Set up SSO and SCIM provisioning with Microsoft Entra ID

Before you start

Finish these items before configuring Entra.

#	Requirement	Where	Who
1	Marq Enterprise plan	—	Account Owner
2	Email domain(s) verified	Contact your Customer Success Manager	Marq
3	SCIM enabled on the account (SCIM only)	Contact your Customer Success Manager	Marq
4	Automatic upgrade turned on (SCIM only)	Admin → App Integration → SCIM: Automatically upgrade account when no more licenses are available	Account Owner or Billing Admin

List every email domain your people use, including any on older accounts. Domain verification is the most common cause of a delayed go-live, so start it first.

Item 4 matters: with automatic upgrade off, SCIM creates new users view-only even when Entra asks for an edit licence.

Choose how accounts are created:

• SCIM provisioning (recommended): Entra creates, updates and deactivates accounts and keeps groups in sync. Follow Steps 1–7.
• Just-in-time (JIT): an account is created the first time someone signs in through SSO, and nothing is synced after that. Follow Step 1, then the just-in-time section.

Three decisions shape everything else. Make them before the first sync:

1. Identity. Which Entra attribute holds each person's real work email? Marq recognises existing people by email. Get this wrong and you create duplicate accounts.
2. Licences. Who gets an edit licence? Users without one land view-only.
3. Groups. Which Entra groups map to which Marq groups? Marq groups only control which templates people see. Per-location details (name, address, phone, logo) travel as profile fields on each user, not on groups.

Do not delete existing Marq users to start fresh. Deleting a user deletes their projects. Provisioning adopts existing accounts safely.

Step 1 — Set up single sign-on (SAML)

SSO can go live before provisioning. You move between Marq and Entra twice.

In Marq: turn on SAML

1. Go to Admin → Identity Management.
2. Check Allow SAML authentication, then click Save Changes.
3. Click Configure. Under Marq Sign in URL, enter your domain name (for example yourcompany) and click Save Changes. This value is <your-domain> below.

In Entra: create the app

1. In the Microsoft Entra admin center, go to Enterprise applications → New application. Search for Marq and add it. If it isn't listed, choose Create your own application → Integrate any other application you don't find in the gallery (Non-gallery) and name it Marq.
2. Open the app → Single sign-on → SAML.
3. Under Basic SAML Configuration, enter:

Entra field	Value
Identifier (Entity ID)	marq.com
Reply URL (Assertion Consumer Service URL)	https://app.marq.com/saml/sso/<your-domain>
Sign on URL	https://app.marq.com/saml/sso/<your-domain>

1. Under Attributes & Claims, set Unique User Identifier (Name ID) to the user's email address, with Name ID format Email address. Use user.userprincipalname when your UPNs are your users' email addresses. Otherwise use user.mail.
2. Leave the signing algorithm at Entra's default, SHA-256.
3. Under SAML Certificates, download Federation Metadata XML.
4. Under Users and groups, assign the people or groups who should sign in.

In Marq: connect Entra and test

1. Back on the SAML configuration page, click Add Identity Provider and upload the metadata XML.
2. Click Test SAML connection. It simulates a sign-on without affecting live users.

Why the Name ID matters. Marq finds the account for an email-shaped Name ID by email first, then by username. Any other Name ID is matched against usernames only. If you also use SCIM, send the same value as the Name ID and as userName in Step 3.

Turning on SSO changes sign-in for everyone on your verified domain, not only the people you assigned. Confirm who that includes first.

Just-in-time provisioning (instead of SCIM)

With JIT, a Marq account is created the first time an assigned person signs in through SSO. Nothing is synced afterwards: Entra does not update, deactivate or group these accounts. Use SCIM (Steps 2–7) if you need any of that.

1. In Entra, open the Marq app → Properties. Assignment required? controls who can sign in: Yes limits it to assigned users and groups; No lets anyone in your tenant sign in.
2. Under Users and groups, assign the people or groups who should have access.
3. In Marq's licensing settings, choose what new users get under When a new user joins a team:
   • Automatically grant license: new users get an edit licence.
   • Do not automatically grant: new users are view-only and can request a licence. Set When a user requests a license to decide how requests are handled.

If you use JIT, skip to Step 6 to share templates with groups you manage in Marq.

Step 2 — Connect provisioning

1. In Marq, open Admin → App Integration → SCIM and generate a bearer token. Copy it now; treat it like a password.
2. In Entra, open your Marq enterprise app → Provisioning and set Provisioning Mode to Automatic.
3. Under Admin Credentials enter:

Setting	Value
Tenant URL	https://users.app.marq.com/scim/v2/press
Secret Token	the token from Marq

1. Click Test Connection. It should succeed before you continue.
2. Under Settings, set Scope to Sync only assigned users and groups. Leave provisioning Off until Step 7.

Step 3 — User attribute mappings

Open Provisioning → Mappings → Provision Microsoft Entra ID Users. Make the list match this table. Most rows are Entra defaults; the changes are userName and the licence row.

