Skip to content
shuffl
Get started

Searches the public product guides only. Nothing from a workspace is read, and questions are not saved.

How-to guide

Use Shuffl with Microsoft Entra ID

Connect Microsoft Entra ID to push people and groups to Shuffl and sign everyone in, and see what Shuffl does with it.

For HR and IT administrators

Have your agent do thisPaste the prompt into Claude Code, Cursor or another agent. It follows this guide over MCP and asks before it changes anything others will see.Show the prompt
Help me with "Use Shuffl with Microsoft Entra ID" in my Shuffl workspace.

1. Read the guide: https://shuffl.ai/docs/markdown/microsoft-entra-id
2. Add Shuffl's MCP server: https://shuffl.ai/api/mcp
   Claude Code: claude mcp add --transport http shuffl https://shuffl.ai/api/mcp
   When the browser opens, choose my workspace and allow the access the guide needs.
3. Work through the steps in order: Push people from Microsoft Entra ID; Sign in with Microsoft Entra ID. Do what you can over MCP and tell me which steps only I can do in the browser or in Slack.

Show me what you will change and who it affects, and wait for my yes before publishing, inviting or sending anything.
On this page

App links open your signed-in workspace. Check the selected workspace before making changes.

What Microsoft Entra ID does in Shuffl

Microsoft Entra ID can push people and groups to Shuffl over SCIM and sign everyone in. Removing someone in Entra takes their Shuffl access away at once.

You need to be a Shuffl workspace administrator, with an administrator in Microsoft Entra ID for the steps there.

Push people from Microsoft Entra ID

  1. In Shuffl, open Settings → Workspace → Integrations → Provisioning and choose New SCIM connection. Copy the base URL and the token, which is shown once.
  2. In Microsoft Entra ID, turn on SCIM 2.0 provisioning for a Shuffl app. Set Provisioning Mode to Automatic. Tenant URL takes the base URL and Secret Token the token.
  3. Turn on creating, updating and deactivating users, send the work email as the user name and assign the people who belong in Shuffl.
  4. Back in Shuffl, under Who gets workspace access?, choose Everyone assigned to this app or Selected groups only, then Save access policy.
  5. To use a pushed group in Shuffl, open People → Sync, choose Groups on the SCIM card and turn it on.

What comes in

Microsoft Entra ID sends each change as it happens. Shuffl only reads; it never changes anything in Microsoft Entra ID.

Microsoft Entra ID’s values replace People’s on every update, so fix a wrong title or manager in Microsoft Entra ID. A blank keeps what People has.

From Microsoft Entra ID into Shuffl

  • Everyone, with names and work emails
  • Job titles
  • Managers
  • Departments
  • Teams and groups, the ones you choose
  • Leavers

What it does for HR

In Shuffl

  • Managers fill the org chart, so playbook meet steps, manager to-dos and 30/60/90 plans reach the right person.
  • Departments become department groups, so Pulse, eNPS and Culture compare teams without exposing anyone.
  • Teams you bring in become synced groups for Pulse questions, automations, Connections and messages.
  • Suspended or removed accounts lose their Shuffl access.
  • Mello knows each person’s title, manager and department when it answers.

Sign in with Microsoft Entra ID

  1. In Shuffl, open Settings → Workspace → Integrations → Single sign-on, choose Add connection and pick OpenID Connect. Keep the values it shows open.
  2. In the Microsoft Entra admin center, open App registrations and choose New registration. Add the redirect URI as a Web platform redirect URI.
  3. Under Certificates & secrets, add a client secret. Under Token configuration, add the email optional claim to the ID token.
  4. Put the login URL in Branding & properties as the Home page URL so the app opens from My Apps.
  5. Copy the Application (client) ID and the secret. The issuer uses your Directory (tenant) ID.
  6. Add the DNS TXT record the connection shows at your DNS provider, then choose Check DNS record until it reads Verified.
  7. In a private window, choose Sign in with SSO with a work email that is in People with access enabled.

Single sign-on proves who someone is; People still decides who gets in. Set up People first, and password sign-in keeps working while you test.

Good to know

Entra sends the user principal name by default. For SAML, set the Unique User Identifier to user.mail so Shuffl gets the work email.

With your other systems

Entra ID sends no start dates. Connect your HR system for those, or use Microsoft 365 in People → Sync instead of SCIM, which reads hire dates. Keep one of the two.

If it stops working

If people stop arriving, read the provisioning errors in Microsoft Entra ID. Tokens expire after 90 days: choose Rotate token in Shuffl, paste the new one into Microsoft Entra ID, test it, then revoke the old one.

Unassigning someone in Microsoft Entra ID suspends their access at once. Restoring them doesn’t undo a suspension made by hand.

Was this guide helpful?