ClickCerts
Setup guide

Connect ClickCerts to Microsoft Entra ID.

For the Entra ID administrator at your organization. When you finish, your people sign in to ClickCerts with their Microsoft work account and no ClickCerts password. Works the same for commercial and GCC High tenants, and takes about ten minutes. You need the Cloud Application Administrator role or higher. Part 2 adds optional automatic provisioning, so Entra creates and deactivates your ClickCerts users for you.

Download as PDF
Part 1

Single sign-on

  1. 1

    Create the application

    In the Microsoft Entra admin center open Enterprise applications, choose New application, then Create your own application. Name it ClickCerts, select Integrate any other application you don’t find in the gallery (Non-gallery), and click Create.

  2. 2

    Set up SAML sign-on

    In the application, open Single sign-on and choose SAML. In section 1, Basic SAML Configuration, click Edit and enter the two values below exactly. Leave Sign on URL, Relay State and Logout URL blank. Save.

    Identifier (Entity ID)

    https://vyiawiutnzdqrwjcazxk.supabase.co/auth/v1/sso/saml/metadata

    Reply URL (Assertion Consumer Service URL)

    https://vyiawiutnzdqrwjcazxk.supabase.co/auth/v1/sso/saml/acs
  3. 3

    Add the display-name claim

    In section 2, Attributes & Claims, click Edit, then Add new claim. Name: displayname. Namespace: blank. Source attribute: user.displayname. Save. Leave the default claims as they are; ClickCerts reads each user’s email from emailaddress, so every user needs a mail address in Entra.

  4. 4

    Assign your users

    Open Users and groups and add the people (or group, where your plan allows) who will use ClickCerts. Anyone not assigned here is refused by Microsoft at sign-in.

  5. 5

    Send us the metadata URL

    Back in Single sign-on, section 3, SAML Certificates, copy the App Federation Metadata Url. Send that URL and the email domain(s) your people sign in with to your ClickCerts contact. GCC High tenants see a URL beginning with login.microsoftonline.us; that is expected.

What happens next

ClickCerts registers your connection, usually the same business day, and confirms by email. From then on, anyone at your domain who opens the ClickCerts sign-in page and enters their work email is sent to Microsoft to authenticate and returned to their training dashboard. Existing users keep their history. New users are invited by your ClickCerts administrator as before, and activate by signing in with Microsoft.

If sign-in fails: check the two values in step 2 for a stray character, confirm the user is assigned in step 4, and confirm the user’s email domain was sent to ClickCerts in step 5. Microsoft’s own error text (AADSTS…) names which of these it is.

Part 2 · optional

Automatic user provisioning

With provisioning on, Entra creates each assigned person in ClickCerts, keeps their name and email current, and deactivates them when you disable or unassign them, with no invitations to send and no one to remember to remove. ClickCerts supports SCIM 2.0, the standard Entra uses. Takes about ten minutes, in the same application you created in Part 1.

  1. 6

    Get your provisioning credentials from ClickCerts

    When provisioning is enabled for your organization, your ClickCerts contact sends you two values: a Tenant URL and a Secret Token. The token is shown to ClickCerts once and cannot be recovered, only replaced, so paste it into Entra in the next step and keep it nowhere else. If you skipped Part 1 because your people use the standard Microsoft sign-in button, create the application as in step 1 and skip steps 2 to 5.

  2. 7

    Turn on provisioning

    In the ClickCerts application open Provisioning and choose Get started (in some tenants, New configuration). Set Provisioning Mode to Automatic. Under Admin Credentials paste the Tenant URL and the Secret Token, then click Test Connection. Entra reports that the credentials are authorized. Save.

  3. 8

    Check the attribute mappings

    Open Mappings, then Provision Microsoft Entra ID Users. Leave Create, Update and Delete checked. ClickCerts reads the six attributes below and ignores everything else Entra sends, so leave the other default mappings as they are.

    ClickCerts attributeEntra sourceWhat it does
    userNameuserPrincipalName (or mail, see note)Becomes the ClickCerts sign-in email.
    displayNamedisplayNameShown as the person’s name.
    name.givenNamegivenName
    name.familyNamesurname
    activeSwitch([IsSoftDeleted], …)Entra’s default; drives deactivation.
    externalIdobjectIdChange from Entra’s default, mailNickname (see below).

    Change one mapping: Entra maps externalId to mailNickname by default. A mail nickname can change when someone’s alias changes, and can later be given to someone else. Edit the externalId row and change its source attribute to objectId, which stays the same for the life of the account.

    One thing to check: the userName value becomes the address the person signs in with, and it must be the same address Microsoft sends in the emailaddress claim from Part 1. At most tenants the user principal name and the mail address are identical and the default mapping is right. If yours differ, edit the userName row and change its source attribute to mail.

  4. 9

    Scope it, then provision one person

    Under Settings, set Scope to Sync only assigned users and groups, so only the people you assigned in step 4 are sent to ClickCerts. Before switching the schedule on, use Provision on demand to send a single user: pick one person, and Entra walks through the lookup, the create and the result, so any problem is visible with one name attached rather than fifty. When that person appears in ClickCerts, set Provisioning Status to On and Save. Entra syncs every 40 minutes from then on.

What provisioning does

  • A new person appears in ClickCerts as an employee with their training assigned, and shows as Pending until they sign in with Microsoft for the first time. No invitation email is sent; there is nothing for them to set up.
  • Someone who is already in ClickCerts with the same email is matched and kept, with their history and certificates. Nobody is duplicated.
  • Past your seat cap, a new person waits for a seat rather than failing. They are switched on automatically, oldest first, as seats free up, and your ClickCerts administrator is told the first time it happens.
  • Disabling, unassigning or deleting a person in Entra deactivates them in ClickCerts and frees their seat. Their record, certificates and training history are kept. ClickCerts never deletes a person on Entra’s behalf. Removal is not instant: Entra’s scheduled sync may not pick up an unassignment at all, so when someone should lose access right away, run Provision on demand for that person and Entra sends the deactivation immediately.
  • Roles are never touched. Provisioning only ever creates employees. Administrators are set in ClickCerts.
  • The email domain must be one you gave us in step 5. A person from another domain is refused, and Entra’s provisioning log names the domains ClickCerts will accept.

If provisioning fails: Entra’s Provisioning logs show ClickCerts’ own reason for each person. A failed Test Connection means a mistyped Tenant URL or a token that has since been replaced — ask your ClickCerts contact for a new one. Provisioning and single sign-on are independent, so a provisioning problem never stops anyone signing in.

Questions? Contact us.