Company configuration
An administrator configures the company-specific Microsoft Entra ID integration and selected groups. Authentication, sign-in policy and directory synchronization are related but separate controls.
Authoritative integration documentation
Microsoft Entra ID, SSO and SCIM capability status
CardIQ provides company-controlled professional identity and lifecycle controls. Each capability below is marked as available now, offered as an Enterprise pilot, or not yet supported.
Current capability matrix
Last reviewed: 2026-09-05. “Where configured” means the required CardIQ entitlement, tenant configuration, Microsoft permissions and deployment prerequisites are in place. Features present in the repository must not be assumed to be deployed for every production tenant.
| Capability | Current status |
|---|---|
| Microsoft Entra OIDC authentication | Implemented and available where deployed and configured, for active pre-mapped CardIQ users |
| Entra sign-in policy enforcement | Available now. A company can require Entra sign-in for its users once the integration passes a readiness check; Super Admin is exempt. Sessions that are already open stay active until they expire or are signed out. |
| Entra directory preview / selected-group preview | Implemented and available where configured |
| Controlled employee synchronization | Implemented where configured and administrator-reviewed |
| Scheduled reconciliation | Implemented where configured; requires deployment scheduling / an external scheduler |
| Optional automated deactivation | Implemented as an opt-in, policy-controlled workflow with safeguards for explicitly disabled Entra accounts |
| SCIM 2.0 Users provisioning | Enterprise pilot. Includes discovery endpoints and Users create/read/update/deactivate flows. We validate interoperability with your identity provider in staging before go-live. |
| SCIM Groups / Bulk | Not currently supported |
| SAML login | Not currently active; stored SAML metadata remains configuration foundation only |
| Just-in-Time (JIT) login-user creation | Not currently supported |
| Native Okta provisioning | Not currently supported |
| Generic tested OIDC/SAML compatibility | Not currently claimed |
Microsoft Entra workflow
Connect → Preview → Review → Controlled Sync → Reconcile
Preview and review
Entra directory information from selected groups can be previewed and reviewed before supported employee data is linked, created or updated. Controlled creation creates an employee record; it does not imply JIT creation of a CardIQ login user, role or invitation.
Reconciliation and safeguards
Optional automated reconciliation can monitor changes or apply configured low-risk updates. Optional employee deactivation for an explicitly disabled Entra account requires configured policy and safeguards. A user missing from selected-group results is not treated as proven deleted from Entra.
Required Entra sign-in
Once readiness checks pass, a company can require Entra sign-in for its users. Local password authentication is then blocked after valid credentials are checked, while Super Admin remains exempt.
SCIM 2.0 Users implementation status
SCIM 2.0 Users provisioning is offered to Enterprise customers as a guided pilot, validated with your identity provider before production use.
Implemented surface
ServiceProviderConfig, ResourceTypes, Schemas and Users endpoints are implemented, with bearer-token authentication, tenant isolation, audit logging, filtering and pagination support for the documented Users scope.
Lifecycle behavior
The Users flow supports create, read, update and active=false deactivation through CardIQ employee lifecycle controls. Stable SCIM mappings are maintained for tenant-scoped identities.
Security model
SCIM credentials are tenant-scoped, hashed at rest and checked with constant-time comparison. Enterprise entitlement, enabled state, revocation state and active-company eligibility are enforced server-side.
Validation boundary
Real Microsoft Entra provisioning interoperability must be validated in staging before CardIQ describes SCIM Users as generally production-ready. Groups and Bulk are not part of the current supported scope.
Authentication is not provisioning
Microsoft Entra OIDC authenticates an existing mapped login user where configured. SCIM manages employee identity lifecycle records. These are separate capabilities, and neither implies SAML login or JIT login-user creation.
SCIM availability
SCIM 2.0 Users is offered as an Enterprise pilot, with staging interoperability validation for each customer before go-live. Controlled Entra synchronization remains a separate Microsoft Graph-based workflow.
SAML and Entra SSO
SAML login is coming soon; companies can already store their SAML metadata. Microsoft Entra OIDC sign-in is available now and can be made required once the company passes a readiness check.
Okta and other providers
CardIQ does not currently claim native Okta provisioning or tested generic OIDC/SAML compatibility. Additional enterprise identity integrations may be evaluated as part of an Enterprise deployment.
Control how employees represent your company externally
Explore the CardIQ Identity platform or review the workflow from verification through identity deactivation.
See how CardIQ Identity works View pricing