Connect your organization's Microsoft Entra ID so employees can sign in to AI Fabrix and the platform can receive users and groups through SCIM provisioning. Check both outcomes: a successful administrator sign-in does not prove that employee provisioning is working.
This procedure extends the identity step in the Tenant activation wizard. For the distinction between identity and access to business systems, see Authentication for trust.
Prerequisites
- Access to the controller portal and permission to configure identity providers.
- An Application Administrator or Global Administrator in the directory you intend to connect.
- Your organization's approval to connect that directory, plus a test employee and group whose access you can verify.
- A working administrator access path to retain while testing employee sign-in.
Agree on the intended directory before starting. The directory used for employee identity can differ from the Azure tenant hosting the installation. Record which is which so a hosting administrator does not accidentally connect the wrong organization.
Where it happens
Use the Identity provider step during activation, or the controller's identity-provider settings for an existing installation. The provider chooser describes how users sign in and shows the connection state.
Microsoft consent opens an administrator sign-in flow. Return to AI Fabrix afterward to follow setup progress. Do not create duplicate enterprise applications manually to compensate for an unfinished setup.
Steps
- Select Microsoft Entra ID and continue the connection flow.
- Sign in as the administrator of the intended directory. You do not need to enter its tenant ID before this sign-in; the authenticated directory determines the connection.
- Review the consent request and complete the authorized setup. The read-only tenant identifier on an Azure installation-consent screen describes the hosting tenant, not necessarily this identity directory.
- Return to the provider screen and wait for setup to finish. Setting up, Needs attention, or Needs repair is not the same as Active. Use the offered progress or repair action and retain the displayed error if setup fails.
- Confirm that the intended test employee and group arrive through the configured provisioning process. Compare their identity and membership with the directory's expected values; a group name alone is not sufficient proof of correct membership.
- Test employee sign-in in a separate browser session. Then assign groups to roles for the required environment. Keep authentication, provisioning, and role assignment as separate checks.
After the first directory is connected, a later sign-in to a different directory does not switch the connection. Stop and confirm the intended organization rather than repeatedly consenting with different accounts.
What done looks like
| Check | Expected outcome |
|---|---|
| Provider setup | Connection reaches its usable state without an unresolved setup error |
| Employee sign-in | The intended employee reaches AI Fabrix using Microsoft sign-in |
| Provisioning | Expected user and group membership are visible in AI Fabrix |
| Role access | The employee receives only the roles assigned for the selected environment |
Validate
Record the installation, directory, test employee, group, environment and test time without recording credentials. Verify a normal employee, not only the setup administrator. If sign-in succeeds but no business role is available, inspect membership and role mappings before changing the identity connection.
After a provisioning change, allow the configured synchronization to finish and repeat the affected check. Retain the provider status and any correlation reference when asking the platform operator to investigate.
Common mistakes
| Mistake | Correction |
|---|---|
| Connecting the hosting directory by assumption | Confirm the employee directory before signing in |
| Treating consent as completed provisioning | Check an actual employee and group |
| Giving every test user administrator access | Verify the intended business role instead |
| Recreating the connection for a missing role | Inspect group membership and environment mappings first |
Limits
Directory policies and installed versions affect the consent and setup experience. This guide covers connection and verification, not migration between identity providers. Initial setup does not promise unattended credential renewal. Maintain the organization's approved administrator recovery path and verify provisioning separately after later identity changes.