Integrating LanSchool Air with Microsoft Entra ID

Integrating LanSchool Air with Microsoft Entra ID

Overview

Integrate LanSchool Air with Microsoft Entra ID (formerly Azure Active Directory) to enable Single Sign-On (SSO) and automatic user account provisioning for instructors.

This integration allows your organization to manage instructor accounts through Microsoft Entra ID instead of manually inviting instructors to LanSchool Air.

With this integration, you can:

  • Enable Single Sign-On (SSO): Instructors sign in to LanSchool Air using their Microsoft Entra ID credentials.
  • Automatically create instructor accounts: Users assigned to the LanSchool Air enterprise application in Entra ID are provisioned to LanSchool Air.
  • Automatically manage account access: Changes to user assignments or account status in Entra ID are reflected in LanSchool Air through provisioning.
  • Simplify account activation: Instructors provisioned through Entra ID do not need a separate LanSchool Air invitation or account activation process.

Prerequisites

Before configuring the integration, ensure you have:

  1. A LanSchool Air Site Admin account.
  2. Administrative access to Microsoft Entra ID to create and configure an enterprise application.
  3. One LanSchool Air organization for the Entra ID domain being integrated.

AlertImportant organization limitation: LanSchool Air currently supports integrating one LanSchool Air organization per Entra ID domain. If your organization has multiple LanSchool Air organizations, only one can be connected to that Entra ID domain.


Create and Configure the Enterprise Application in Microsoft Entra ID

Generate a secret token in LanSchool Air

  1. Sign in to LanSchool Air as a Site Admin.
  2. Open the menu in the upper-left corner and select LanSchool Air Settings.



  3. Select SSO Configuration.



  4. Select Generate New to create a secret token.

  5. Copy the secret token. You will need it to configure provisioning in Microsoft Entra ID.

Create the LanSchool Air Enterprise Application

  1. Open the Microsoft Entra admin center.
  2. Select Entra ID.
  3. Select Enterprise applications.



  4. Select New application.



  5. Search for LanSchool Air in the application gallery.
  6. Select LanSchool Air, rename the application if needed, then select Create.

Configure User Provisioning

  1. In the LanSchool Air enterprise application, select Provisioning.



  2. Select New configuration, if prompted.
  3. Enter the Tenant URL that matches your LanSchool Air region.

    LanSchool Air Region
    Tenant URL
    America
    EMEA
    		https://api-lsa-emea.lenovosoftware.com/0/lsa/common/scim
    APAC

  4. Paste the secret token generated in LanSchool Air into the Secret Token field.
  5. Select Test Connection.
  6. If the connection test succeeds, select Save.


Keep this configuration page available while you complete the remaining setup.


Configure SAML Single Sign-On

SAML authentication allows instructors to sign in to LanSchool Air using their Microsoft Entra ID credentials.

  1. In the LanSchool Air enterprise application in Entra ID, select Single sign-on.



  2. Select SAML.
  3. If your LanSchool Air organization is in the Americas, the default gallery application URLs should already match your region. Continue to the metadata configuration step.



  4. If your organization is in EMEA or APAC, select the option to configure the settings later, then edit the Basic SAML Configuration.

To identify your region, check your LanSchool Air sign-in URL. URLs containing lanschoolair-emea indicate EMEA, and URLs containing lanschoolair-apac indicate APAC.

Configure the Identifier and Reply URL

For EMEA or APAC organizations:

  1. Under Basic SAML Configuration, select Edit.



  2. Replace the existing Identifier (Entity ID) with the appropriate regional URL.
  3. Mark the Identifier as the default.
  4. Replace the existing Reply URL (Assertion Consumer Service URL) with the appropriate regional URL.
  5. Select Save, then close the configuration panel. If prompted to test the configuration, select No, I'll test later.

Use the URLs that match your LanSchool Air region:


Region
Reply URL (Assertion Consumer Service URL)
Americas
EMEA
APAC

Connect the SAML metadata to LanSchool Air

  1. On the Entra ID Set Up Single Sign-On with SAML page, locate SAML Signing Certificate.
  2. Copy the URL from the App Federation Metadata URL field.



  3. Return to LanSchool Air and open LanSchool Air Settings > SSO Configuration.
  4. Paste the URL into the App Federation Metadata URL field.


  5. Select Update.

The SAML configuration is now connected to LanSchool Air. Complete the user provisioning steps below to automatically create and manage instructor accounts.

Enable User Account Provisioning

Only users assigned to the LanSchool Air enterprise application in Microsoft Entra ID will be provisioned.

  1. Return to the LanSchool Air enterprise application in Entra ID.
  2. Select Users and groups.



  3. Select Add user/group.
  4. Select None Selected under Users and groups.
  5. Search for the users you want to provision and select them.
  6. Select Assign.
  7. Select Provisioning in the left navigation menu.
  8. Select Start provisioning.

Microsoft Entra ID will begin synchronizing assigned users with LanSchool Air.

InfoNote: Provisioning normally runs approximately every 40 minutes after the initial synchronization. The initial synchronization may take longer depending on the number of users and configuration. To trigger a new provisioning cycle using the procedure supported by this integration, select Stop Provisioning, then select Start Provisioning.

