Integrating Lucid with Azure enables your users to authenticate using SAML single-sign on through Azure. Azure also offers a SCIM connection that allows you to provision users in your IDP. The following tutorial walks through the process of integrating Azure with Lucidchart and Lucidspark. You will need admin privileges in both Azure and Lucid to set up this integration.

This integration is only available to Enterprise accounts. See the Upgrade your Lucid account article for instructions to upgrade.

Configure the SAML integration for Lucid via Azure Portal

To configure the SAML integration for Lucid via Azure Portal, follow these steps:

In Azure:

Log in to Azure.
From the home page, click Azure Active Directory from the navigation menu on the left-hand side.
Select Enterprise Applications from the navigation menu on the left-hand side.
Click +New application at the top-left of the page.
Search “Lucid” and select the Lucid (All Products) tile.
Click Create.
In the app, navigate to ”Set up Single Sign-on" .
Under Single Sign-on Mode, select SAML.
Select Edit on your Basic SAML Configuration. Your settings in Azure should look like the example below:
- Entity ID: lucidchart.com
- Default Reply URL link: https://lucid.app/saml/sso/<yourdomainnamehere>
- Secondary Reply URL link: https://www.lucidchart.com/saml/sso/<yourdomainnamehere>
- Sign on URL link: https://lucid.app/saml/sso/<yourdomainnamehere>
Click Save.
Confirm that the User Identifier is “user.userprincipalname”.
- All basic attributes and claims should be set up already by default.
Click Save.
Under “Federation Metadata XML” select Download to retrieve the IDP metadata.
- Do not open the XML file (metadata). You will upload the saved file into Lucid.

In Lucid:

Select Admin.
Click Identity management in the left-hand menu.
Select Configure to the right of the “Allow SAML authentication” option to navigate to your SAML Activation page in Lucid.
- You will not be able to enable SAML until you have populated your domain and uploaded metadata.
Under “Lucidchart Sign in URL”, enter your Domain name.
Click Save Changes.
Scroll down on the SAML Activation page of Lucidchart and click Add Identity Provider.
Upload the XML file (metadata) that you downloaded from Azure.
Click Test SAML connection to verify that Lucid is properly communicating with Azure.
- The connection will only work if the Lucid (All Products) app has been assigned to your test user in Azure. You can assign the app to users in the Assignments section of the app page. To do so, navigate to “Users and Groups” on the left hand side and click Assign.
Navigate back to the Identity management page.
Check the box next to “Allow SAML authentication”.
Click Save changes.

Note: You can select the Default Authentication method in Lucid, after you have checked the methods that you would like to allow as sign in options above. Users will be prompted to sign in using the default authentication you set up in the Identity management page.

Create users upon login with SAML

Once you have configured SAML with Azure for your Lucid account, you can set up Just-In-Time provisioning so that users assigned Lucid access in Azure who do not have a Lucid account will have an account created for them upon their first log-in.

Note: For this type of provisioning to work, you must have Domain Control enabled.

To enable new user creation for users assigned to the application:

Navigate to the “Properties” tab in your Lucid (All Products) application page within Azure.
Scroll to the bottom of the page and toggle the “User Assignment Required?” to ”No”.
Click Save.
Select Users and groups from the Manage menu.
Select and assign users and/or groups to access the Lucid (All Products) application.

You can then set up Just-In-Time provisioning in the License settings section of your Lucid admin panel.

If you would like all users to come onto your Lucid team with full-edit licenses, set the setting for “When a new user joins a team” to “Automatically grant license.”
If you want all users to come in as limited-access users, set the setting for “When a new user joins a team” to “Do not automatically grant.” Your users will then be able to request full-edit licenses. Depending on the “When a user requests a license” setting, you can have licenses automatically granted to users upon their request, or you can have the requests turn into pending requests in your user list.

Note: We strongly recommend that you have a custom request dialog if you have users requesting licenses from an admin.

Configure SCIM with the Lucid (All Products) application

Set up the Lucid SCIM integration by using the Lucid (All Products) app from the Azure AD Gallery. You can use SCIM to create Lucid users before their first login and to assign them a specific license type.

Before configuring SCIM, you need to do the following:

Confirm you are on an Enterprise account with an up-to-date pricing plan. To upgrade, contact our sales team.
Contact your Lucid Customer Success Manager or contact support to request SCIM be enabled for your account.

Once you finish the pre-configuration steps listed above, configure SCIM for Lucid in Azure by following these steps:

Log in to Azure.
From the home page, click Azure Active Directory from the navigation menu on the left-hand side.
Select Enterprise Applications from the navigation menu on the left-hand side.
Click +New application at the top-left of the page.
Search “Lucid” and select the Lucid (All Products) tile.
Click Create.

Create app roles

To create app roles:

Select Azure Active Directory from the navigation menu on the left-hand side of the Azure home page.
Click App registrations from the navigation menu on the left-hand side.
Select the All applications tab.
Click the Lucid (All Products) app.

Configure “Licensed User” app role

Select App roles from the menu on the left-hand side.
Click User from the existing app roles.
Update the following settings. The text must be typed exactly as shown below:
- Display name: Change from “User” to “Licensed User”
- Value: Type in the value “true”
- Description: Change from “User” to “Licensed User”
Click Apply.

