Table of Contents

Microsoft Entra SSO

Microsoft Entra SSO signs you into your Diggle account. SCIM manages workspace membership and roles. Signing in and granting workspace access are separate operations.

Before you start

Ask your workspace administrator to confirm that Microsoft sign-in is available and that you have access to the intended Diggle workspace. Use the Microsoft identity assigned by your organization. Your organization may require MFA or administrator approval.

Sign in for the first time

  1. Open Diggle and choose Microsoft sign-in, or Microsoft signup if you are creating a new account.
  2. Choose the intended Microsoft account and complete Microsoft authentication, including MFA when required.
  3. Complete any profile details and accept Diggle’s terms when prompted.
  4. Check that the correct workspace and role are available. Complete a pending invitation separately if one is shown.

Which account flow applies?

Account

Expected first sign-in

New account created with Microsoft SSO

Complete the supported signup and terms steps. You do not need to create a Diggle password or separately verify your email merely because you signed up with Microsoft.

New account provisioned through Microsoft Entra SCIM

Use the same Microsoft identity that was provisioned. When Diggle can validate its SCIM activation binding to that tenant and Microsoft user, the account is activated through SSO without an additional Diggle password or email-code step. Accept terms on first use if they have not already been accepted.

Existing Diggle account being linked to Microsoft

The protected account-linking flow may require proof of ownership of the existing Diggle account. A matching email address alone is not sufficient. Use the supported method offered; your Microsoft password is not a Diggle password.

SCIM provisioning alone does not mean the user has accepted Diggle’s terms. The user completes that step when first using the account. The Data Processing Agreement is available separately.

SCIM activation and credential changes

First-time SCIM activation depends on a valid provisioning source and activation binding. An expired activation, changed identity mapping, or revoked or rotated provisioning credential can prevent a not-yet-activated account from using that shortcut. Contact your workspace administrator and Diggle to check or reissue activation through the supported process. Creating another token alone is not a guarantee that an existing pending activation becomes valid.

This differs from an account with an already-established Microsoft sign-in identity: rotating or revoking a SCIM token does not delete that permanent identity.

Later sign-ins and profile changes

Use the same Microsoft identity for later sign-ins. After legitimate linking, that identity identifies the same global Diggle account even if the provider’s email or display name changes. Provider profile changes do not automatically rewrite all global Diggle account details.

Access is evaluated separately

Successful SSO does not restore a SCIM-deactivated membership, clear an explicit local Diggle block, recreate private project access, or restore a cancelled personal paid plan. Resolve workspace access with the workspace administrator and provisioning source.

Troubleshooting

Problem

What to do

Microsoft sign-in is unavailable or requests administrator approval

Ask your Entra administrator and Diggle to confirm the intended tenant and consent configuration.

A new SSO or SCIM account is unexpectedly asked for a Diggle password or email code

Confirm that you used the intended Microsoft identity and whether Diggle is linking an existing account or activating a new one. For SCIM, ask the administrator to check the tenant, externalId mapping and activation validity. Do not create a duplicate account to bypass the problem.

The account has no Diggle password

Do not enter your Microsoft password as a Diggle password. Use Microsoft sign-in or the supported account recovery/linking method. Contact Diggle if the flow offers no applicable method.

Sign-in succeeds but the workspace is missing

Check workspace membership, pending invitations, SCIM source activity and any local block with the workspace administrator.

An activation or linking attempt fails repeatedly

Contact Diggle with the time and visible error. Never include passwords, tokens, cookies or login codes.

Related articles