ACE's identity was spread across four systems that didn't talk to each other — an on-prem Active Directory server, Microsoft 365, NetSuite, and Shopify Plus. Four separate logins, no single sign-on story.
Constraints
Twenty-five employees total, only three of whom needed a new single sign-on path. That ruled out SCIM-based automated user provisioning and the heavier identity-broker platforms — manual account linking for three people is simpler than standing up and maintaining a sync pipeline. And Shopify Plus and Microsoft 365 both accept only SAML (the older enterprise single sign-on standard) for workforce federation, not the newer OIDC, which constrained the architecture from the start.
Architecture
Entra ID is the identity provider; Cloudflare Access is the single broker in front of everything else.
Groundwork
Early work got Entra ID functioning as the identity provider for an internal app running on Azure, with the full login/logout/redirect flow verified end to end. One platform gotcha surfaced there: Azure's managed-identity stack silently reserves environment variables under its own platform prefix, and a custom OIDC config using that prefix caused an opaque login redirect loop with no useful error — fixed by renaming to a project-specific prefix.
An option ruled out
NetSuite supports OIDC as an identity provider, so it was worth checking whether it could broker through Cloudflare Access into Shopify and Microsoft 365. The protocol check closed it: both require SAML for workforce federation, and Entra can't broker an external OIDC provider on NetSuite's behalf. The investigation stopped there.
What converged
One cloud directory — Entra ID — became the source of truth for identity, synced from the aging on-prem server, which keeps only its non-identity duties (DNS, DHCP, file shares). Cloudflare Access — already deployed via existing tunnels — is the sole broker in front of it, translating Entra's identity into SAML for Shopify Plus and Microsoft 365, and separately exposing an MCP Server Portal for agent access. That single decision eliminated two other workstreams outright: no separate Entra-as-IdP path was needed for NetSuite, and no SCIM pipeline was needed at all, since three manual account links is simpler than any automation I could build for it.
Apple Business Manager federates against the same Entra tenant. AI agent access to internal systems goes through an MCP Server Portal behind the same Cloudflare Access policies that govern human sign-in — the identity and access model extended to non-human identities, with no separate, looser path for agents. And there's a documented break-glass path: a scoped Cloudflare API token with OAuth-reset permission, held outside the SSO flow, in case SAML ever locks out the system that's supposed to restore access.
Outcome
Apple Business Manager federation and the internal app's Entra authentication are live in production, alongside the MCP Server Portal, which already gates AI agent access through Cloudflare Access independently of human sign-on. SAML federation for human sign-on to Microsoft 365 and Shopify Plus is the next phase, pending validation of the remaining protocol assumptions.