Set up Microsoft Entra ID SSO (and optional SCIM) for Hyperbound

Let your team sign in to Hyperbound with their Microsoft accounts using Microsoft Entra ID (formerly Azure AD) and SAML 2.0. Once single sign-on works, you can also turn on SCIM so people are added to and removed from Hyperbound automatically.

Before you start

• Get your setup link. Your Hyperbound account team sends a secure link that starts with https://auth.hyperbound.ai/setup_saml/. It's unique to your workspace and shows the exact values you'll copy. Links expire, so if yours opens a sign-in or home page, ask for a new one.

• Decide who gets access. Anyone you assign to the Hyperbound app in Entra ID can sign in, and is added to your workspace (and counts toward your licensed seats) the first time they do. Assign a specific group, not everyone.

• Check your email domains. Your workspace is linked to your company's email domain. If some people use another domain, for example from an acquired company, tell your account team before you start.

• Use one email everywhere. People are matched by email, so each person's email should be the same one they use in your call recorders (Gong, Zoom and others).

Part 1: Set up single sign-on

Step 1: Open your setup link

Open the link from your account team and choose Entra ID / Azure. Keep the tab open: you'll copy values from it into Entra ID, and paste values from Entra ID back into it.

Step 2: Create the Hyperbound app in Entra ID

1. In the Microsoft Entra admin center, go to Enterprise applications, click New application, then Create your own application.

2. Name it Hyperbound, choose Integrate any other application you don't find in the gallery (Non-gallery), and click Create.

3. Open Single sign-on and choose SAML.

4. Edit Basic SAML Configuration and save:

   Entra field	Value from your setup guide
   Identifier (Entity ID)	Audience URI / SP Entity ID
   Reply URL (Assertion Consumer Service URL)	Single sign-on URL

5. Edit Attributes & Claims so Entra sends the email, first name and last name, with the claim names your setup guide shows. The usual sources are user.mail, user.givenname and user.surname.

Step 3: Give Hyperbound your Entra details

1. Under SAML Certificates, download Certificate (Base64).

2. Copy each value into its own field in your setup guide:

   Copy from Entra	Paste into the setup guide
   Login URL (under Set up Hyperbound)	Single sign-on URL
   Microsoft Entra Identifier	Issuer / Entity ID
   Certificate (Base64) contents	Certificate

Step 4: Assign people

Open Users and groups, click Add user/group, and assign the group that should use Hyperbound. Keep a single enterprise app named Hyperbound: with two, people often end up assigned to the one that isn't connected.

Step 5: Test the connection

In your setup guide, click Test Connection and sign in as someone who's assigned to the app. They don't need a Hyperbound account yet.

Step 6: Go live

When the test succeeds, click Finish & Go Live in your setup guide.

How your team signs in

• From Entra ID: open Hyperbound from My Apps (myapps.microsoft.com).

• From Hyperbound: go to app.hyperbound.ai, type your work email, and you're sent to Entra ID to sign in. Type the email rather than using a “Sign in with Microsoft” button, which is a separate sign-in method.

• Adding people later: assign them in Entra ID. They don't need an invitation from Hyperbound, and email invitations shouldn't be sent to people who sign in with single sign-on.

Part 2: Automatic provisioning with SCIM (optional)

With SCIM, Hyperbound stays in sync with Entra ID:

• People you assign in Entra ID get a Hyperbound account right away.

• Profile changes in Entra ID update Hyperbound.

• People you unassign or deactivate in Entra ID are blocked from Hyperbound and signed out.

Step 1: Get your SCIM details

Open the SCIM step in your setup guide. It shows a SCIM base URL and a secret token. Store the token somewhere safe.

Step 2: Connect Entra ID to Hyperbound

1. In the same enterprise application, open Provisioning and set Provisioning Mode to Automatic.

2. Paste the base URL into Tenant URL and the token into Secret Token. Click Test Connection, then Save.

3. Under Mappings, review the user attribute mappings against your setup guide.

4. Under Settings, set Scope to Sync only assigned users and groups, then set Provisioning Status to On.

Check it's working

• Assign a test person to the app and click Provision on demand. They should appear in Hyperbound within a few minutes.

• Remove them from the app and provision on demand again. They should be blocked from Hyperbound and signed out.

Set roles from Entra ID (optional)

Everyone starts with the Member role. You can keep managing roles in Hyperbound, or send them from Entra ID so they follow group membership. Your account team will help you decide which role each group should get.

1. Go to App registrations, open the Hyperbound app (choose All applications if it isn't listed), and open App roles.

2. Create one app role for each Hyperbound role you'll use. Set its Value exactly as in the table above, and allow member type Users/Groups.

3. Back in the enterprise application, under Users and groups, assign each user or group to its role.

4. In Attributes & Claims, add a claim named role with the source attribute user.assignedroles.

Send extra user details (optional)

To bring in details like department, region or manager, add a claim named user_attr_metadata with the namespace http://schemas.xmlsoap.org/ws/2005/05/identity/claims. Its value must be a JSON string, because SAML can't carry JSON objects. SCIM must be on for these details to be stored. See How To: Ingest User Attributes From SSO.

Troubleshooting

Still stuck?

Reply in your shared Slack channel or email help@hyperbound.ai with a screenshot, the email of the person who tried to sign in, and the time they tried. We'll check our sign-in logs for that attempt.