TimeClock 365 supports single sign-on with Microsoft Entra ID (Azure Active Directory) via SAML 2.0, so employees can log in with their existing company credentials - no separate password to manage. Follow the steps below to connect your Active Directory to TimeClock 365.
Step 1 - Create an enterprise application in Azure AD
Sign in to the Azure Portal and open Microsoft Entra ID → Enterprise Applications. Click New Application, then Create your own application, and name it "TimeClock 365".
Step 2 - Configure single sign-on
Open the new application, go to Single sign-on, and select SAML as the method. Azure will ask for the Identifier (Entity ID) and Reply URL - copy both of these from your TimeClock 365 admin panel under Settings → Integrations → Single Sign-On.
Step 3 - Map user attributes
In the Attributes & Claims section, confirm that the email address is sent as the Name ID (this is how TimeClock 365 matches Azure AD users to employee accounts). Add first name and last name as additional claims if you want them to sync automatically.
Step 4 - Download the certificate and metadata
In the SAML Certificates section, download the Federation Metadata XML. Upload this file (or paste the metadata URL) into TimeClock 365 under Settings → Integrations → Single Sign-On.
Step 5 - Assign users and groups
Back in the Enterprise Application, go to Users and groups and assign the Active Directory users or security groups who should have access to TimeClock 365. Only assigned users will be able to sign in via SSO.
Step 6 - Test the connection
From the Azure Enterprise Application page, click Test to verify the SAML response is accepted. Then have a test user sign in at your TimeClock 365 login page using the "Sign in with SSO" option to confirm the full flow works end to end.
Notes for on-premise Active Directory
If you run on-premise Active Directory without Azure AD, connect it through Microsoft Entra Connect to sync users to Azure AD first, then follow the same steps above. TimeClock 365 authenticates via SAML against Azure AD regardless of whether your source directory is cloud-based or on-premise.
Automatic user provisioning (SCIM)
TimeClock 365 is listed in the Microsoft Entra application gallery with official support for automatic user provisioning, so Entra ID can automatically create, update, and de-provision TimeClock 365 accounts as employees join, change roles, or leave. This is a separate, optional layer on top of SSO - SSO handles login, provisioning handles the user lifecycle.
To enable it: in the TimeClock 365 admin console go to Settings → Company Profile → General, scroll to Azure user synchronization, and copy the Microsoft Entra token. In the Entra admin center, open your TimeClock 365 enterprise application's Provisioning tab, select New configuration, and enter:
- Tenant URL:
https://live.timeclock365.com/scim - Secret Token: the Microsoft Entra token copied above
Select Test Connection to confirm Entra ID can reach TimeClock 365, then Create. From there you can assign which users or groups are in scope, review the attribute mappings (username, display name, work email, employee number, and manager are supported), and turn on Start Provisioning once you're ready to go live.
Microsoft's official tutorials cover this in full detail, including screenshots of every step: