With single sign-on (SSO) through Microsoft Entra, your team logs in to Productive with their Microsoft accounts. There are fewer passwords to manage, and access is controlled in one place.
Most of the setup happens in Microsoft Entra. You’ll copy a few values between Entra and Productive’s SSO settings, in Settings > Integrations > SSO and SCIM. Only users who can administer the organization see that page.
📌 Set up SSO before you turn on SCIM to sync users automatically.
Step 1: Add Productive to Entra
In Entra, go to Enterprise Applications and click New Application.
Search for Productive, click the Productive tile, and click Create.
Step 2: Check Your Users’ Names
Every user needs a first and last name in Entra. Go to Users > All users and check each one.
If a name is missing, click Edit, open the Identity tab, enter the first and last name, and click Save.
Step 3: Choose Who Can Use SSO
Open the Productive application, go to Users and Groups, and click Add user/group.
Select the users who should log in with Entra SSO, click Select, then Assign.
Step 4: Copy Values From Productive to Entra
In the Productive application in Entra, go to Single sign-on and choose SAML.
In the Basic SAML Configuration section, click Edit.
In Productive, go to Settings > Integrations > SSO and SCIM and copy the Audience URI.
In Entra, paste it into Identifier (Entity ID). Delete any other entries and mark this one as the default.
In Productive, copy the Single sign-on URL.
In Entra, paste it into Reply URL (Assertion Consumer Service URL) and click Save.
Step 5: Copy Values From Entra to Productive
In Entra, under SAML Certificates, copy the App Federation Metadata URL.
In Productive’s SSO settings, paste it into Metadata URL.
In Entra, copy the Login URL.
In Productive, paste it into Identity Provider Single sign-on URL.
Click Enable SSO.
Step 6: Set Up the User Attributes in Entra
In the Attributes & Claims section, click Edit.
Click the required claim, set Source Attribute to user.mail, and click Save. Productive identifies people by their email address.
Under Additional Claims, click the claim with the value user.givenname. Set its Name to first_name, clear Namespace, and click Save.
Click the claim with the value user.surname. Set its Name to last_name, clear Namespace, and click Save.
Step 7: Test SSO
In the Productive application in Entra, click Single sign-on, then Test at the bottom of the page.
Click Test sign in.
You can also test from the Productive login page: click Use single sign-on (SSO).
Require SSO for Everyone
Once SSO works, you can turn on Force login via single sign-on in Productive’s SSO settings. People then can’t log in with a username and password. You can only turn it on while you’re logged in through SSO yourself.
Sync Users With SCIM
You can also turn on SCIM, on the same settings page. It keeps your users in step with Entra: people you add, change, or remove in Entra are added, changed, or removed in Productive too.