We're working with a client who is setting up SAML with SCIM using Microsoft Entra as the identity provider. They also want to use the Microsoft Entra Application Proxy to securely publish Laserfiche applications (Web Client and Forms) for remote access.

The challenge we're facing is around the RelayState configuration in the Entra Enterprise Application. As you know, RelayState must point to a single URL—either Web Client or Forms—but not both.

We attempted to use a custom landing page that provides links to both Web Client and Forms. However, this approach isn’t viable—after SAML authentication, users are redirected to the landing page, but clicking on either link causes an authentication loop.

We also considered creating two separate SAML applications, one for Forms and one for Web Client. The problem here is that this would result in two distinct user identities in Laserfiche, requiring a separate set of licenses and permission management.

Has anyone successfully implemented a similar setup using Microsoft Entra with SAML, SCIM, and Application Proxy? We're looking for any recommended approaches or workarounds to support both Forms and Web Client access via SSO while maintaining a unified user identity and permissions structure.

Appreciate any insights or suggestions!