Skip to content
English - United States
Contact Us
  • There are no suggestions because the search field is empty.

Configure Microsoft Entra ID SSO and SCIM forRocketDocs

This guide connects Microsoft Entra ID to RocketDocs with SAML 2.0 SSO. You can also configure SCIM provisioning for RocketDocs users. A Microsoft Entra administrator and a RocketDocs administrator can complete these steps. If your settings differ from this guide, contact RocketDocs Support.

Placeholder Format

This guide uses <tenant> for your RocketDocs tenant name.
Replace <tenant> in each URL with your tenant name.

Tenant URL https://<tenant>.rocketdocs.com
ACS URL https://<tenant>.rocketdocs.com/api/auth/AssertionConsumerService
RocketDocs login URL https://<tenant>.rocketdocs.com/app/login
SCIM Endpoint URL https://<tenant>.rocketdocs.com/integrationapi/scim

Signing Model

  • Microsoft Entra ID signs the SAML assertion with its identity provider certificate.

  • RocketDocs uses the Entra certificate to authenticate the assertion.

  • The SAML response remains unsigned.

  • RocketDocs uses SCIM for optional user provisioning.

  • This setup does not use SAML Single Logout.

Step 1: Prepare The Values

Required Access

  • Use a Cloud Application Administrator or Application Administrator account.

  • Use a RocketDocs system administrator account.

  • For SCIM, use a subscription that includes application provisioning.

  • Keep one RocketDocs local administrator session open during SSO setup.

Create the RocketDocs Values

  1. Record your RocketDocs tenant URL.

  2. Build the ACS URL from the tenant URL.

  3. Record the current SSO SP Name.

  4. If no SSO SP Name exists, use the tenant URL.

  5. Copy the SSO SP Name exactly into

  6. Identifier (Entity ID)

Tenant URL https://<tenant>.rocketdocs.com
ACS URL https://<tenant>.rocketdocs.com/api/auth/AssertionConsumerService
SSO SP NAME Use the existing value. Otherwise, use the full tenant URL.
Identifier (Entity ID) Use the exact SSO SP Name, including case, scheme, and trailing slash.
NameID Use the email address that matches the RocketDocs SSO User ID.

📋Note:

Keep Allow Users To Use System Login on during setup and testing. This setting helps prevent anadministrator lockout.

Choose How RocketDocs Creates Users

Existing users Keep Auto Generate SSO User off.
SCIM provisioning Keep Auto Generate SSO User off. Complete Steps 13 through 17.
JIT provisioning If your organization approves JIT, turn on Auto Generate SSO User.

Step 2: Create the Entra enterprise application

  1. Sign in to the Microsoft Entra admin center.

  2. Go to Entra ID > Enterprise apps > All applications

  3. Select New application

  4. Select Create your own application

  5. Enter RocketDocs - <company name> as the application name.

  6. Select Integrate any other application you do not find in the gallery

  7. Select Create

  8. Wait for the application overview page to open.

Entra q

📋Note: 

Use this application for SAML SSO and SCIM provisioning.

 

Step 3: Enter the SAML endpoints

  1. Open the RocketDocs enterprise application.
  2. Select Single sign-on.
  3. Select SAML.
  4. Select Edit in Basic SAML Configuration.
  5. Enter the values in the following table.
  6. Select Save.

Entra field

Value

Identifier (Entity ID)

Use the exact RocketDocs SSO SP Name.

Reply URL (Assertion Consumer

Service URL)

https://<tenant>.rocketdocs.com/api/auth/AssertionConsumerService

Sign on URL

https://<tenant>.rocketdocs.com/app/login

Relay State (Optional)

Leave blank.

Logout URL (Optional)

Leave blank.

Entra 2

📋Note:

The Entra Identifier (Entity ID) and RocketDocs SSO SP Name must match exactly. The Reply URL is a separate value.

 

Step 4: Configure the SAML NameID

  1. Find Attributes & Claims on the SAML setup page.
  2. Select Edit.
  3. Select Unique User Identifier (Name ID).
  4. Open Choose name identifier format.
  5. Select Email address.
  6. Select Attribute under Source.
  7. Select user.mail under Source attribute.
  8. Select Save.

Entra 3-1

📋Notes: 

  • Make sure that user.mail contains the exact RocketDocs SSO User ID for every assigned user. Make sure that each value is unique.
  • Only when user.userprincipalname contains the exact SSO User ID, use it for NameID and both SCIM source mappings.

