Migrate Entra SAML to OIDC

Last Updated: July 02, 2026

This topic outlines the required steps to migrate your Entra ID SAML configuration to an OIDC connection.

Key Points

  • This configuration migrates an Entra ID SAML connection to an OIDC connection, for the SAML method, refer to Entra ID (SAML).
  • This configuration is required for mobile Microsoft Intune environments. For more details refer to Microsoft Intune Support.
    • This authentication method allows mobile sign-in to enable the PrinterLogic mobile app to access documents protected by Microsoft Intune's Mobile Application Management (MAM) policies.

Configure the Connection

To add and configure app properties for the PrinterLogic OIDC connection do the following:

  1. Open the Existing SAML Template.
  2. Register Entra OIDC Application.
  3. Add Mobile URIs.
  4. Configure IdP Settings.
  5. Configure SCIM Provisioning.

1. Open the Existing SAML Template

In a browser window, log in to Vasion Automate, and do the following:

  1. Select Admin from the left-side navigation.
  2. Select the Authentication option.
  3. Select your existing Entra IDSAML configuration.
  4. Copy the SCIM Tenant URL and save it. We'll use it in a later step.
  5. Clear all the values from the IdP Template, including the login options.
  6. Select the OIDC option in the Authentication Protocol section.
  7. Leave the IdP Information template with the new fields open.

IdP Information screen, showing Service Provider Information section.

Keep the IdP Information screen open so that the Service Provider Information at the bottom is available for the following steps.

2. Register Entra OIDC Application

To create and register the application:

  1. Go to the Microsoft Entra admin center. (https://entra.microsoft.com/)

  2. In the left-side menu expand Entra ID, then select App registrations.

    Entra ID window, showing options in expanded Entra ID menu.

  3. On the App Registrations page, select + New Registration in the upper-left.
  4. In the Register an application page, enter a Name for the application.
  5. Select the desired option in the Support account types section.
  6. In the Redirect URI (optional) section, choose the Web option in the Select a platform dropdown.

  7. Go back to the IdP Information template and copy the SSO URL from the Service Provider Information section.

    Service Provider Information section, showing SSO URL and Mobile SSO URL.

  8. Paste the SSO URL in the field next to the Web option.
  9. Select Register.

"Register an application" modal, showing Name, "Supported account types" section, and Redirect URI section.

3. Add Mobile URIs

To add the mobile URIs:

  1. On the new app's homepage, select the Redirect URIs option in the Essentials section.

    Microsoft Intune window, Overview page, showing Essentials section.

  2. In the Redirect URIs configuration section, select + Add Redirect URI.

  3. Select the Web option.

    "Select a platform to add redirect URI" modal, showing "Web applications" section.

  4. Go back to the IdP Information template and copy the Mobile SSO URL from the Service Provider Information section.

    Service Provider Information section, showing SSO URL and Mobile SSO URL.

  5. Paste the Mobile SSO URL in the new Redirect URI field.

  6. In the new field that appears, add the following Redirect URI.

    Copy Code 
    http://localhost
  7. Select Configure.

  8. On the Authentication (Preview) page, select Settings.

    Settings tab, showing "Web and SPA settings" and "Implicit grant and hybrid flows" sections.

  9. In the Implicit grant and hybrid flows section, select the Access tokens (used for implicit flows) option.
  10. Select Save.

4. Configure IdP Settings

To configure the IdP Settings:

  1. Select Overview from the app's left-side menu.

  2. Select the Endpoints option.

    Endpoints menu option in Entra.

    1. In the Endpoints modal, copy the OpenID Connect metadata document.
    2. Paste it into the IdP Information Discovery Endpoint field.
    3. Close the Endpoints modal.

  3. Copy the Application (client) ID from the Entra app's Essentials section and paste it into both the Client Id for Clients and the Client Id for Server fields.

    Microsoft Intune window, Overview page, showing Essentials section.

  4. Select Certificates and secrets in the app's left-side menu.
  5. Select + New client secret.
    1. Enter Server in the Description field.
    2. Adjust the Expires value as needed.
    3. Select Add.

  6. Copy the Value for the Server secret and paste it into the IdP Information Client Secret for Server field.

    Copy the Value, not the Secret ID.
  7. Select + New client secret again.
    1. Enter Client in the Description field.
    2. Adjust the Expires value as needed.
    3. Select Add.

  8. Copy the Value for the Client secret and paste it into the IdP Information Client Secret for Clients field.

    "Client secrets" tab, showing server and client information.

  9. Select Apply in the IdP Information modal.
  10. Select Save in Vasion Automate.

IdP Information screen, showing Service Provider Information section.

5. Configure SCIM Provisioning

The following sections guide you through creating the Entra Provisioning app, adding the users and groups, and applying the SCIM token.

Locate the Existing Entra ID SAML App

  1. Navigate to the Microsoft Entra admin center.

  2. In the left-side menu expand Entra ID, then select Enterprise apps.

    Entra ID window, showing options in expanded Entra ID menu.

  3. Search for and select your existing Entra ID SAML app.

Add Users and Groups

  1. On the app's Overview page, and select 1. Assign Users and Groups.
  2. Verify the desired users and groups show.
  3. Select the + Add User/Group option to add more.
    1. In the Users and Groups section of the Add Assignments page, select None Selected.
    2. Add the users and groups you want to provision over.
    3. The user roles the Users role for end users.
  4. Select the Select button.
  5. Select Assign.

Entra ID "Users and groups" window, showing results found.

Adjust Provisioning

  1. On the app's Overview page, select Provisioning from the left-side Manage menu.

  2. Expand the Admin Credentials section, and verify the Tenant URL follows the structure below. (e.g., example.printercloud.com would be example).

    SCIM Tenant URLs are instance-specific and should not change. This step is verifying the instance subdomain is correct, and should match to SCIM Tenant URL copied in step 1.

    Copy Code 
    https://gw.app.printercloud.com/<Your_Instance_Subdomain>/scim/v2
  3. In the Vasion Automate IdP Information go to the SCIM Token section and select Generate New Token.
  4. Copy the new OIDC SCIM token and paste it into the Entra Secret Token field.
  5. Select Test Connection.

  6. Verify the Provisioning Status is set to On.

    Entra ID app showing Provisioning tab, with Provisioning Status On.

  7. Select Save.

The initial provisioning can take up to 45 minutes to "Automatically" provision after changes are made. Select the Start Provisioning option on the Provisioning tab to start the process sooner. Use Provision on Demand to provision specific users for testing purposes.

Next Steps

  • Microsoft Intune Support (Optional, supporting Mobile app Microsoft Intune Login tied to the, OIDC configuration.)
  • For steps on assigning users and roles to the PrinterLogic and Vasion Automate Admin Console, refer to Admin Console Users.