Hi,
we're moving to a new Microsoft Entra ID (Azure AD) tenant. Since we sign in to Docebo through SSO, there are a few things on your side we'll need your help with. We can't change these from our end.
The main reason for this is that we’ve been acquired and we are in the process of consolidating everything.
We're planning to switch over around the end of January.
Here's what's changing for us:
- Our tenant ID is going from [Our current ID] to [New Tenant ID]
- We'll have new SSO details: Entity ID/Issuer, login and logout URLs, and signing certificate (new metadata attached, or available at [New Metadata URL])
- User emails/UPNs are staying the same, but the underlying Microsoft object IDs will likely change. If you match users on object ID, please let us know.
Could you let us know about the following?
-
SSO setup: What's the process for updating our SSO connection with the new details? Can we set up the new one alongside the old one ahead of time, or does it have to be swapped on the day?
-
Matching users: How do you link people to their existing accounts (email, UPN, NameID, object ID)? We want to make sure nobody ends up with a duplicate account or loses their data or permissions.
-
Provisioning (SCIM): If we use automatic provisioning with you, we'll need a new SCIM endpoint/token. Will re-syncing link up with existing accounts instead of creating new ones?
-
Integrations: If anything uses an app registration, client ID, or admin consent in our tenant, what needs to be redone in the new one?
-
Tenant/domain restrictions: If access is locked to our tenant ID or domain, can you add the new tenant ID?
-
Anything else tied to our current tenant that we might not know about.
It'd also help to have a contact we can reach on switchover day, a way to test before we go live if you have one, and a quick note on how we'd roll back if something goes sideways.
Happy to answer any questions, feel free to reach out to me.
Kind Regards