tile in the steps above.
10. Click Test Connection.
    
11. If the connection is successful, click Save.

Set up SCIM for admin management

The groups that you set up for SCIM for admin management will be used to manage licensing and granular admin controls at scale, including attribute management (e.g. cost center, region, etc). These groups can also be used to automatically provision users and Lucid org groups to reflect company hierarchy.

Create user groups

Create new or additional groups by following these steps:

1. Select Entra ID from the navigation menu on the left-hand side of the Azure home page.
2. Select Groups from the left-hand menu.
3. Follow the steps below to create licensing user groups.

Create licensing groups

1. Click New Group.
2. Update the following settings:
   • Group name: [input desired name here]
   • Optionally, you can enter a group description.
3. Click Create.
4. Repeat these steps for as many licensing groups as you want.

Assign groups to the Lucid for admin management app

Now, you can assign the user groups that you created in the previous section to the Lucid fior admin management app by following these steps:

1. Navigate to the Lucid for admin management app in Entra ID.
2. Click Users and Groups.
3. Follow the remaining instructions in this section to assign both groups appropriately.

Assign your “All Users” group

This should be the group to which all current and new users at your company are automatically added. This allows all assigned users to sign into the Lucid application, assuming SAML has been configured, and it is used to provision all users in this group into your default Lucid organizational group.

To set up this “All Users” group, follow these steps:

1. Click Add user/group.
2. Under “Users and groups”, click None Selected.
3. Search for your “All User” group in Entra ID. 
   • For our example, we will use the name “All Users” but yours will likely be called something different.
4. Select the group.
5. Click Select.
6. Click Assign.
   

Assign the "Licensed User" group(s)

These groups will be used to assign a user a license in Lucid based on their membership to the group.

To set up this “Licensed User” group, follow these steps:

1. Click Add user/group.
2. Under “Users and groups”, click None Selected.
3. Search for your desired license group.
4. Select the group.
5. Click Select.
   
6. Click Assign in the bottom-left corner of the page.

Test provisioning

After all the settings detailed above are saved, test the application to ensure it is functioning properly. To do this:

1. Assign a test user to one of your licensing groups.
2. Open the Lucid for admin management app.
3. Select Provisioning from the navigation menu on the left-hand side.
4. Click Provision on demand from the menu across the top of the page.
5. Enter the name of the test user you assigned to the licensing group.
6. Click Provision.

If everything is working as intended, you will see green checkmarks next to all steps. You will also see that the modified attributes were successful in pulling over values like username, email, etc.

If you don’t see the checkmark icons, review the configuration steps above. If the user was provisioned successfully in your test, proceed to the next section.

Turn provisioning on in Microsoft Entra ID

Now that you have completed the SCIM configuration steps and successfully ran a provisioning test, you can enable provisioning. To do so:

1. Navigate back to the Lucid for admin management app in Entra ID.
2. Open the “Provisioning” page.
3. Click Start provisioning.
4. Wait while Entra ID provisions your users, groups, and memberships into Lucid.
   • Once the “Current cycle status” shows as 100% complete, move on to the next section.

View Microsoft Entra ID groups as organizational groups in Lucid

Double-check that you see the expected Microsoft Entra ID for admin management groups as organizational groups in Lucid—this confirms the migration was successful. To access the organizational groups page in Lucid, follow these steps:

1. Navigate back to the Lucid admin panel.
2. Select Groups from the left-hand navigation menu.
3. From the dropdown menu, click Organizational groups.

If the Entra ID provisioning has finished, as we recommend ensuring before you move onto this section, you should now see your Microsoft Entra ID groups from the Lucid SCIM for admin management app as organizational groups on this page of the Lucid admin panel.

Configure license settings for each group

You’re now at the stage in the process where you can configure the license settings for each of your organizational groups. This ensures users are licensed or delicensed as intended when they are added to or removed from any of these groups. To access license settings, follow these steps:

1. Navigate to the Lucid admin panel.
2. Select License settings from the left-hand navigation menu.
3. From the dropdown menu, click Lucid Suite settings.
4. Proceed to the appropriate set of steps below to customize license settings for each organizational group.

License setting set up for licensed users group:

1. Select your desired licensing group from the list of organizational groups on the left-hand side of the licensing page.
2. Under the “Access eligibility” section, select Eligible for full access.
3. Under “Customized eligibility criteria”, select Instant access.
4. Click Save changes.
5. Repeat these steps for any additional licensing groups.

You have now completed all the steps to successfully configure the Lucid for admin management app. License settings will now be managed via the organizational groups created via SCIM.