Deploying Locke with Microsoft Entra ID

1. Go to Microsoft Entra Admin Center → Enterprise Applications → New Application
2. Click Create your own application
3. Name it "Locke ID" (or "Locke - {Client Name}")
4. Select "Integrate any other application you don't find in the gallery (Non-gallery)"
5. Click Create

1. In the Enterprise App, go to Single sign-on → SAML
2. Configure Basic SAML Configuration:

Replace {org-id} with the client's Locke org ID (e.g., arndt-heating-cooling).

Use Entra's default claims. No changes needed in Entra. The default claims are:

1. In the SAML Signing Certificate section, download Certificate (Base64)
2. Open the downloaded file — you will need the full PEM content including -----BEGIN CERTIFICATE----- and -----END CERTIFICATE----- headers

From the Set up Locke ID section, copy:

1. In Armory, navigate to the client org → Settings → SAML SSO
2. Enable SAML SSO
3. Fill in the following fields:

4. Click Save
5. Click Test to verify configuration

1. In the Enterprise App, go to Users and groups → Add user/group
2. Assign the users or group that should have access to Locke
3. Only assigned users will be able to SSO into Locke

1. In Armory, navigate to client org → Settings → SCIM
2. Click Generate Token
3. Copy the token immediately (it will not be shown again)

1. In the Enterprise App, go to Provisioning → Get Started
2. Set Provisioning Mode to Automatic
3. Under Admin Credentials:

4. Click Test Connection — should show success
5. Click Save

Under Provisioning → Mappings → Provision Azure Active Directory Users:

Ensure these mappings exist (most are default):

1. Set Provisioning Status to On
2. Click Save
3. Initial sync runs within 40 minutes
4. For immediate provisioning, use Provision on demand for specific users

After provisioning runs:

• check Users appear in the client org's member list in Armory
• check Users are in pending_first_login state until they complete SSO + passkey setup
• check Removing/disabling a user in Entra automatically removes them from Locke (and billing)

1. Go to Microsoft Intune Admin Center → Devices → Configuration profiles
2. Click Create profile
3. Platform: Windows 10 and later
4. Profile type: Settings catalog
5. Name: "Locke Browser Extension - Chrome"
6. Add setting: search "Google Chrome > Extensions"
7. Select "Configure the list of force-installed apps and extensions"
8. Add the extension string:

9. Assign to the same user group that has Locke access in Entra

1. Create another profile (or add to the same one)
2. Add setting: search "Microsoft Edge > Extensions"
3. Select "Control which extensions are installed silently"
4. Add the extension string:

5. Assign to the same user group

• check Extension installs silently on next Intune sync (up to 8 hours, or trigger manual sync)
• check Users see the Locke icon in their browser toolbar
• check Extension activates after first SSO login

Share the Login Link

Send users this link to get started:

Or configure the Sign-on URL in the Entra Enterprise App so Locke appears as a tile in the user's My Apps portal.

First Login Experience

Returning User Experience