> For the complete documentation index, see [llms.txt](https://docs.caf.io/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://docs.caf.io/caf-docs/user-guide/organizations/sso-configurations/microsoft-entra-id.md).

# Microsoft Entra ID (SAML)

Configure SSO with Microsoft Entra ID (Azure AD) using the SAML protocol.

This guide explains how to configure SSO integration between Organizations and Microsoft Entra ID (formerly Azure AD) using the `SAML` protocol. After configuring Entra ID, return to the [Organizations SSO Configuration Guide](/caf-docs/user-guide/organizations/sso-configurations.md) to complete the setup.

{% hint style="info" %}
For **OpenID Connect (`OIDC`)** with Microsoft Entra ID, follow the [Generic Provider Configuration Guide](/caf-docs/user-guide/organizations/sso-configurations/generic.md) using the **Redirect URI**, client credentials, and issuer URL from your Entra ID app registration.
{% endhint %}

{% hint style="info" %}
**Before you begin:** Open **Authentication** → **SSO** in Organizations and copy the **Entity ID** and **ACS URL** as described in [Step 2 of the SSO Configuration Guide](/caf-docs/user-guide/organizations/sso-configurations.md#step-2-enable-sso-and-configure-the-provider).
{% endhint %}

***

## Prerequisites

* Administrator access to Microsoft Entra ID
* Super Admin access to Organizations

***

## Create Application in Microsoft Entra ID

1. Access the [Azure Portal](https://portal.azure.com)
2. Navigate to **Microsoft Entra ID** → **Enterprise Applications**
3. Click **New application**

<div data-with-frame="true"><img src="https://737907756-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FI4kncOam5KtDqeGMEiQu%2Fuploads%2Fgit-blob-ceebd6caf7934936d05fc2342a3b046c25fd831e%2Fcreate-new-app-integration.jpg?alt=media" alt="Entra ID - Create App Integration"></div>

4. Click **Create your own application**
5. Enter the application name (e.g., "Certta")
6. Select **Integrate any other application you don't find in the gallery (Non-gallery)**
7. Click **Create**

<div data-with-frame="true"><img src="https://737907756-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FI4kncOam5KtDqeGMEiQu%2Fuploads%2Fgit-blob-154d71f994f0697d5afe586234ce7c5df7ff46a3%2Fcreate-application.jpg?alt=media" alt="Entra ID - Create Application"></div>

***

## Configure SAML

1. In the created application, access **Single sign-on** in the side menu
2. Select **SAML** as the authentication method

<div data-with-frame="true"><img src="https://737907756-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FI4kncOam5KtDqeGMEiQu%2Fuploads%2Fgit-blob-c659d12afda6b97cd23a0c164e17fd71e616b72f%2Fselect-saml.jpg?alt=media" alt="Entra ID - Select SAML"></div>

3. In the **Basic SAML Configuration** section, click **Edit** and configure:

<div data-with-frame="true"><img src="https://737907756-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FI4kncOam5KtDqeGMEiQu%2Fuploads%2Fgit-blob-2f13b39b523c6b889cdc4a3bfa3c6739c9ab5ac9%2Fbasic-saml-edit.jpg?alt=media" alt="Entra ID - Basic SAML Edit Configuration"></div>

| Entra ID Field                                 | Value                                             |
| ---------------------------------------------- | ------------------------------------------------- |
| **Identifier (Entity ID)**                     | Paste the **Entity ID** copied from Organizations |
| **Reply URL (Assertion Consumer Service URL)** | Paste the **ACS URL** copied from Organizations   |
| **Sign-on URL**                                | Leave blank (optional)                            |
| **Relay State**                                | Leave blank                                       |
| **Logout Url**                                 | Leave blank (optional)                            |

<div data-with-frame="true"><img src="https://737907756-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FI4kncOam5KtDqeGMEiQu%2Fuploads%2Fgit-blob-a3280ec05e547bcccfdaa75a620aa78ce260aedc%2Fbasic-saml.jpg?alt=media" alt="Entra ID - Basic SAML Configuration"></div>

4. Click **Save**

***

## Configure Attributes and Claims

In the **Attributes & Claims** section, configure the attributes that will be sent to Organizations:

1. Click **Edit**

<div data-with-frame="true"><img src="https://737907756-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FI4kncOam5KtDqeGMEiQu%2Fuploads%2Fgit-blob-842103d0421e2bf97d1286936d105dde57dbb7a5%2Fedit-attributes-and-claims.jpg?alt=media" alt="Entra ID - Edit Attributes &#x26; Clains"></div>

2. Configure the following claims:

| Claim Name                                                           | Source Attribute         |
| -------------------------------------------------------------------- | ------------------------ |
| `http://schemas.xmlsoap.org/ws/2005/05/identity/claims/emailaddress` | `user.userprincipalname` |
| `http://schemas.xmlsoap.org/ws/2005/05/identity/claims/givenname`    | `user.givenname`         |
| `http://schemas.xmlsoap.org/ws/2005/05/identity/claims/name`         | `user.userprincipalname` |
| `http://schemas.xmlsoap.org/ws/2005/05/identity/claims/surname`      | `user.surname`           |

<div data-with-frame="true"><img src="https://737907756-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FI4kncOam5KtDqeGMEiQu%2Fuploads%2Fgit-blob-4f3fd12458ddfee2bae59e62968febafda20daf9%2Fattributes-and-claims.jpg?alt=media" alt="Entra ID - Attributes &#x26; Clains"></div>

### Configure Group Claim (Optional)

If you want to use group-based assignment rules in Organizations:

1. Click **Add a group claim**
2. Select **Security groups** or **Groups assigned to the application**
3. In **Source attribute**, select **Group ID** or **Cloud-only group display names**
4. Click **Save**