 

Step 5: Configure optional JIT claims

For existing or SCIM-provisioned users

  1. Keep the NameID mapping from Step 4.
  2. Do not add the JIT claims in this step.
  3. Make sure that the NameID matches the RocketDocs SSO User ID.

Only when RocketDocs JIT provisioning is on

Add these claims in the Entra Attributes & Claims page.

SAML claim name

Entra source attribute

email

user.mail

firstname

user.givenname

lastname

user.surname
  1. Select Add new claim.
  2. Enter the claim name.
  3. Leave Namespace blank.
  4. Select Attribute under Source.
  5. Select the matching source attribute.
  6. Select Save.
  7. Repeat these steps for each claim.

📋Notes:

  • RocketDocs does not require a group or role claim for sign-in.

  • JIT requires all three claims. When SCIM creates the users, keep JIT off.

 

Step 6: Configure assertion signing

  1. Find SAML Certificates on the SAML setup page.
  2. Select Edit.
  3. Select the active certificate.
  4. Set Signing Option to Sign SAML assertion.
  5. Set Signing Algorithm to SHA-256.
  6. Add a certificate notification email address.
  7. Select Save.
  8. Open the active certificate menu.
  9. Select PEM certificate download.
  10. Save the Certificate file securely.

Entra 4

📋Notes: 

  • Make sure that user.mail contains the exact RocketDocs SSO User ID for every assigned user. Make sure that each value is unique.
  • Only when user.userprincipalname contains the exact SSO User ID, use it for NameID and both SCIM source mappings.

 

Step 5: Configure optional JIT claims

For existing or SCIM-provisioned users

  1. Keep the NameID mapping from Step 4.

  2. Do not add the JIT claims in this step.

  3. Make sure that the NameID matches the RocketDocs SSO User ID.

Only when RocketDocs JIT provisioning is on

Add these claims in the Entra Attributes & Claims page.

SAML claim name

Entra source attribute

email

user.mail

firstname

user.givenname

lastname

user.surname
  1. Select Add new claim.
  2. Enter the claim name.
  3. Leave Namespace blank.
  4. Select Attribute under Source.
  5. Select the matching source attribute.
  6. Select Save.
  7. Repeat these steps for each claim.

📋Notes: 

  • RocketDocs does not require a group or role claim for sign-in.
  • JIT requires all three claims. When SCIM creates the users, keep JIT off.

 

Step 6: Configure assertion signing

  1. Find SAML Certificates on the SAML setup page.
  2. Select Edit.
  3. Select the active certificate.
  4. Set Signing Option to Sign SAML assertion.
  5. Set Signing Algorithm to SHA-256.
  6. Add a certificate notification email address.
  7. Select Save.
  8. Open the active certificate menu.
  9. Select PEM certificate download.

Entra 5

RocketDocs setting

Value

Want Assertion Signed

true

Want Response Signed

false

 

Step 7: Assign pilot access

Require an assignment

  1. Select Properties in the enterprise application.
  2. Set Enabled for users to sign-in? to Yes.
  3. Set Assignment required? to Yes.
  4. Select Save.

Assign one pilot user

  1. Select Users and groups.
  2. Select Add user/group.
  3. Select None Selected under Users and groups.
  4. Select one approved pilot user.
  5. Select Select.
  6. Select the default access role.
  7. Select Assign

Entra 6

📋Note:

Group-based assignment requires an Entra ID P1 or P2 license. Nested group membership does not assign access.

 

Step 8: Get the Entra identity provider values 

  1. Return to the enterprise application Single sign-on page.
  2. Find Set up RocketDocs.
  3. Copy the displayed Login URL.
  4. Copy the displayed Microsoft Entra Identifier.
  5. Keep the PEM certificate file from Step 6.

Entra 7

Entra value

RocketDocs setting

Microsoft Entra Identifier

SSO Idp Name

Login URL

SSO Idp SingleSignOnServiceUrl

PEM certificate

SSO Idp PartnerCertificates

Identifier (Entity ID)

SSO SP Name

 

📋Note:

Copy the displayed Microsoft Entra Identifier. Do not build this value manually.

