Integrating Lucid with Azure enables your users to authenticate using SAML single-sign on through Microsoft Entra ID. Azure also offers a SCIM connection that allows you to provision users in your IDP. The following tutorial walks through the process of integrating Azure with Lucidchart and Lucidspark. You will need admin privileges in both Azure and Lucid to set up this integration.

Free	Individual	Team	Enterprise	FedRAMP

See the Upgrade your Lucid account article for instructions to upgrade.

Set up the Lucid (All Products) app in Azure

Log in to Azure.
From the home page, click Entra ID from the navigation menu on the left-hand side.
Select Enterprise Applications from the navigation menu on the left-hand side.
Click +New application at the top-left of the page.
Search “Lucid” and select the Lucid (All Products) tile.
Click Create.

The app created here is used for both SAML and SCIM.

Configure the SAML integration for Lucid via Azure Portal

To configure the SAML integration for Lucid via Azure Portal, follow these steps:

In Azure:

Select Entra ID from the navigation menu on the left-hand side of the Azure home page.
Select Enterprise Applications from the navigation menu on the left-hand side.
Open the Lucid (All Products) app.
In the app, navigate to ”Set up Single Sign-on" .
Under Single Sign-on Mode, select SAML.
Select Edit on your Basic SAML Configuration.
Change the Entity ID to "lucidchart.com".
- The default is “lucid.app”, which won’t work.
If you are on a commercial environment, update the Reply URLs and Sign on URL to match the following:
- Default Reply URL link: https://lucid.app/saml/sso/<yourdomainnamehere>
- Secondary Reply URL link: https://www.lucidchart.com/saml/sso/<yourdomainnamehere>
- Sign on URL link: https://lucid.app/saml/sso/<yourdomainnamehere>
If you are in the FedRAMP environment, refer to the FedRAMP overview article for your Sign on URL and the Default Reply URL you should use.
Click Save.
Confirm that the User Identifier is “user.userprincipalname”.
- All basic attributes and claims should be set up already by default.
Click Save.
Under “Federation Metadata XML” select Download to retrieve the IDP metadata.
- Do not open the XML file (metadata). You will upload the saved file into Lucid.

Note: If you have multiple domain names, we recommend choosing the domain that is most recognizable to your users. Then, make sure that the domain you choose to use for your Reply URLs and Sign on URL in steps 7 and 8 above matches what you set as the “Lucidchart Sign in URL” in step 4 of the following instructions.

In Lucid:

Select Admin.
Click Security in the left-hand menu.
From the dropdown options, click Authentication.
Select Configure to the right of the “Allow SAML authentication” option to navigate to your SAML Activation page in Lucid.
- You will not be able to enable SAML until you have populated your domain and uploaded metadata.
Under “Lucidchart Sign in URL”, enter your Domain name.
Click Save Changes.
Scroll down on the SAML Activation page of Lucidchart and click Add Identity Provider.
Upload the XML file (metadata) that you downloaded from Azure.
Click Test SAML connection to verify that Lucid is properly communicating with Azure.
- The connection will only work if the Lucid (All Products) app has been assigned to your test user in Azure. You can assign the app to users in the Assignments section of the app page. To do so, navigate to “Users and Groups” on the left hand side and click Assign.
Navigate back to the Security page.
Check the box next to “Allow SAML authentication”.
Click Save changes.

You have the option to use encrypted assertions for the identity providers you add for SAML to your Lucid account. To learn more, refer to our SAML overview article.

Note: You can select the Default Authentication method in Lucid, after you have checked the methods that you would like to allow as sign in options above. Users will be prompted to sign in using the default authentication you set up in the Security page.

Create users upon login with SAML

Once you have configured SAML with Azure for your Lucid account, you can set up Just-In-Time provisioning so that users assigned Lucid access in Azure who do not have a Lucid account will have an account created for them upon their first log-in.

Note: For this type of provisioning to work, you must have Domain Control enabled.

To enable new user creation for users assigned to the application:

Navigate to the “Properties” tab in your Lucid (All Products) application page within Azure.
Scroll to the bottom of the page and toggle the “User Assignment Required?” to ”No”.
Click Save.
Select Users and groups from the Manage menu.
Select and assign users and/or groups to access the Lucid (All Products) application.

You can then set up Just-In-Time provisioning in the License settings section of your Lucid admin panel.

If you would like all users to come onto your Lucidchart account with full-edit licenses, choose the following settings:
- Under the “Access eligibility” section, select Eligible for full access.
- Under “Customized eligibility criteria”, select Instant access.
If you want all users to come in as limited-access users, under the “Access eligibility” section select Only eligible for limited access.
- Your users will still be able to request full-edit licenses. Depending on the “When a user requests a license” setting, you can have licenses be automatically granted to users upon their request, or you can have the requests turn into pending requests in your user list.

Note: We strongly recommend that you have a custom request dialog if you have users requesting licenses from an admin.

