Duplicate users
Two directories to provision.
Microsoft campuses — sign in with Entra ID
Azure AD Integration connects ScholarERP to Microsoft Entra ID so staff (and optionally students) authenticate with existing school Microsoft accounts and group mappings.
Entra ID
SSO
Group→role
mapping
Directory
aligned offboarding
The problem
Why Microsoft-heavy schools hate duplicate directories
IT already manages Entra ID; a parallel ERP password directory doubles offboarding risk.
Slow exits
Microsoft disabled, ERP still open.
Group drift
ERP roles ignore M365 groups.
Helpdesk load
Password resets everywhere.
Capabilities
What this module actually does
Operational depth your team will use every cycle — not a shallow feature list.
Entra ID SSO
OIDC/SAML patterns per deployment.
Group mapping
Security groups → ScholarERP roles.
JIT users
Provision on first login when allowed.
Campus tenants
Support multi-tenant trusts carefully.
Conditional access
Respect org CA policies at IdP.
Sync cues
Align staff email with Staff Management.
Audit SSO
Success/failure events.
Break-glass
Local admin fallback.
Operating loop
How it works end to end
A clear path your staff and parents can follow without training manuals.
-
01
Register
App registration in Entra ID.
-
02
Map
Groups to roles.
-
03
Pilot
IT + one department.
-
04
Enforce
Staff SSO campus-wide.
Who uses it
Role-aware access for every stakeholder
The right people see the right slice of the pipeline.
IT Admin
Owns Entra app & maps.
Teacher
Uses school Microsoft account.
Security
Applies CA at IdP.
Auditor
Checks SSO audits.
Connected stack
Works with the modules you already need
Each module is an edge in the campus operating graph — not a silo.
Outcomes
What changes after go-live
Measurable ops wins institutions report once this module runs inside ScholarERP.
Aligned
with Microsoft identity
Faster
staff access
Cleaner
offboarding
“Entra SSO let us retire a whole class of ERP password tickets.”
FAQ
Questions teams ask before buying
Straight answers for setup, integrations, and day-two operations.
Azure AD or Entra ID?
Same Microsoft identity platform — we use current Entra ID naming with Azure AD still widely searched.
Can we run Google SSO and Azure together?
Yes — different populations or campuses can use different IdPs.
Does this sync Teams automatically?
SSO covers login. Teams/Meet provisioning is a separate collaboration connector where enabled.
What about students on Microsoft 365 Education?
Student SSO can be enabled when licenses and policy allow.
Pilot Entra ID SSO for staff
Map one security group to Teacher role and test login.