Ctrlk
Useful links
For the complete documentation index, see llms.txt. This page is also available as Markdown.

Microsoft Entra ID (SAML)

Configure SSO with Microsoft Entra ID (Azure AD) using the SAML protocol.

This guide explains how to configure SSO integration between Organizations and Microsoft Entra ID (formerly Azure AD) using the SAML protocol. After configuring Entra ID, return to the Organizations SSO Configuration Guide to complete the setup.

For OpenID Connect (OIDC) with Microsoft Entra ID, follow the Generic Provider Configuration Guide using the Redirect URI, client credentials, and issuer URL from your Entra ID app registration.

Before you begin: Open Authentication → SSO in Organizations and copy the Entity ID and ACS URL as described in Step 2 of the SSO Configuration Guide.

Prerequisites

  • Administrator access to Microsoft Entra ID

  • Super Admin access to Organizations

Create Application in Microsoft Entra ID

  1. Access the Azure Portal

  2. Navigate to Microsoft Entra ID → Enterprise Applications

  3. Click New application

Entra ID - Create App Integration

  1. Click Create your own application

  2. Enter the application name (e.g., "Certta")

  3. Select Integrate any other application you don't find in the gallery (Non-gallery)

  4. Click Create

Entra ID - Create Application

Configure SAML

  1. In the created application, access Single sign-on in the side menu

  2. Select SAML as the authentication method

Entra ID - Select SAML

  1. In the Basic SAML Configuration section, click Edit and configure:

Entra ID - Basic SAML Edit Configuration
Entra ID Field
Value

Identifier (Entity ID)

Paste the Entity ID copied from Organizations

Reply URL (Assertion Consumer Service URL)

Paste the ACS URL copied from Organizations

Sign-on URL

Leave blank (optional)

Relay State

Leave blank

Logout Url

Leave blank (optional)

Entra ID - Basic SAML Configuration

  1. Click Save

Configure Attributes and Claims

In the Attributes & Claims section, configure the attributes that will be sent to Organizations:

  1. Click Edit

Entra ID - Edit Attributes & Clains

  1. Configure the following claims:

Claim Name
Source Attribute

http://schemas.xmlsoap.org/ws/2005/05/identity/claims/emailaddress

user.userprincipalname

http://schemas.xmlsoap.org/ws/2005/05/identity/claims/givenname

user.givenname

http://schemas.xmlsoap.org/ws/2005/05/identity/claims/name

user.userprincipalname

http://schemas.xmlsoap.org/ws/2005/05/identity/claims/surname

user.surname

Entra ID - Attributes & Clains

Configure Group Claim (Optional)

If you want to use group-based assignment rules in Organizations:

  1. Click Add a group claim

  2. Select Security groups or Groups assigned to the application

  3. In Source attribute, select Group ID or Cloud-only group display names

  4. Click Save

Entra ID - Add Group Claim

  1. The claim will be: http://schemas.microsoft.com/ws/2008/06/identity/claims/groups

Important: If using Group ID, map group IDs (GUIDs) in Group assignment rules, not display names.

Obtain Metadata URL

  1. In the SAML Certificates section, locate App Federation Metadata Url

  2. Copy the URL, which will have the format:

Entra ID - Metadata URL

Assign Users and Groups

  1. In the side menu, access Users and groups

  2. Click Add user/group

Entra ID - Users and Groups

  1. Click to add users

  2. Select the users or groups that will have access to Organizations via SSO

  3. Click Select

Entra ID - Add Users

Configure in Organizations

Return to the Organizations SSO Configuration Guide and configure:

Organizations field
Value

Protocol

SAML 2.0

Metadata XML URL

Paste the copied federation metadata URL

On the Attribute mapping tab, use these claim values:

Organizations attribute
Claim value

Email

http://schemas.xmlsoap.org/ws/2005/05/identity/claims/emailaddress

Full name

http://schemas.xmlsoap.org/ws/2005/05/identity/claims/name

First name

http://schemas.xmlsoap.org/ws/2005/05/identity/claims/givenname

Last name

http://schemas.xmlsoap.org/ws/2005/05/identity/claims/surname

Groups (optional)

http://schemas.microsoft.com/ws/2008/06/identity/claims/groups

Next Steps

After configuring Microsoft Entra ID, return to the Organizations SSO Configuration Guide to:

  1. Configure attribute mapping

  2. Configure group assignment rules

  3. Save and test

Troubleshooting

Problem
Probable Cause
Solution

Certificate error

Invalid or expired Metadata URL

Verify that the URL is correct and accessible

Unauthorized user

User not assigned to the application

Add the user in Users and groups

Attributes not received

Claims not configured correctly

Review the Attributes & Claims section

ACS URL error

ACS URL does not match

Verify that the URL in Entra ID is identical to Organizations's ACS URL

References

Last updated