Disable Instructor Confirmation Emails (Optional)

By default, newly provisioned instructors may receive a confirmation email containing a link to the LanSchool Air sign-in page.

If your organization wants instructors to sign in through a Microsoft Entra ID portal instead, you can disable confirmation emails in the LanSchool Air SSO Configuration settings.

Disabling confirmation emails does not disable SSO or user provisioning.



Update an Expired SAML Certificate

If the SAML signing certificate expires, instructors may be unable to sign in through Microsoft Entra ID.

To replace the certificate:

  1. Sign in to the Microsoft Entra admin center.
  2. Select Entra ID > Enterprise applications.



  3. Open the LanSchool Air enterprise application.
  4. Select Single sign-on.



  5. Locate SAML Certificates and select Edit.
  6. Select New Certificate.



  7. Select Save.
  8. Open the three-dot menu beside the new certificate and select Make certificate active.



  9. Open the three-dot menu beside the old certificate and select Delete Certificate, if appropriate.



  10. Sign in to LanSchool Air as a Site Admin.
  11. Navigate to LanSchool Air Settings > SSO Configuration.
  12. Select Update beside the App Federation Metadata URL field to refresh the metadata.

Test SSO after updating the certificate to confirm that instructors can sign in successfully.

Remove the Microsoft Entra ID Integration

WarningWarning: Removing the Entra ID integration deletes user accounts that were provisioned from Entra ID. Existing manually created classes and device carts associated with deleted local accounts may also be affected.

Before removing the connection, review the impact on instructors and their classroom resources.

To remove the integration:

  1. Sign in to LanSchool Air as a Site Admin.
  2. Open the upper-left menu and select LanSchool Air Settings.



  3. Select SSO Configuration.



  4. Select Remove Connection at the bottom of the page.



  5. Enter Confirm when prompted.



  6. Select Remove Connection again to complete the removal.

Frequently Asked Questions

How do instructors sign in to LanSchool Air using Microsoft Entra ID?

Instructors provisioned through Entra ID sign in using their Microsoft credentials. On the LanSchool Air sign-in page, they enter their email address and are redirected to Microsoft for authentication.

Why can't an instructor sign in using Microsoft Entra ID?

Check whether the instructor is assigned to the LanSchool Air enterprise application and has been provisioned successfully.

In LanSchool Air, navigate to Settings > People and check the user's Source:

  • Entra ID: The account is managed through Entra ID and should use Microsoft SSO.
  • LanSchool Air: The account is a locally managed account and continues to use its LanSchool Air password.

Also verify that the SAML configuration, regional URLs, and App Federation Metadata URL are correct.

Why is an instructor missing from LanSchool Air after being assigned in Entra ID?

Only users assigned to the LanSchool Air enterprise application are provisioned. Verify that the user is assigned, provisioning is running, and the provisioning configuration is valid.

Allow time for synchronization. Provisioning normally runs approximately every 40 minutes after the initial cycle. Check the provisioning logs in Entra ID for errors.

How often does Microsoft Entra ID synchronize users with LanSchool Air?

Provisioning normally runs approximately every 40 minutes. The initial synchronization may take longer.

To initiate a new provisioning cycle, use the Stop Provisioning and Start Provisioning controls in the enterprise application's Provisioning settings.

What happens when a user is deleted in Microsoft Entra ID?

According to the current LanSchool Air integration behavior, a user deleted in Entra ID appears as disabled in LanSchool Air for 30 days before being deleted.

What happens when a user is unassigned from the LanSchool Air enterprise application?

The user is disabled in LanSchool Air. Review the user's assignment and provisioning status in Entra ID if the user should retain access.

Can I connect multiple LanSchool Air organizations to the same Microsoft Entra ID domain?

No. LanSchool Air currently supports one integrated LanSchool Air organization per Entra ID domain.

What happens to existing locally managed instructor accounts when I enable Entra ID provisioning?

Existing local accounts have LanSchool Air listed as their source under Settings > People.

The current integration instructions require local accounts to be deleted before the corresponding users are assigned through Entra ID. Deleting a local account removes manually created classes and device carts associated with that account. The instructor may need to recreate those resources after signing in through Entra ID.

AlertImportant: Plan account migration carefully before deleting local accounts. Consider retaining one or two locally managed Site Admin accounts to reduce the risk of losing administrative access if Entra ID becomes unavailable.

Why did an instructor stop being able to sign in after a certificate change?

Verify that the new SAML certificate is active in Entra ID and that the App Federation Metadata URL has been updated in LanSchool Air. Confirm that the correct regional Identifier and Reply URL are configured, then test SSO again.

Can I keep a local Site Admin account if Entra ID is unavailable?

Yes. It is recommended to retain one or two locally managed Site Admin accounts as a fallback in case Microsoft Entra ID is unavailable or the SSO integration fails.

Where can I get help with Microsoft Entra ID integration?

If the integration fails after you verify the regional URLs, secret token, SAML metadata, user assignments, and provisioning status, contact LanSchool Air Support. Include the error message and relevant provisioning or sign-in details, but never include your secret token or other credentials.

I received a SAML error when trying to log in. What should I do?

If you received a SAML error when trying to log into LanSchool Air please contact LanSchool Air Support with the ErrorID.