This article is for your IT team. SSO is set up together with LeanSuite. Contact your LeanSuite representative or [email protected] to start.
LeanSuite supports SAML Single Sign-On with Microsoft Entra ID (Azure AD) and Google.
1. Create the enterprise application
In Entra ID, create an enterprise application for LeanSuite using the SAML details LeanSuite provides.
2. Configure claims
Under Attributes & Claims, add the following claims. Use the full URI form for claim names.
Claim | Value | Notes |
user.mail | The user's email address | |
username | The attribute that matches the user's LeanSuite username, for example user.mailnickname | If this doesn't match, users log in but aren't matched to their LeanSuite account |
phone_number | A constant value set with a claim transformation | Required by our sign-in service. The value is not stored and your directory isn't changed. |
gender | A constant value | Required by our sign-in service. The value is not stored. |
3. Exchange metadata
Download the Federation Metadata XML from Entra ID and send it to LeanSuite.
Any time you change claims, download the metadata again and send the new file.
4. Test
Test with a test user in a separate browser or private window.
On mobile, users need the latest version of the LeanSuite app to sign in with SSO.
Finish SSO setup before bulk-creating users, so usernames match.
Troubleshooting
"Invalid phone number format": the phone_number claim is missing or not in a valid format. Set it to a constant, valid-format value using a claim transformation.
User logs in but lands in the wrong account or no account: the username claim doesn't match the LeanSuite username. Map the attribute that matches, for example mailnickname instead of an object ID.
Changes don't take effect: re-send the updated metadata XML to LeanSuite.