Hi ALl, apologise for this possible simple query but im new to n8n and came across it while trying to resolve other issues and hoping that this is my answer. Basically ive setup Entra for my company and we have plenty of apps that aren’t capable of using SSO and/or provisioning so my question is can I use n8n to establish this function (sso anyway) via n8n workflows ? i just wanted to know before I upgrade the licence i have.
thanks in advance
Mark
What is the error message (if any)?
Please share your workflow
(Select the nodes on your canvas and use the keyboard shortcuts CMD+C/CTRL+C and CMD+V/CTRL+V to copy and paste the workflow.)
@Mark_Flanagan short answer, no for the SSO part. n8n isnt an identity provider, so it cant make apps that dont support SSO suddenly federate logins, thats an IdP job (entra already is one) or an identity-aware proxy sat in front of the app, not something workflows can bolt on. n8ns own SSO (saml/oidc, business and enterprise) only goes the other way, it lets your users sign INTO n8n via entra, it doesnt hand SSO out to other apps, so id hold off upgrading the licence for that because it wont get you there. where n8n does genuinely help is provisioning, the Microsoft Entra ID node can create/update/disable users and manage group membership, so for any app that exposes a user-management api you can automate provisioning/deprovisioning even without SCIM. is it really the SSO login piece youre after, or the user lifecycle/provisioning side? theyre completely different paths.
Thanks for the quick reply and to be fair I assumed (wrongly) that SSO was more of an option in n8n over provisioning however i would definitely prefer provisioning over SSO so am i correct in reading what you said that this is more of an option ?
@Mark_Flanagan yeah youve got it, provisioning is the realistic path and the better fit for what you described. good news on the licence too, you dont need to upgrade for it, the Microsoft Entra ID node and the HTTP Request node are core builtin nodes so they work on self-hosted community as-is, the paid tiers are for things like SSO and rbac, not for building provisioning workflows. the shape is, trigger on the lifecycle event (new starter, leaver, role change), use the Entra ID node for the entra-side user and group bits, then an HTTP Request node per downstream app hitting its own user-management api to create or disable the account. the one catch is an app has to expose a user api for this to work, if it has none theres nothing to automate against, so the win really depends on each app having one. whats the rough set of apps youre trying to cover?
@Mark_Flanagan both work, just at different depths. slack you drive through its api with the http request node, though creating or disabling actual accounts is the SCIM api (business+ and up), while the built-in slack node handles channel membership and user groups on top of that. plausible has an invite endpoint (PUT /api/v1/sites/guests, editor or viewer per site, needs an enterprise plan and an api key from them) but no remove-user one yet, so adds automate cleanly and offboarding stays manual for now.