Marq (target) attribute	Entra source	Required	Notes
userName	mail (or userPrincipalName if it equals the email)	Yes	Matching precedence 1. Must be the user's real email address.
emails[type eq "work"].value	mail	Yes	Marq adopts an existing account when this email matches it.
name.givenName	givenName	Yes	A user with no name is rejected.
name.familyName	surname	Yes
active	Switch([IsSoftDeleted], , "False", "True", "True", "False")	Yes	Entra default; leave as is.
displayName	displayName	No
externalId	mailNickname	No	Entra default; leave as is.
urn:ietf:params:scim:schemas:extension:marq:1.0:User.hasLicense	Constant True, or an expression	Recommended	Gives an edit licence, applied on Entra's first sync after a user is created. Without it, new users stay view-only.

Adding the licence row. It is not in Entra's list by default:

1. On the mapping page, tick Show advanced options → Edit attribute list for <app name>.
2. Add urn:ietf:params:scim:schemas:extension:marq:1.0:User.hasLicense with type Boolean. Save.
3. Back on the mapping page, Add New Mapping: type Constant, value True, target the new attribute. To licence only some people, use an Expression instead.

Leave out:

• canEdit under the marq:1.0:User extension. Marq does not read it there; use hasLicense.
• title, addresses, phoneNumbers. They are accepted but do not fill profile fields. Profile fields use Step 4.
• Admin roles. Assign Team Admin, Template Admin and other roles in Marq.

Step 4 — Profile fields

Profile fields (user smart fields) put each person's own details on the templates they use: name, title, address, phone, logo. Each field is its own attribute. You do not need an expression to combine them. Name each one with the prefix below followed by the field name.

The prefix is exactly:

urn:ietf:params:scim:schemas:extension:lucidpress:1.0:UserFields.

Two details matter. The prefix says lucidpress, not marq. The field name follows a dot, not a colon: …UserFields.title, not …UserFields:title. Marq cannot apply updates sent with a colon.

Entra fills in a new user's profile fields on its first sync after creating the account, typically within about 40 minutes. From then on it keeps them up to date.

To add a field:

1. Edit attribute list for <app name> (as in Step 3) → add the prefix + field name, e.g. urn:ietf:params:scim:schemas:extension:lucidpress:1.0:UserFields.title, type String.
2. Repeat for every field you want. Save.
3. Add New Mapping for each one, pointing it at its Entra source.

Field name (after the prefix)	Suggested Entra source	Kind
fullName	displayName	Text
firstName, lastName	givenName, surname	Text
title	jobTitle	Text
company	companyName	Text
address	streetAddress, or Join(", ", [streetAddress], [city], [state], [postalCode])	Text
workPhone	telephoneNumber	Text
cellPhone	mobile	Text
email	mail	Text
website	an extension attribute, or a constant	Text
logo, secondaryLogo, tertiaryLogo	a URL (see below)	Image URL
profileImage, secondaryProfileImage, tertiaryProfileImage	a URL	Image URL

Other standard names: middleName, preferredName, homeOffice, agentNumber. Image fields also accept named variants such as logo_applewood or profileImage_headshot. You can use custom names too; a template must reference the same name. Names can be up to 128 characters and values up to 10,000. A longer value makes Marq reject the whole user.

Per-location logos are where an expression helps. Image fields take a public URL, not an uploaded file. If the location is held in an attribute such as officeLocation, map logo with:

Switch([officeLocation], "https://example.com/logos/default.png",   "Applewood", "https://example.com/logos/applewood.png",   "Riverside", "https://example.com/logos/riverside.png")

The first URL is the fallback. Then come pairs of location value and logo URL. The same pattern works for a location's address or phone number.

See Smart fields and User profile smart fields for how templates use these values.

Step 5 — Group provisioning

Groups need no custom mappings. A Marq group holds a name and a member list, nothing else, and Entra's default group mapping sends exactly those. Who belongs in which group is decided entirely in Entra.

1. Build the groups in Entra. Use one group per unit (community, site, region). Dynamic membership rules, e.g. user.physicalDeliveryOfficeName -eq "Applewood", require Entra ID P1 or P2. On the free tier, assign members by hand.
2. Assign the groups to the Marq app. Go to Users and groups → Add user/group. Assigning a group also puts its members in provisioning scope.
3. Turn on the group mapping; it can be off by default. Go to Provisioning → Attribute mapping → Provision Microsoft Entra ID Groups, set Enabled to Yes, and click Save. While it is off, users are provisioned normally but no group or group membership ever reaches Marq. Keep the default mappings: displayName ← displayName (matching precedence 1), members ← members, externalId ← objectId. Under Target Object Actions, untick Delete unless you want removing a group in Entra to delete it in Marq.

Existing Marq groups are reused by name. If a Marq group's name exactly matches an Entra group's display name, Entra adopts it instead of creating a second one. Rename one side first if they don't match exactly. Make sure no two Marq groups share a name.

Nested groups are not provisioned. Entra sends the direct members of each assigned group only.

Where to check membership. Open the group in Marq and look at its member list. Don't use the Users page: its Primary Group column shows each person's primary group. Provisioning adds people to groups as ordinary members and leaves their primary group alone, so a correctly provisioned person still shows the default group there. Template access follows membership, not primary group.

