Entra OIDC

Last Updated: August 18, 2026

An identity provider (IdP) uses an authentication token to vouch for a person's identity. Vasion Automate uses IdPs for several tasks, including logging in to the Admin Console and portals, deploying printers, releasing print jobs, and more.

If you use an IdP, the Control Panel Application (CPA) supports only badge and PIN authentication.

Key Points

  • This configuration creates an OIDC connection, for the SAML method, refer to Entra ID (Azure AD) SAML.
  • If you use Azure Government, including Government Community Cloud (GCC) High, you cannot use the PrinterLogic Entra ID gallery application. Instead, create a custom app for provisioning in step 5.
  • This configuration is required for mobile Microsoft Intune environments. For more details refer to Microsoft Intune Support.
    • This authentication method allows mobile sign-in to enable the PrinterLogic mobile app to access documents protected by Microsoft Intune's Mobile Application Management (MAM) policies.

Requirements

  • Multi-IdP and Microsoft Intune features enabled for your PrinterLogic instance.
  • Microsoft Microsoft Intune environment with Mobile Application Management (MAM) policies.
  • Administrative access to both the Microsoft Entra admin center and PrinterLogic Admin Console.

Configure the Connection

To add and configure app properties for the PrinterLogic OIDC connection do the following:

  1. Add the IdP Information Template.
  2. Register the OIDC App.
  3. Add Mobile URIs.
  4. Configure IdP Settings.
  5. Configure SCIM Provisioning.

1. Add the IdP Information Template

There are two options in this

In a browser window, log in to Vasion Automate, and do the following:

  1. Select Admin from the left-side navigation.
  2. Select the Authentication option.

  3. Select the + New Authentication button.

    Authentication page showing + (add) New Authentication button.

  4. Select the IdP that you want to configure.
  5. Select Next.
  6. Give your IdP a unique name.
    1. (Optional) Add a description.
  7. Select OIDC in the Authentication Protocol section.

  8. In the Provisioning section, if you are using Systems for Cross-domain Identity Management (SCIM), leave the Just-in-Time (JIT) option deselected.

  9. Leave the IdP Information page open. You need this information for the next step.

IdP Information screen showing Service Provider Information section.

Keep the IdP Information screen open so that the Service Provider Information at the bottom is available for the following steps.

2. Register the OIDC Application

  1. Go to the Microsoft Entra admin center. (https://entra.microsoft.com/)

  2. In the left-side menu expand Entra ID, then select App registrations.

    Entra ID window showing options in expanded Entra ID menu.

  3. On the App Registrations page, select + New Registration in the upper-left.
  4. In the Register an application page, enter a Name for the application.
  5. Select the desired option in the Support account types section.
  6. In the Redirect URI (optional) section, choose the Web option in the Select a platform dropdown.

  7. Go back to the IdP Information template and copy the SSO URL from the Service Provider Information section.

    Service Provider Information section showing SSO URL and Mobile SSO URL.

  8. Paste the SSO URL in the field next to the Web option.
  9. Select Register.

"Register an application" modal showing Name, "Supported account types" section, and Redirect URI section.

3. Add Mobile URI

  1. On the new app's homepage, select the Redirect URIs option in the Essentials section.

    Microsoft Intune window, Overview page, showing Essentials section.

  2. In the Redirect URIs configuration section, select + Add Redirect URI.

  3. Select the Web option.

    "Select a platform to add redirect URI" modal showing "Web applications" section.

  4. Go back to the IdP Information template and copy the Mobile SSO URL from the Service Provider Information section.

    Service Provider Information section showing SSO URL and Mobile SSO URL.

  5. Paste the Mobile SSO URL in the new Redirect URI field.

  6. In the new field that appears, add the following Redirect URI.

    Copy Code 
    http://localhost
  7. Select Configure.

  8. On the Authentication (Preview) page, select Settings.

    Settings tab showing "Web and SPA settings" and "Implicit grant and hybrid flows" sections.