<div data-with-frame="true"><img src="https://737907756-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FI4kncOam5KtDqeGMEiQu%2Fuploads%2Fgit-blob-2a5bb9e4b6d4370423206fa46b9c5851fdd97d21%2Fadd-group-claim.jpg?alt=media" alt="Entra ID - Add Group Claim"></div>

5. The claim will be: `http://schemas.microsoft.com/ws/2008/06/identity/claims/groups`

{% hint style="warning" %}
**Important:** If using Group ID, map group IDs (GUIDs) in **Group assignment rules**, not display names.
{% endhint %}

***

## Obtain Metadata URL

1. In the **SAML Certificates** section, locate **App Federation Metadata Url**
2. Copy the URL, which will have the format:

```
https://login.microsoftonline.com/{tenant-id}/federationmetadata/2007-06/federationmetadata.xml
```

<div data-with-frame="true"><img src="https://737907756-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FI4kncOam5KtDqeGMEiQu%2Fuploads%2Fgit-blob-3d684ee373939f9ccdb804d773ac38fd86ba1856%2Fmetadata-url.jpg?alt=media" alt="Entra ID - Metadata URL"></div>

***

## Assign Users and Groups

1. In the side menu, access **Users and groups**
2. Click **Add user/group**

<div data-with-frame="true"><img src="https://737907756-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FI4kncOam5KtDqeGMEiQu%2Fuploads%2Fgit-blob-bdcd62da2a7577f9994e3a887c08dbc881ecb0b2%2Fuser-and-groups.jpg?alt=media" alt="Entra ID - Users and Groups"></div>

3. Click to add users
4. Select the users or groups that will have access to Organizations via SSO
5. Click **Select**

<div data-with-frame="true"><img src="https://737907756-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FI4kncOam5KtDqeGMEiQu%2Fuploads%2Fgit-blob-9dbd20e6aa86bedbca17e61c33ff26eccafc537d%2Fadd-users.jpg?alt=media" alt="Entra ID - Add Users"></div>

***

## Configure in Organizations

Return to the [Organizations SSO Configuration Guide](/caf-docs/user-guide/organizations/sso-configurations.md#step-2-enable-sso-and-configure-the-provider) and configure:

| Organizations field  | Value                                    |
| -------------------- | ---------------------------------------- |
| **Protocol**         | SAML 2.0                                 |
| **Metadata XML URL** | Paste the copied federation metadata URL |

On the **Attribute mapping** tab, use these claim values:

| Organizations attribute | Claim value                                                          |
| ----------------------- | -------------------------------------------------------------------- |
| **Email**               | `http://schemas.xmlsoap.org/ws/2005/05/identity/claims/emailaddress` |
| **Full name**           | `http://schemas.xmlsoap.org/ws/2005/05/identity/claims/name`         |
| **First name**          | `http://schemas.xmlsoap.org/ws/2005/05/identity/claims/givenname`    |
| **Last name**           | `http://schemas.xmlsoap.org/ws/2005/05/identity/claims/surname`      |
| **Groups** (optional)   | `http://schemas.microsoft.com/ws/2008/06/identity/claims/groups`     |

***

## Next Steps

After configuring Microsoft Entra ID, return to the [Organizations SSO Configuration Guide](/caf-docs/user-guide/organizations/sso-configurations.md) to:

1. [Configure attribute mapping](/caf-docs/user-guide/organizations/sso-configurations.md#step-3-configure-attribute-mapping)
2. [Configure group assignment rules](/caf-docs/user-guide/organizations/sso-configurations.md#step-4-configure-group-assignment-rules)
3. [Save and test](/caf-docs/user-guide/organizations/sso-configurations.md#step-5-save-and-test)

***

## Troubleshooting

| Problem                 | Probable Cause                       | Solution                                                                    |
| ----------------------- | ------------------------------------ | --------------------------------------------------------------------------- |
| Certificate error       | Invalid or expired Metadata URL      | Verify that the URL is correct and accessible                               |
| Unauthorized user       | User not assigned to the application | Add the user in **Users and groups**                                        |
| Attributes not received | Claims not configured correctly      | Review the **Attributes & Claims** section                                  |
| ACS URL error           | ACS URL does not match               | Verify that the URL in Entra ID is identical to Organizations's **ACS URL** |

***

## References

* [Microsoft Entra ID Documentation - SAML SSO](https://learn.microsoft.com/en-us/entra/identity/enterprise-apps/add-application-portal-setup-sso)
* [Configure group claims](https://learn.microsoft.com/en-us/entra/identity/hybrid/connect/how-to-connect-fed-group-claims)


---

# Agent Instructions
This documentation is published with GitBook. GitBook is the documentation platform designed so that both humans and AI agents can read, navigate, and reason over technical content effectively. Learn more at gitbook.com.

## Querying This Documentation
If you need additional information that is not directly available in this page, you can query the documentation dynamically by asking a question.

Perform an HTTP GET request on the current page URL with the `ask` query parameter, and the optional `goal` query parameter:

```
GET https://docs.caf.io/caf-docs/user-guide/organizations/sso-configurations/microsoft-entra-id.md?ask=<question>&goal=<endgoal>
```

`ask` is the immediate question: it should be specific, self-contained, and written in natural language.
`goal` is optional and describes the broader end goal you are ultimately trying to accomplish on behalf of the user. GitBook uses it to tailor the answer towards what is most useful for that goal.

The response will contain a direct answer to the question and relevant excerpts and sources from the documentation.

Use this mechanism when the answer is not explicitly present in the current page, you need clarification or additional context, or you want to retrieve related documentation sections.