 

Step 9: Open the RocketDocs SSO settings 

  1. Sign in to RocketDocs as an administrator.
  2. Open Settings.
  3. Select System Settings.
  4. Find the SSO section.
  5. Select the pencil icon to edit a setting.

Entra 8

📋Note:

  • Enter the values from your Entra application in the matching RocketDocs fields.

  • If you cannot see System Settings, ask a RocketDocs administrator for access.

 

Step 10: Enter the RocketDocs SSO values 

RocketDocs setting

Value

Turn SSO on/off

Keep off during setup. After you save all values, set on.

Auto Generate SSO User

Set off for existing users or SCIM. Set on only for approved JIT provisioning.

Allow Users To Use System Login

Set on during setup and testing.

Auto Generate Based On This User

If JIT is off, leave blank. For JIT, select an active template user.

Want Assertion Signed

true

Want Response Signed

false

SSO Idp Name

Paste the Entra Microsoft Entra Identifier.

SSO Idp SignAuthnRequest

false

SSO Idp SingleSignOnServiceUrl

Paste the Entra Login URL.

SSO Idp PartnerCertificates

Paste the complete Entra PEM certificate text.

SSO Idp Description

Optional. Enter Microsoft Entra ID or another useful description.

SSO SP Name

Enter the exact Entra Identifier (Entity ID).

SSO SP Description

Optional. Enter a useful RocketDocs description.

 

📋Note:

The Entra Identifier (Entity ID) and RocketDocs SSO SP Name must contain the same string.

  • The letter case matches.
  • The https:// scheme matches.
  • The domain name matches.
  • The trailing slash matches.

 

Step 11: Paste the Entra certificate 

  1. Find the PEM certificate file that you downloaded from Entra.
  2. Open the file in a plain-text editor.
  3. Select the complete certificate text.
  4. Copy the text without changing it.
  5. Edit SSO Idp PartnerCertificates in RocketDocs.
  6. Paste the complete certificate text.
  7. Save the setting.

The copied text must include both boundary lines and all text between them.

-----BEGIN CERTIFICATE-----

MIIC...all certificate characters and lines...

-----END CERTIFICATE-----

Make sure that RocketDocs saved the certificate

  1. Return to the RocketDocs SSO settings.
  2. Find SSO Idp PartnerCertificates.
  3. Make sure that RocketDocs reports Certificate present: True.

 

Step 12: Activate and test SSO 

Activate SSO

  1. Make sure that all RocketDocs SSO values match Step 10.
  2. Keep Allow Users To Use System Login on.
  3. Set Turn SSO on/off to on.
  4. Keep the current RocketDocs administrator session open.
  5. Open a private browser window.
  6. Open https://<tenant>.rocketdocs.com/app/login.
  7. Sign in with the approved Entra pilot user.
  8. Make sure that the correct RocketDocs user opens.

Run an Entra test

  1. Open the enterprise application Single sign-on page.
  2. Find Test single sign-on with RocketDocs.
  3. Select Test.
  4. Sign in with the approved pilot user.
  5. Make sure that the correct RocketDocs user opens.

If the test fails 

Entra denies access

Make sure that the pilot user has an application assignment.

Audience error

Compare the Entra Identifier (Entity ID) with the RocketDocs SSO SP Name.

Reply URL error

Compare the Entra Reply URL with the RocketDocs ACS URL.

User not found

Compare the SAML NameID with the RocketDocs SSO User ID.

Signature error

Paste the complete active Entra PEM certificate again.

After the pilot test succeeds, expand access.

 

Step 13: Generate the RocketDocs SCIM credentials 

If your organization does not use SCIM provisioning, skip Steps 13 through 17.

📋Note:

These steps configure user provisioning only. Keep group provisioning off.

Make sure that SCIM is available

  1. Sign in to RocketDocs as a system administrator.
  2. Open Settings.
  3. Select System Settings.
  4. Find the SSO section.
  5. Make sure that SCIM Provisioning appears beside SSO.

📋Note:

If SCIM Provisioning does not appear, contact RocketDocs Support.

Generate the credentials

📋Note:

A new token immediately invalidates the current SCIM token. When you are ready to update Entra, generate a token.

  1. Select SCIM Provisioning.
  2. Select Generate token.
  3. Copy the SCIM Endpoint URL.
  4. Before you close the drawer, copy the Bearer Token.
  5. Record the displayed expiration date.

