×

ClickUp SAML SCIM Setup Guide

/ ClickUp / By

ClickUp SAML SCIM Setup Guide

This guide explains how to configure custom SAML SSO and SCIM provisioning for ClickUp using Microsoft Entra ID so your workspace stays secure and automatically in sync with your identity provider.

You will create a custom enterprise application in Entra ID, configure SAML-based single sign-on, enable SCIM provisioning, and then connect everything to your workspace. Follow each section carefully and test before enforcing login policies for your members.

Before you start: ClickUp and Entra prerequisites

Make sure the following requirements are met before you configure anything:

  • You have admin access to your ClickUp workspace security settings.
  • You have admin or application admin access to Microsoft Entra ID (Azure AD).
  • You know which users and groups should access your workspace.
  • You understand your organization’s SSO and SCIM security policies.

SCIM is included with certain plans and may require an upgraded subscription. Confirm your plan and security features in your workspace settings or with your account manager.

Create a custom enterprise app for ClickUp

First, create a new custom enterprise application in Microsoft Entra ID dedicated to your workspace.

  1. Sign in to the Microsoft Entra admin center.
  2. Navigate to Enterprise applications.
  3. Select New application.
  4. Choose Create your own application.
  5. Name the app clearly, for example ClickUp SAML SCIM.
  6. Select Integrate any other application you don’t find in the gallery.
  7. Click Create.

Once the application is created, you can configure SAML single sign-on and provisioning for your ClickUp users.

Configure ClickUp SAML SSO in Entra ID

Next, configure the SAML-based single sign-on settings for the enterprise app so users authenticate to your workspace through Entra ID.

  1. In the enterprise application, go to Single sign-on.
  2. Select the SAML method.
  3. In the Basic SAML Configuration section, edit the default values.

Set SAML identifiers and reply URLs for ClickUp

Populate the SAML configuration fields with your workspace details:

  • Identifier (Entity ID): Use the SAML Entity ID from your workspace security settings.
  • Reply URL (Assertion Consumer Service URL): Use the ACS URL from your SAML configuration page.
  • Sign on URL (optional): If provided in the workspace configuration page, enter it here.

You can obtain the exact values for these fields from the SAML section in your workspace security settings, where they are listed for custom identity providers.

Configure SAML user attributes for ClickUp

In the User Attributes & Claims section, verify that the mandatory SAML claims are correctly mapped:

  • user.principalname or user.mail as the primary identifier.
  • email, givenName, and surname if required by your workspace.

Match the claim names and formats to the values shown on the ClickUp SAML configuration page. Consistent claims ensure new users are matched and authenticated correctly.

Download SAML certificate and endpoints

After saving your SAML configuration:

  • Download the Base64-encoded certificate (often named Certificate (Base64)).
  • Copy the Login URL (also called SAML Single Sign-On Service URL or Azure AD Identifier depending on your view).

You will paste these into your workspace security settings to finalize the SSO connection.

Connect Entra SAML to ClickUp

Now switch to your workspace security configuration page and plug in the Entra SSO values.

  1. Open your workspace and go to Security & Permissions or the equivalent security page.
  2. Locate the SAML SSO or Custom SAML area.
  3. Paste the Login URL from Entra ID into the IdP URL field.
  4. Upload or paste the Base64 certificate value into the certificate field.
  5. Confirm the Entity ID and ACS URL match what you placed in Entra ID.
  6. Save your SAML configuration.

Use the test SSO option provided in the workspace to verify that sign-in works correctly for a pilot user before enforcing SSO for everyone.

Enable ClickUp SCIM provisioning in Entra ID

With SAML configured, you can set up SCIM so users and groups automatically provision and deprovision in your workspace.

  1. In your enterprise application, go to Provisioning.
  2. Set the Provisioning Mode to Automatic.
  3. Under Admin Credentials, configure the SCIM endpoint and token.

Add ClickUp SCIM endpoint and token

From your workspace SCIM configuration page, copy the SCIM base URL and token, then paste them into Entra ID:

  • Tenant URL: The SCIM endpoint URL shown in workspace settings.
  • Secret Token: The SCIM bearer token generated in the same section.

Click Test Connection in Entra ID. If the connection succeeds, save the configuration to enable SCIM synchronization.

Map SCIM attributes for ClickUp

In the Mappings section, confirm that user and group attributes are correctly aligned with your workspace schema:

  • Common attributes: userName, givenName, familyName, active.
  • Optional mappings for advanced role or group management, if supported.

Keep default mappings unless the workspace documentation specifies additional requirements. Incorrect mappings can prevent proper provisioning.

Assign users and groups to ClickUp

Once SCIM is active, assign users and groups in Entra ID to control who gets access to your workspace.

  1. In the enterprise app, go to Users and groups.
  2. Select Add user/group.
  3. Choose the users or groups you want to sync.
  4. Click Assign.

Assigned users will be provisioned automatically through SCIM. Removing a user or group from the app will deprovision access according to your workspace settings and sync schedule.

Test and enforce ClickUp SSO

Before enforcing SSO-only access, verify both SAML and SCIM behavior:

  • Sign in as a test user via the SSO URL.
  • Confirm that the user account is created or mapped correctly.
  • Check that profile information and memberships reflect identity provider data.
  • Remove the user from the app and verify deprovisioning, if applicable.

After successful testing, you can enable a policy that requires workspace members to sign in using SSO, depending on your plan and security configuration.

Official ClickUp SAML SCIM reference

For exact field names, supported attributes, and the latest screenshots, review the official configuration guide: Custom SAML SCIM configuration via Entra ID. That page is maintained as the authoritative reference for this integration.

Get expert help with ClickUp integrations

If you need assistance designing SSO and SCIM architecture, troubleshooting claims, or aligning provisioning with your organizational structure, consider working with a specialist partner. You can find strategic consulting and implementation support at Consultevo, including services focused on workspace security and automation.

By following this step-by-step process, you can integrate your identity provider with your workspace using SAML and SCIM, centralize user management in Microsoft Entra ID, and maintain secure, automated access control for your entire team.

Need Help With ClickUp?

If you want expert help building, automating, or scaling your ClickUp workspace, work with ConsultEvo — trusted ClickUp Solution Partners.

Get Help

“`

Verified by MonsterInsights