The Azure Active Directory integration allows for real-time employee provisioning through Azure Active Directory utilizing SCIM API.

How does this integration work?

With the Envoy + Azure Active Directory integration, Envoy will allow employee provisioning and Single Sign On by utilizing the Envoy Enterprise app within Azure’s Active Directory portal.

Enabling the Envoy + Azure Active Directory integration

Note: You’ll need to be an admin on your Azure account to complete this integration. Either become an admin or ask your admin for help before completing these steps:

Configuring employee provisioning

  1. Go to Apps > All Apps

  2. Click on Directory and SSO > Directory Settings

  3. Find Microsoft Azure. Click “Install.”

  4. Select “Sync all users” or “Sync specific users per location” and click “Save”.

  5. Copy the OAuth Bearer Token from Envoy and note to be entered into Azure later.

  6. Open the Azure portal and select Azure Active Directory -> Enterprise applications -> New application -> Add from the gallery -> search for Envoy and select add.

  7. Open Provisioning tab and select “Provisioning Mode” as “Automatic”

  8. Copy Envoy’s SCIM endpoint into “Tenant URL” = and paste the Oauth Bearer Token from the Envoy Dashboard.

    1. Note: Tenant URL above is for new instances, if existing, do not update.

  9. Click on “Test Connection”, once successful, “Save”.

  10. Click on “Users and groups” on the left hand side and then assign users or groups to the application. Note that Azure does not support nested groups for SCIM provisioning.

  11. Once users are assigned, click on “Provisioning” on the left hand side and scroll down to the bottom and turn “Provisioning Status” On.

  12. (Optional) To test provisioning on a single user, utilize the "Provision on demand" feature in Azure.

Important notes:

  • Envoy is in the process of updating our official documentation Envoy app within the Microsoft Azure store.

  • If you want Mobile phone instead of Office phones please change the following within Azure.

  1. Find and delete telephoneNumber from the mapping list.

  2. Find mobile and click onto it so it brings up the editing pane.

  3. Change the mapping to phoneNumbers[type eq "work"].value

Configuring Single Sign On

  1. In the Envoy dashboard go to Integrations and click Install on the SAML integration.

  2. In the Azure portal, on the Envoy application page, select Single sign-on.

  3. On the Select a Single sign-on method dialog, select SAML to enable single sign-on.

  4. On the Set up Single Sign-On with SAML page, click the edit icon to open the Basic SAML Configuration dialog.

  5. On the Basic SAML Configuration section, enter the following URLs:

    1. Identifier (Entity ID)-

    2. Reply URL (Assertion Consumer Service URL) -

    3. Sign on URL -, your specific sign on URL will be found in Integrations > Enabled integrations > Configure SAML.

    4. Relay State -

  6. Once all URL’s are entered correctly, hit “Save”.

  7. In the SAML Signing Certificate section, click the edit icon to open SAML Signing Certificate dialog.

  8. In the SAML Signing Certificate section, copy the Thumbprint and save it on your computer.

  9. On the Set up Envoy section, copy the Login URL This URL is what you will enter into the Envoy integrations page for SAML as your “IDENTITY PROVIDER HTTP SAML URL”.

  10. Login to your Envoy dashboard and go to your Integrations page and “Install” SAML.

  11. Take the Thumbprint from step 3 in Azure of the setup and enter that value into the Fingerprint field provided in Envoy.

  12. Paste the Login URL value, which you have copied from the Azure portal into the IDENTITY PROVIDER HTTP SAML URL textbox.

  13. Choose whether you want SAML “Required” and toggle ON if needed, then “Save”.

Configuring assistants

Please be aware that Azure does not support the assistant feature of Envoy. If you would like to use assistants in Envoy manually, please alert Support to whitelist your account.

Did this answer your question?