TL;DR
Connect Microsoft Entra ID to Genea so people sign in with their Microsoft account (single sign-on) and Genea users are created, updated and removed automatically (SCIM provisioning).
There are three setup models, depending on how many Entra tenants and Genea portals your organization has.
Overview
Genea works with Microsoft Entra ID in two ways: people sign in to Genea with their Microsoft account, and their Genea user records are created, updated and removed automatically as you change them in Entra.
A few terms are used throughout this article:
Entra tenant: your organization's Microsoft Entra ID directory, where your users and groups live.
Genea portal: a Genea account your organization manages, with its own sites, users and access rules.
Genea Entra app: Genea's application in the Microsoft Entra applications. You add it under Enterprise applications.
Provisioning token: the secret you generate in a Genea portal and paste into the Entra app so Entra can provision users into that portal.
Which setup fits you?
Find the row that matches how your organization is structured.
One Entra tenant and one Genea portal: user provisioning and single sign-on are supported. Go to Model 1.
One Entra tenant and several Genea portals: user provisioning is supported, and single sign-on is supported for every portal. Go to Model 2.
Several Entra tenants and one Genea portal: user provisioning is supported from every tenant, but single sign-on is supported for one tenant only. Go to Model 3.
Model 1: One Entra tenant, one Genea portal
This is the standard setup. You add the Genea app to your Entra tenant once and connect it to your Genea portal. Everyone you assign to the app can sign in with Microsoft and is kept in sync automatically.
How it works:
Users and groups assigned to the Genea app in Entra are created in your Genea portal.
Profile changes in Entra update the Genea user.
Unassigning or disabling a user in Entra deletes the user in Genea.
Users sign in to Genea with their Microsoft account.
Setup:
In Entra, add the Genea app from the Enterprise applications.
In your Genea portal, install the Microsoft Entra ID integration and copy the provisioning token.
In the Entra app, turn on provisioning and enter the Genea provisioning URL and token.
Set up single sign-on and assign your users or groups to the app.
Model 2: One Entra tenant, several Genea portals
Use this when your organization runs more than one Genea portal, for example one per region or business unit, but manages everyone in a single Entra tenant. Microsoft supports adding the same enterprise application more than once (app multi-instancing). Each copy of the Genea app connects to exactly one Genea portal.
How it works:
Each copy of the Genea app has its own provisioning connection and its own single sign-on setup.
Each Genea portal is registered with the unique identifier (Object ID) of its matching app copy, so sign-ins land in the right portal.
A person in group A appears only in portal A. A person in both groups appears in both portals.
Removing someone from group B removes them from portal B only.
Setup:
Create one Entra security group per Genea portal.
Add the Genea app from the gallery once per portal. Give each copy a clear name, such as "Genea - Portal A".
In each Genea portal, install the Entra integration and copy that portal's provisioning token.
Enter each portal's token in its matching app copy and turn on provisioning.
Share each app copy's Object ID with Genea so it can be registered with the right portal for sign-in.
Assign each group to its matching app copy.
Keep the pairs straight. Mixing up tokens or Object IDs between app copies sends users to the wrong portal. Name each app copy after its portal and record which Object ID belongs to which portal.
If the same people need access to more than one portal, we recommend that each portal uses Genea User Groups to assign access. Ask Genea to confirm this is turned on before you start.
Model 3: Several Entra tenants, one Genea portal
Use this when users from more than one Entra tenant, for example after a merger or acquisition, need access to the same Genea portal. Provisioning works from every tenant. Single sign-on can be connected to one tenant only.
How it works:
A Genea portal has one Microsoft Entra ID provisioning token. Each tenant adds the Genea app and uses that same provisioning URL and token.
Users from every tenant are created, updated and removed in the portal as they change in their own tenant.
Single sign-on is connected to the primary tenant. Its users sign in with their Microsoft account.
Users from other tenants sign in with Genea's standard login instead of Microsoft sign-in.
Setup:
Choose which tenant will be the primary tenant for single sign-on.
In the Genea portal, install the Entra integration and copy the provisioning token.
In every tenant, add the Genea app and turn on provisioning with that token.
Set up single sign-on in the primary tenant only.
Assign users or groups to the Genea app in each tenant.
Plan for these:
This model requires your Genea portal to use Genea User Groups, with groups sent from Entra to Genea. Ask Genea to confirm this is turned on before you connect the additional tenants.
Use distinct group names across tenants. Genea matches groups by name within a portal, so a group named "Staff" in both tenants cannot be created twice.
Make sure no person is assigned in more than one tenant. If the same email address is provisioned from two tenants, each tenant's changes overwrite the other's.
If you regenerate the provisioning token in Genea, update it in every tenant.
If you have any questions or need help with your setup, reach out to Genea Support at acsupport@getgenea.com.