Configure SCIM with the Lucid (All Products) application

You can use SCIM to create Lucid users before their first login and use Lucid organizational groups to assign them a Lucid Suite license. To provision users and groups, follow the steps below in the Lucid (All Products) app you created. If you haven’t set up the Lucid (All Products) app in Azure, you can see the steps in the section above.

Note: The instructions in this article for setting up SCIM are relevant if you are setting up SCIM for the first time for your Lucid Enterprise account. If you were already using SCIM prior to October 22nd, 2024, you need to migrate to the new organizational groups experience. See our Azure migration article for instructions.

Before configuring SCIM, complete the following in your Lucid account:

Confirm that you are on an Enterprise account with an up-to-date pricing plan. To upgrade, contact sales.
Contact your Lucid Customer Success Manager or contact support to request that SCIM be enabled for your account.
Make sure that auto-upgrade is enabled in your Licensing settings. You cannot generate a bearer token to configure SCIM if this setting is not enabled. You can turn off auto-upgrade after generating a bearer token to prevent unwanted licensing during the configuration process.

Create user groups

Create new or additional groups by following these steps:

Select Entra ID from the navigation menu on the left-hand side of the Azure home page.
Select Groups from the left-hand menu.
Follow the steps below to create both a “Lucid Suite Licensed Users” group and a “Lucid Suite Limited Access Users” group.

Create a “Lucid Suite Licensed Users” group

Click New Group.
Update the following settings:
- Group name: “Lucid Suite Licensed Users”
- Optionally, you can enter a group description.
Click Create.

Create a “Lucid Suite Limited Access Users” group

Click New Group.
Update the following settings:
- Group name: “Lucid Suite Limited Access Users”
- Optionally, you can enter a group description.
Click Create.

Assign groups to the Lucid (All Products) app

Now, you can assign the user groups that you created in the previous section to the Lucid (All Products) app by following these steps:

Navigate to the Lucid (All Products) app in Azure.
Click Users and Groups.
Follow the remaining instructions in this section to assign both groups appropriately.

Assign your “All Users” group

This should be the group to which all current and new users at your company are automatically added. This allows all assigned users to sign into the Lucid application, assuming SAML has been configured, and it is used to provision all users in this group into your default Lucid organizational group.

Note: There is no limit on the number of users you can have in this group within Lucid because they are provisioned as limited-access users by default. Users can have membership in this group until they leave the company.

To set up this “All Users” group, follow these steps:

Click Add user/group.
Under “Users and groups”, click None Selected.
Search for your “All User” group in Azure.
- For our example, we will use the name “All Users” but yours will likely be called something different.
Select the group.
Click Select.
Click Assign.

Assign the “Licensed User” group

This group will be used to assign a user a license in Lucid based on their membership to the group.

Note: Users assigned to this group can’t also be assigned to any other “Limited Access”, “Read-Only”, or “Delicensing” group. You can have a few different groups used to license users but users can only belong to one license or delicensing group at a time across all groups. The only exception to this rule is the “All Users” group.

To set up this “Licensed User” group, follow these steps:

Click Add user/group.
Under “Users and groups”, click None Selected.
Search for the “Lucid Suite Licensed User” group.
Select the group.
Click Select.
Click Assign in the bottom-left corner of the page.

Assign the “Limited Access User” group

This group will be used to delicense users from the Licensed User group to free up licenses for others to use.

Note: Users assigned to this group can’t also be assigned to the “Licensed User” group. Similar to the group above, you can have a few different groups used to remove licenses from users because each user can only belong to one license or delicensing group at a time across all groups. The only exception to this rule is the “All Users” group.

Click Add user/group.
Under “Users and groups”, click None Selected.
Search for the “Lucid Suite Limited Access User” group.
Select the group.
Click Select.
Click Assign.

If successful, your groups should look similar to this:

Obtain bearer token and enable SCIM provisioning

Obtain bearer token and configure SCIM settings in Lucid

Before enabling SCIM provisioning in Azure, you need to obtain a bearer token from Lucid and exclude your “All Users” group from your identity provider. To do this:

Sign in to Lucid as an account owner or account admin.
Select Admin from the menu to the left.
Click App Integration from the left-hand navigation menu.
On the SCIM tile, click Settings.
Click the Specify a group button under “Exclude a group from your identity provider”.
Type in the name of the “All Users Group” from Azure.
- Your “All Users Group” will most likely be named something different and it must be an exact text match with the name of your AD group.
- The purpose of this setting is to make it so that Lucid doesn’t license any of the users that belong to this “All User Group” and so that users can belong to this group in addition to either a licensed or a delicensing group.
Click Save.
Click Generate Token.
- If Generate Token is not clickable, ensure the “Automatically upgrade account when no more licenses are available” option is checked in your License settings and try again.