Configure “Limited Access User” app role

Select App roles from the menu on the left-hand side.
Click msiam_access from the existing app roles.
Update the following settings. The text must be typed exactly as shown below:
- Display name: Change from “msiam_access” to “Limited Access”
- Value: Type in the value “false”
- Description: Change from “msiam_access” to “Limited Access”
Click Apply.

Create user groups

Create new or additional groups by following these steps:

Select Azure Active Directory from the navigation menu on the left-hand side of the Azure home page.
Click Groups from the navigation menu on the left-hand side.

Create a “Lucid Suite Licensed Users” group

Click New Group.
Update the following settings:
- Group name: “Lucid Suite Licensed Users”
- Enter a Group description (optional)
Click Create.

Create a “Lucid Suite Limited Access Users” group

Click New Group.
Update the following settings:
- Group name: “Lucid Suite Limited Access Users”
- Enter a Group description (optional)
Click Create.

Assign groups to the Lucid (All Products) app

Select Azure Active Directory from the navigation menu on the left-hand side of the Azure home page.
Select Enterprise Applications from the navigation menu on the left-hand side.
Open the Lucid (All Products) app.
Click Users and Groups.

Assign the “Licensed User” group

Click Add user/group.
Under “Users and groups”, click None Selected.
Search for the “Lucid Suite Licensed User” group.
Select the group and click Select.
Under “Select a role”, click None Selected.
Select Licensed User.
Click Select.
Click Assign.

Assign the “Limited Access User” group

Click Add user/group.
Under “Users and groups”, click None Selected.
Search for the “Lucid Suite Limited Access User” group.
Select the group and click Select.
Under “Select a role”, click None Selected.
Select Limited Access.
Click Select.
Click Assign.

Create expression attribute mappings

Obtain bearer token from Lucid

Before creating expression attribute mappings in Azure, you need to obtain a bearer token from Lucid. To do this:

Sign in to Lucid as an Account Owner or Team Admin.
Select Admin from the navigation menu on the left-hand side.
Click App Integration from the navigation menu on the left-hand side.
Under “SCIM”, click Settings.
If a bearer token doesn’t already exist, click Generate Token.
- If Generate Token is not clickable, ensure the “Automatically upgrade account when no more licenses are available” option is checked and try again.

Create expression attribute mapping

After obtaining the bearer token from Lucid, follow these steps:

Open the Lucid (All Products) app.
Select Provisioning from the navigation menu on the left-hand side.
Click Get started.
From the “Provisioning Mode” dropdown, select Automatic.
Under “Admin Credentials”, enter https://users.lucid.app/scim/v2/azure under “Tenant URL”.
Enter the bearer token under “Secret Token” using the token you obtained from Lucid in the steps above.
Click Test Connection.
If the connection is successful, click Save.
Under “Mappings”, click Provision Azure Active Directory Users.
Click Add New Mapping from the bottom of the page.
Enter the following values in the “Edit Attribute” dialog box:
- Mapping Type: “Expression”
- Expression: “Switch(SingleAppRoleAssignment([appRoleAssignments]), , "Licensed User", "True", "Limited Access", "False")”
- Target attribute: “urn:ietf:params:scim:schemas:extension:lucid:2.0:User:productLicenses:Lucidchart”
Click Ok.
Click Save.

Repeat steps 12-15 to create an additional expression mapping. Instead of selecting the Lucidchart Target Attribute, select the attribute ending with “Lucidspark”.

Test provisioning

After all the settings detailed above are saved, test the application to ensure it is functioning properly. To do this:

Assign a test user to the “Lucid Suite Licensed User Group”.
Open the Lucid (All Products) app.
Select Provisioning from the navigation menu on the left-hand side.
Click Provision on demand from the menu across the top of the page.
Enter the name of the test user you assigned to the Lucid Suite Licensed User Group.
Click Provision.

The same steps can be followed to test the “Limited Access User Group”.

If everything is working as intended, you will see:

Green checkmarks next to all steps
The Lucidchart and Lucidspark target attributes = “True”

If either of these did not happen, review the configuration steps above.

FAQ

What is the difference between Microsoft SSO and Azure SAML Sign-On?
Microsoft SSO and Azure SAML Sign-On are both managed from the Azure portal. SAML uses SAML2.0 protocol while MS SSO uses OAuth2.0 OpenID. Generally, SAML set-ups are considered more secure because the encryption is on the transport layer (SSL).

What happens to documents when I delicense a user via SCIM?
When you delicense or delete a user via SCIM, you must transfer their documents to another user on your Enterprise account. This does not apply when deactivating users.

By default, the Account Owner will be the recipient of the documents that are automatically transferred upon delicensing or deleting a user. You can change the recipient of the transferred documents by navigating to the SCIM integration settings in the Admin Panel and selecting Modify default owner to the right-hand side of the email address. See the screenshot below for reference.

Clicking Modify default owner redirects you to the “Document & Folder Settings” page of the Lucid admin panel where you can change the default document owner on your account. Refer to Lucid admin panel: Document and folders article for additional details.
change-recipient-of-documents-when-deleting-or-delicensing-users-via-SCIM.png

Related articles