SSO issue with UPN / email
Our Entra SCIM provisioning sends:
UserName = jdo@company.eu
Emails[type eq "work"].value = john.doe@company.eu
It happens a lot that user are signed into o365 sessions / cookies with their full email.
When they try to use devolutions cloud at that point, it says they do not have an account.
Even though devolutions has both the mail and UPN.
Can Devolutions Cloud/Hub accept email as an alias for the same SCIM user, or match by Entra oid/SCIM userName instead?
Or any other possible way to fix this?
All Comments (1)
Hello,
Thanks for reaching out and for the detailed technical breakdown — it helped us dig into this quickly.
I checked with our development team, and here's what I can confirm: Devolutions Cloud/Hub's SSO login is built to match directly against the UPN synced via SCIM (userName) as the sole identifier — it doesn't currently check a secondary email attribute or Entra's oid as a fallback.
This is a structural part of how user matching works today, not a configuration toggle, which is why it affects any account where the identity presented at login (full email) differs from the UPN stored on our side.
Best regards,
Tommy Sanders