Enable SCIM provisioning

To enable SCIM provisioning in Azure, follow these steps:

Open the Lucid (All Products) app.
Select Provisioning from the navigation menu on the left-hand side.
Click Get started.
From the “Provisioning Mode” dropdown, select Automatic.
Under “Admin Credentials”, enter https://users.lucid.app/scim/v2/azure under “Tenant URL”.
Enter the bearer token under “Secret Token” using the token you obtained from Lucid in the steps above.
Click Test Connection.
If the connection is successful, click Save.

Test provisioning

After all the settings detailed above are saved, test the application to ensure it is functioning properly. To do this:

Assign a test user to the “Lucid Suite Licensed User Group”.
Open the Lucid (All Products) app.
Select Provisioning from the navigation menu on the left-hand side.
Click Provision on demand from the menu across the top of the page.
Enter the name of the test user you assigned to the Lucid Suite Licensed User Group.
Click Provision.

The same steps can be followed to test the “Limited Access User Group”.

If everything is working as intended, you will see green checkmarks next to all steps. You will also see that the modified attributes were successful in pulling over values like username, email, etc.

If you don’t see the checkmark icons, review the configuration steps above. If the user was provisioned successfully in your test, proceed to the next section.

Turn provisioning on in Azure

Now that you have completed the SCIM configuration steps and successfully ran a provisioning test, you can enable provisioning. To do so:

Navigate back to the “Lucid (All Products)” app in Azure.
Open the “Provisioning” page.
Click Start provisioning.
Wait while Azure provisions your users, groups, and memberships into Lucid.
- Once the “Current cycle status” shows as 100% complete, move on to the next section.

View Azure groups as organizational groups in Lucid

Double-check that you see the expected Azure groups as organizational groups in Lucid—this confirms the migration was successful. To access the organizational groups page in Lucid, follow these steps:

Navigate back to the Lucid admin panel.
Select Groups from the left-hand navigation menu.
From the dropdown menu, click Organizational groups.

If the Azure provisioning has finished, as we recommend ensuring before you move onto this section, you should now see your Azure groups as organizational groups on this page of the Lucid admin panel.

lucid-suite-scim-user-groups-visible-as-organizational-groups-in-lucid.png

Note: If you successfully followed the steps to exclude the All Users group in Azure from organizational groups, you won't see that group in the Lucid admin panel. Any users that aren’t added to one of the organizational groups you created to license or delicense users will instead be added to the “Default organizational group” automatically.

Configure license settings for each group

You’re now at the stage in the process where you can configure the license settings for each of your organizational groups. This ensures users are licensed or delicensed as intended when they are added to or removed from either of these groups. To access license settings, follow these steps:

Navigate to the Lucid admin panel.
Select License settings from the left-hand navigation menu.
From the dropdown menu, click Lucid Suite settings.
Proceed to the appropriate set of steps below to customize license settings for each organizational group.

License setting set up for licensed users group:

Click Lucid Suite Licensed Users from the list of organizational groups on the left-hand side of the licensing page.
Under the “Access eligibility” section, select Eligible for full access.
Under “Customized eligibility criteria”, select Instant access.
Click Save changes.

License setting set up for limited access group:

Click Lucid Suite Limited Access Users from the list of organizational groups on the left-hand side of the licensing page.
Under the “Access eligibility” section, select Only eligible for limited access.
Click Save changes.
In the pop-up window that appears, you will be informed that all current and future members of this group will be delicensed by Lucid.
- The purpose of this group is to host limited-access users here, so this is expected.
If you are in acceptance of the stipulations expressed above and in this pop-up confirmation window, click Save changes.

You have now completed all the steps to successfully configure the Lucid (All Products) app. License settings will now be managed via the organizational groups created via SCIM.

FAQ

What is the difference between Microsoft SSO and Azure SAML Sign-On?
Microsoft SSO and Azure SAML Sign-On are both managed from the Azure portal. SAML uses SAML2.0 protocol while MS SSO uses OAuth2.0 OpenID. Generally, SAML set-ups are considered more secure because the encryption is on the transport layer (SSL).

What happens to documents when I delicense a user via SCIM?
When you delicense or delete a user via SCIM, you must transfer their documents to another user on your Enterprise account. This does not apply when deactivating users.

By default, the account owner will be the recipient of the documents that are automatically transferred upon delicensing or deleting a user. You can change the recipient of the transferred documents by navigating to the SCIM integration settings in the Admin Panel and selecting Modify default owner to the right-hand side of the email address. See the screenshot below for reference.

Clicking Modify default owner redirects you to the “Document & Folder Settings” page of the Lucid admin panel where you can change the default document owner on your account. Refer to Lucid admin panel: Document and folders article for additional details.
change-recipient-of-documents-when-deleting-or-delicensing-users-via-SCIM.png

Resources

To learn more about this feature or to ask additional questions, explore the additional resources below. These resources are available in English only.

Community post

Instructions to update IDP metadata certificate (renew SSO cert)

Give feedback on this article

Have feedback about this article? Tell us about your experience here.

Related articles