SCIM Endpoint URL

https://<tenant>.rocketdocs.com/integrationapi/scim

Bearer Token

Use the token that RocketDocs shows after generation.

📋Note:

Store the bearer token in your approved secret store. After you close the drawer, RocketDocs does not show the token again.

 

Step 14: Connect Entra to the SCIM endpoint

  1. Open the RocketDocs enterprise application in Entra.
  2. Select Provisioning.
  3. Select New Configuration

entra 9

  1. Paste the RocketDocs SCIM Endpoint URL in Tenant URL.
  2. Paste the RocketDocs bearer token in Secret token.
  3. Do not add the word Bearer before the token.
  4. Select Test connection.
  5. Make sure that Entra reports a successful connection.
  6. Select Create.

entra 10

📋Note:

If the test fails, compare the endpoint and token with the current RocketDocs values.

 

 Step 15: Configure the SCIM user mappings

  1. Open Attribute mapping in the provisioning configuration.
  2. Open the user mapping.
  3. Set the user mapping to Enabled.
  4. Select Create and Update under Target Object Actions.
  5. Clear Delete.
  6. Enter the mappings in the following table.

Entra source

SCIM target

Settings

mail

userName

Direct. Matching on. Precedence 1. Apply always.

Not([IsSoftDeleted])

active

Expression. Matching off. Apply always.

givenName

name.givenName

Direct. Matching off. Apply always.

surname

name.familyName

Direct. Matching off. Apply always.

mail

emails[type eq "work"].value

Direct. Matching off. Apply always.
  1. Remove the default mapping from objectId to externalId.
  2. Save the user mapping.
  3. Return to Attribute mapping.
  4. Open the group mapping.
  5. Set the group mapping to Disabled.
  6. Save the group mapping.

📋Note:

Use the same email for SAML NameID, SCIM userName, and RocketDocs SSO User ID. Before provisioning, make sure that mail, givenName, and surname contain values for every assigned user.

 

Step 16: Set the scope and test provisioning Configure the provisioning properties

  1. Open Properties in the provisioning configuration.
  2. Add an email address for provisioning notifications.
  3. Set Prevent accidental deletion to Enabled.
  4. Set Skip out of scope deletions to Disabled.
  5. Set Provisioning scope to Sync only assigned users and groups.
  6. Select Save.

entra 11

 Provision one pilot user

  1. Select Provision on demand.
  2. Select the assigned pilot user.
  3. Select Provision.
  4. Make sure that Entra reports a successful provisioning event.
  5. Open RocketDocs User Management.
  6. Find the pilot user.
  7. Make sure that the name, email, and SSO User ID match Entra.
  8. Assign the required RocketDocs access, including a license.
  9. Test SSO with the pilot user.

📋Note:

A new SCIM user has the user role without a license, privileges, restrictions, or group memberships.

 

Step 17: Start and maintain SCIM Start provisioning

  1. Return to the provisioning overview.
  2. Select Start provisioning.
  3. Open Provisioning logs.
  4. Make sure that the next cycle succeeds.

Replace a SCIM token

Before the displayed expiration date, replace the SCIM token.

  1. Plan a short provisioning interruption.
  2. Open System Settings > SSO > SCIM Provisioning.
  3. Select Regenerate token.
  4. Copy the new bearer token.
  5. Replace the Entra Secret token immediately.
  6. Run Test connection again.

When your organization stops SCIM provisioning, select Revoke token.

Test profile changes

After an approved profile change, use Provision on demand and make sure that RocketDocs receives the value.

If SCIM fails

Connection test fails

Compare the SCIM Endpoint URL and the current bearer token.

Entra reports unauthorized

Replace a lost, expired, revoked, or regenerated token.

User already exists

Match Entra mail and SCIM userName to the RocketDocs SSO User ID.

User cannot sign in

Compare the SAML NameID, Entra assignment, and RocketDocs SSO User ID.

User has no access

Assign a RocketDocs license and any required groups or privileges.

 

Get support

If you need help, email support@rocketdocs.com.

Include the tenant URL, Entra application name, error message, and test time.

Do not send a bearer token, certificate file, or user password.

Related help: Enable SAML SSO, configure SAML signing, and assign application access. Also see Configure a SCIM endpoint, configure attribute mappings, and provision a user on demand. Microsoft Entra interface labels can change.