Optional: set the primary group. Only do this if you also want the Primary Group column to show the community. Add the attribute urn:ietf:params:scim:schemas:extension:marq:1.0:User.primaryGroup (String) and map it with a Switch expression from location to Marq group ID. Ask Marq Support for the group IDs after the first group sync. The user must also be a member of that group.

Step 6 — Give each group its templates

Templates are shared with groups in Marq, one template at a time or several at once. Do this after the first sync, because a group must exist in Marq before you can share with it.

1. In Marq, open Brand Templates.
2. Select the templates for one group (multi-select works) and choose Edit.
3. In the Share section, add the group. Save.

From then on, anyone Entra adds to that group sees those templates. Nothing more is needed per person.

Test one person who already has a Marq account and belongs to one assigned group. In the Marq app, open Provision on demand and run it twice:

1. For the user. This tests their account, licence and profile fields.
2. For the group. Select the group, then pick a few of its members. This is how you test group membership. A user's provisioning log entry never shows groups; membership appears only in the group's own entry.

Then check:

• Entra's result shows success. It may say Created even for an existing person, because Marq adopts the account by email. The Marq check below is the one that counts.
• In Marq, the person appears once (no duplicate) and keeps their projects.
• Their licence is what you intended (edit vs view-only).
• Their profile fields are filled. Check their profile, or a template that uses those fields.
• They appear in the group's member list (not the Primary Group column; see Step 5).
• Signing in through SSO lands them on the same account.

When all six pass, run Provision on demand for the group, then set Provisioning Status: On. Entra then syncs on its own schedule.

What happens when things change in Entra

Marq applies whatever Entra sends. Entra sends changes on its incremental cycle, typically about every 40 minutes; Provision on demand sends one immediately. New accounts are created from a short queue on Marq's side, and their group memberships are applied as soon as each account exists.

In Entra	In Marq
User assigned to the app, or added to an assigned group	Account created, or the existing account with the same email adopted. Licence and profile fields set.
User attribute changes (title, phone, location)	Profile fields and name updated on the next cycle.
User moves to another group	Removed from the old Marq group, added to the new one. Template access follows.
User unassigned, out of scope, or soft-deleted	Account deactivated and edit licence released. Projects are kept.
User permanently deleted	Account deleted, with its projects, unless automatic document transfer is enabled on your Marq account.
Group renamed	Marq group renamed. Template shares are kept.
Group unassigned from the app, or deleted	Marq group deleted. Its members move to the account's default group, and templates shared with it lose that share.

The last two bold rows are the ones that lose work. Before removing a group from the Marq app, check which templates are shared with it.

Troubleshooting

Start with Provisioning → Provisioning logs in Entra. Each entry shows what Entra sent and Marq's reply.

Symptom	Likely cause	Fix
Person shows the default group on the Users page	That column is Primary Group; provisioning doesn't change it	Check the group's member list instead (Step 5).
Person missing from the group's member list	Group mapping set to Enabled: No (it can be off by default), group not assigned to the app, or the person is in a nested group	Assign the group; set group mapping Enabled: Yes; add the person directly to the assigned group.
A second copy of an existing group appeared	Names didn't match exactly	Rename to match exactly, then delete the extra group.
Duplicate accounts for existing people	userName / work email is not the address their Marq account uses	Map both to mail (Step 3). Contact Marq Support before deleting either copy.
Profile fields empty	Attribute named with marq instead of lucidpress, the whole prefix mapped as one attribute, or a colon instead of a dot before the field name	One attribute per field with the exact prefix (Step 4).
User rejected for smartfield length	A field name over 128 characters or a value over 10,000	Shorten the source value.
New users are view-only	No hasLicense mapping, or automatic team upgrades off	Add the mapping (Step 3); turn on upgrades (Before you start).
User rejected: "must have email addresses" or "must have a name"	mail or givenName empty in Entra	Fill the attribute in Entra.
User rejected: "email already exists"	The account belongs to a different Marq account	Ask Marq Support to move it.
A group's templates vanished	The group was unassigned or deleted in Entra	Re-assign the group, then re-share its templates (Step 6).
A user's provisioning log shows no group	Expected: Entra logs membership on the group's entry, not the user's	Filter the logs to the group, or run Provision on demand on the group (Step 7).

Still stuck? Send Marq Support the Entra provisioning log entry (screenshot or export) and the user's email.

FAQ

Is this the same as "Sign in with Microsoft"? No. Both are managed in the Entra admin center, but this article uses SAML 2.0. "Sign in with Microsoft" uses OAuth 2.0 / OpenID Connect. SAML lets your organisation enforce SSO and pairs with SCIM provisioning.

Can I use SCIM without SSO? Yes, but most organisations turn on SSO first so provisioned people can sign in with their Entra credentials.

Do I have to delete existing Marq users first? No, and please don't. Deleting a user deletes their projects. SCIM adopts existing accounts by email (Step 3).

How quickly do changes reach Marq? On Entra's next provisioning cycle, typically about every 40 minutes. To push one user immediately, use Provision on demand.