Set up SAML Single Sign-On so your users can sign in to LeanSuite with their company account. LeanSuite supports SAML Single Sign-On with Microsoft Entra ID (Azure AD) and Google.
Who can do this: Your IT team. SSO is set up together with LeanSuite. Contact your LeanSuite representative or [email protected] to start.
1. Create the enterprise application
In Entra ID, create an enterprise application for LeanSuite using the SAML details LeanSuite provides.
2. Configure claims
Under Attributes & Claims, add the following claims. Use the full URI form for claim names.
Claim | Value | Notes |
user.mail | The user's email address | |
username | The attribute that matches the user's LeanSuite username, for example user.mailnickname | If this doesn't match, users log in but aren't matched to their LeanSuite account |
phone_number | A constant value set with a claim transformation | Required by our sign-in service. The value is not stored and your directory isn't changed. |
gender | A constant value | Required by our sign-in service. The value is not stored. |
3. Exchange metadata
Download the Federation Metadata XML from Entra ID and send it to LeanSuite.
Important: Any time you change claims, download the metadata again and send the new file.
4. Test
Test with a test user in a separate browser or private window.
On mobile, users need the latest version of the LeanSuite app to sign in with SSO.
Finish SSO setup before bulk-creating users, so usernames match.
Troubleshooting
"Invalid phone number format": the phone_number claim is missing or not in a valid format. Set it to a constant, valid-format value using a claim transformation.
User logs in but lands in the wrong account or no account: the username claim doesn't match the LeanSuite username. Map the attribute that matches, for example mailnickname instead of an object ID.
Changes don't take effect: re-send the updated metadata XML to LeanSuite.