Error in user YAML: (<unknown>): mapping values are not allowed in this context at line 22 column 209
---
conversation_id: 07a6ae94-07dd-435e-b963-8e908678cc0d
answered_by: team
date: 2026-08-25 19:28:28
exchanges: 1
dropped_sample_prompts: 0
foundry_feedback: none
user_comments: []
# ---- review fields: edit these ----
review_status: pushed
reviewer: jon-olson-tylertech
suggested_to:
review_round: 1
routing_verdict: correct
reassign_to:
answer_verdict: good
diagnosis: search-empty
fix_target: knowledge-file
kb_action: add
kb_files: Knowledge-TylerIdentity/FAQ-Identity.md
action_status: applied
notes: Classified by Claude from the Proposed fix (no exchange-level correction). Client-side Entra ID app-registration steps added to FAQ-Identity.md; registered in _START_HERE.md. | verified live in Foundry: check_foundry_drift.py reports all 5 collections and the team router byte-matching main (2026-09-02)
delegated_to: Tyler Identity Assistant
orchestration: router/Simple
---
| Sub-agent(s) invoked | Tyler Identity Assistant |
| Tools used across the run | searchTenantKnowledge |
| Orchestration | router / Simple |
Source: run spans in /api/team-logs. Team transcripts carry no per-exchange tool detail, so the above is for the whole conversation, not one exchange.
Tools called: not recorded for team conversations — see Delegation above
Q:
How do i federate with Entra?
A:
I'll search for information on federating with Entra (Azure AD) in the Identity knowledge base.Based on the documentation, here's how to federate with Entra (formerly Azure AD):
## Overview
Entra ID is one of the most common customer Identity Providers federated with the Identity Gateway for **Identity Workforce** (back-office/employee applications). The Gateway supports both **OIDC and SAML 2.0** protocols for federation.
## Two Setup Paths
### 1. **Self-Service in Admin Center** (Preferred)
Most federations can be configured directly by customer administrators through Admin Center. The customer IT administrator:
- Accesses their organization's Admin Center
- Configures the Entra ID connection with OIDC or SAML metadata
- Provides required claims/attributes (Email, Username, First name, Last name)
### 2. **Request Tyler Identity Team Assistance**
If federation cannot be set up through Admin Center, file a **Federate Identity Provider** ticket:
**Ticket:** [Request #4128 - Federate Identity Provider](https://help.center.tylertech.com/servicedesk/customer/portal/3168/group/3329/create/4128)
**Required Information:**
- **Explanation** of what prevented using Admin Center
- **CRM Customer Identifier**
- For OIDC federation:
- Client ID on the provider
- Scopes
- Issuer endpoint
- Authorization endpoint
- Token endpoint
- JWKS endpoint
- Userinfo endpoint
- **Test user account** for validation
- **Configuration settings must be sent securely via Kiteworks** — never in the ticket itself
- The Identity team will contact you separately for the client secret and test user password
## Requirements for Customer's Entra ID
The customer's Entra ID must:
- Be externally accessible from the public internet
- Support OIDC or SAML2 protocols
- Be highly redundant and scalable
- Provide required claims: Email, Username, First name, Last name
## Troubleshooting
If you encounter "IdP not configured for organization":
- Verify IdP configuration exists in Admin Center
- Check IdP metadata URL is accessible
- Confirm organization is enabled for **Workforce Direct**
For SAML/OIDC protocol errors:
- Verify metadata in Admin Center matches current Entra configuration
- Check required claims are configured
- Validate IdP certificate is current
---
**Related Documentation:**
- [Identity Workforce Overview](https://docs.tylerdev.io/identity)
- [Docusaurus-Identity.md](/api/tenant-knowledge-base/collections/TCP-KB-Identity/files/0c056ff0-f664-4262-839a-c70ffa59df85/download) - See "Customer IdP Requirements" and "Identity Workforce FAQ" sections
- [Conf-OneTylerTickets.md](/api/tenant-knowledge-base/collections/TCP-KB-Identity/files/7b04b9f4-e219-44a2-bf3b-88043c445c50/download) - Ticket #4128 detailsReview — verdict: · should have said:
What should change so this answer is right next time? For an instructions or routing fix, say exactly what to add or reword.
Should incorporate more guidance on Entra setup. From Tyler's support docs: https://tylernow.atlassian.net/wiki/spaces/KA/pages/950796345/Federating+using+Entra+ID+through+Admin+Center
Federation (client side)
Log in to your organization’s Entra ID Portal https://entra.microsoft.com
From the left-side navigation pane, expand Identity>Applications and select App registration
From the App Registrations section, click the + New registration button at the top of the page.
In the Register an application screen, make the following changes:
Name: TylerIdentityWorkforceIntegration
Supported Account Type: select accounts in this organizational directory only
Redirect URL (Select a platform) drop-down box: select Web
Redirect URL textbox:
https://tyler-<customeridentifier>.okta.com/oauth2/v1/authorize/callback
From the Overview page, copy the Application (client) ID, Directory (tenant) ID
Select Certificates & secrets from the Manage section of the navigation bar
Ensure the Client Secrets tab is select and click the + New client secret button
In the Add a client secret pop-up window, enter the following:
Description: TylerIdentityWorkforceIntegration
Expires: 730 days (24 months). Note: While Tyler recommends setting the expiration period as long as possible to reduce the need to reconfigure your federation in TID-W when the secret expires, Always consult your own internal security posture for the best recommendation
Click the Add button when finished
Ensure you are returned to the Certificates and Secrets section with the Client secrets tab selected, find the secret Value and click Copy
This client information will be used to configure the Tyler Identity side of the federation configuration in Admin Center.