Need help with sso integration.

pavan Punna
Tera Contributor

4 hours ago

Hi Community,
 
We are testing the Microsoft Entra SSO integration with SAM Pro for Lucid (All Products).
 
The integration is technically working:
 
- Entra App-P_LucidChart_User group: approximately 1,700 users
- ServiceNow Lucid SSO subscriptions: approximately 1,700
- SAM Licenses Required: approximately 1,700
- Lucid portal actual licensed users: approximately 1,250
 
The issue is that the Entra group contains stale or access-only users who no longer consume paid Lucid licenses. Since ServiceNow correctly imports the Entra group, Licenses Required is higher than the actual Lucid portal count.
 
As Lucid does not have an out-of-box SAM direct integration, what is the recommended approach for keeping the Lucid portal licensed-user population aligned with the Entra group?
 
Is the expected design to periodically compare the Lucid licensed-user export with the Entra group and remove stale users, or is there a recommended automated provisioning/governance approach?
 
Our goal is for SAM Licenses Required to reflect the actual Lucid licensed-user population without ongoing manual corrections.
 
Thank you.
0 Helpfuls
  • 81 Views
1 REPLY 1

Maniteja_2003
Kilo Sage

an hour ago

Hi @pavan Punna,

 

I hope this answer helps you.

 

If the Microsoft Entra ID group contains stale users or users who have access to Lucid but do not consume paid licenses, there are two possible approaches to manage this in ServiceNow SAM Pro.

 

1. Clean up stale users and configure reclamation rules

 

Initially, it is recommended to clean up stale users from the Entra ID group. Once the group membership is updated, you can configure reclamation rules for Lucid in ServiceNow. Based on the configured criteria, eligible subscription records will be marked as stale, and reclamation candidates will be generated. This helps identify subscriptions that can be reclaimed.

 

2. Exclude users who do not consume paid licenses

 

If certain users require access to Lucid but do not consume paid licenses, you can exclude them from license consumption calculations using Subscription User Exclusion Rules. When reconciliation runs, the excluded users will not be considered in the license consumption calculation. However, this approach requires manually maintaining the exclusion rules for the relevant users.

 

Steps to create a Subscription User Exclusion Rule:

  1. Navigate to the User Subscription Category and open the SSO Integration List.

  2. Open the relevant Integration Profile.

  3. Under the available tabs, click More and select Subscription User Exclusion Rules.

  4. Click New, enter the user's principal name (UPN), and save the record.

  5. Repeat these steps for all users who should be excluded from license consumption.

  6. Run the Microsoft Entra ID - Download User directory job.

  7. Run reconciliation for the relevant publisher and verify that the excluded users are no longer considered in the license consumption calculation.

 

I would recommend exploring the possibility of implementing an automated provisioning or governance process to keep Microsoft Entra ID group membership aligned with actual paid license assignments in Lucid. This would help minimize manual maintenance and ensure that license consumption data in ServiceNow remains accurate.


Thanks,
Maniteja.

0 Helpfuls