  9. In the Implicit grant and hybrid flows section, select the Access tokens (used for implicit flows) option.
  10. Select Save.

4. Configure IdP Settings

  1. Select Overview from the app's left-side menu.

  2. Select the Endpoints option.

    Endpoints menu option in Entra.

    1. In the Endpoints modal, copy the OpenID Connect metadata document.
    2. Paste it into the IdP Information Discovery Endpoint field.
    3. Close the Endpoints modal.

  3. Copy the Application (client) ID from the Entra app's Essentials section and paste it into both the Client Id for Clients and the Client Id for Server fields.

    Microsoft Intune window, Overview page, showing Essentials section.

  4. Select Certificates and secrets in the app's left-side menu.
  5. Select + New client secret.
    1. Enter Server in the Description field.
    2. Adjust the Expires value as needed.
    3. Select Add.

  6. Copy the Value for the Server secret and paste it into the IdP Information Client Secret for Server field.

    Copy the Value, not the Secret ID.
  7. Select + New client secret again.
    1. Enter Client in the Description field.
    2. Adjust the Expires value as needed.
    3. Select Add.

  8. Copy the Value for the Client secret and paste it into the IdP Information Client Secret for Clients field.

    "Client secrets" tab showing server and client information.

  9. Select Apply in the IdP Information modal.
  10. Select Save in Vasion Automate.

IdP Information screen showing Service Provider Information section.

5. Configure SCIM Provisioning

The following sections guide you through creating the Entra Provisioning app, adding the Microsoft Intune users and groups, and applying the SCIM token.

Create Provisioning App

  1. In your preferred browser, go to the Microsoft Entra admin center at https://entra.microsoft.com/#home, and log in.

  2. From the left-side navigation, expand Entra ID, and select the Enterprise apps option.

    Microsoft Entra admin center showing expanded Entra ID side navigation and "Enterprise apps" option.

  3. Select + New application.

    Microsoft Entra admin center showing "Enterprise applications" tab and "+ New application" button.

  4. There are two options here.
    1. Search for and select the PrinterLogic gallery app.
    2. Or select + Create your own application.
  5. Give your app a unique name, and select Create.

Add Users and Groups

  1. On the app's Overview page, and select 1. Assign Users and Groups.
  2. Select the + Add User/Group option.
  3. In the Users and Groups section of the Add Assignments page, select None Selected.
  4. Add the users and groups you want to provision over.
  5. The Users role applies automatically.
  6. Select the Select button.
  7. Select Assign.

Entra ID "Users and groups" window showing results found.

Enable Provisioning

  1. On the app's Overview page, select Provisioning from the left-side Manage menu.

  2. On the Overview (Preview) page, select + New configuration.

    Overview page showing "New configuration" button.

  3. Copy the SCIM Tenant URL below and adjust <Your_Instance_Subdomain> to your instance (e.g., example.printercloud.com would be example).

    Copy Code 
    https://gw.app.printercloud.com/<Your_Instance_Subdomain>/scim/v2
  4. Expand the Entra Admin Credentials section and paste the URL into the Tenant URL field.
  5. In the Vasion Automate IdP Information go to the SCIM Token section and select Generate New Token.
  6. Copy the token and paste it into the Entra Secret Token field.
  7. Select Test Connection.
  8. Select Create.
  9. Select Provisioning from the left-side menu.

  10. Turn Provisioning Status to On, and then select Save.

    Entra ID app showing Provisioning tab, with Provisioning Status On.

The initial provisioning can take up to 45 minutes to "Automatically" provision after changes are made. Select the Start Provisioning option on the Provisioning tab to start the process sooner. Use Provision on Demand to provision specific users for testing purposes.

Next Steps

  • For steps on assigning users and roles to the PrinterLogic and Vasion Automate Admin Console, refer to Admin Console Users.
  • Microsoft Intune Support (Optional, supporting Mobile app Microsoft Intune Login tied to the, OIDC configuration.)