Single sign-on user list preconfiguration

Part of the onboarding process for Bluebeam single sign-on (SSO) involves using email domains managed by your identity provider to identify users who already have accounts in Bluebeam Studio.

After you configured the SSO application in Microsoft Entra ID (Formerly Azure Active Directory) or in Okta, you logged into accounts.bluebeam.com and submitted information to Bluebeam.

After we receive your information, we’ll send you a Studio User Activity Report, which is a CSV formatted file that lists all users under your managed domain who currently have Bluebeam IDs (BBIDs). Use the activity report to ensure your users’ BBIDs match their entries in Microsoft Entra ID or their usernames in Okta (depending on which identity provider your organization uses) to ensure your users retain access to all the Sessions, Projects, and other Studio work they spent valuable time creating.

User information included in the Studio User Activity Report

The Studio User Activity Report file contains the following headings:

• User Status (PreCreated, Active, Closed, Suspended)

  “Closed” and “Suspended” are legacy statuses that are no longer used. You can ignore these statuses if they appear for any users in the User Activity Report. The user status is reset when those users sign in through your identity provider.

• Email Address

• Sessions Owned

• Projects Owned

• Sessions Attended/Invited

• Project Memberships/Invites

• Last Studio Access

  You should format this column to “Time” to display human readable time.

Reconcile the user report with your users’ BBIDs

Bluebeam matches your existing users’ BBIDs to a value that must be in email address format.

• Microsoft Entra ID: Use the Email property specified for each user.

• Okta: Use the Okta Username attribute (which should be in email address format).

To ensure this match, use the Studio User Activity Report to compare the BBID values in the Email Address column to users’ Microsoft Entra ID entries or Okta usernames to ensure the values match.

If you find discrepancies between the BBIDs listed in the Studio User Activity Report and those users’ Entra ID or Okta username values, we recommend that you have those users make changes at accounts.bluebeam.com.

Potential discrepancies between the BBID list we provide and your identity provider:

• The BBID (email) doesn’t exist with the identity provider

• Terminated employees, aliases, or nickname emails used as an alternative to the identity provider email property

• The email changed with the identity provider and is no longer the same as the BBID

• Typos with the BBID that differ from what’s registered with the identity provider

• Other unexpected authentication problems that may prevent a successful implementation

When you configure the SSO application in Entra ID, you will grant specific API Permissions and Optional Claims to the Bluebeam SSO application. The following images show the minimum requirements for Entra ID. Bluebeam requires you to provide values for all fields.

• API Permissions
  

• Optional Claims
  

Bluebeam matches Entra ID users to existing Bluebeam users only by the Entra ID Email property. To successfully link user accounts in Entra ID to user accounts in Bluebeam, the value for the users’ Entra ID Email property must match their email address values in Bluebeam Studio.

When a user logs in to Studio for the first time after SSO is active, Bluebeam will attempt to sync the user signing in with an existing user in the Bluebeam databases. If no user account already exists, a new user will be created in Bluebeam Studio.