> For the complete documentation index, see [llms.txt](https://docs.caf.io/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://docs.caf.io/caf-docs/user-guide/trust-platform/sso-configurations/microsoft-entra-id.md).

# Microsoft Entra ID (SAML)

This guide explains how to configure SSO integration between Trust and Microsoft Entra ID (formerly Azure AD) using the `SAML` protocol. After configuring Entra ID, return to the [Trust SSO Configuration Guide](/caf-docs/user-guide/trust-platform/sso-configurations.md) to complete the setup.

{% hint style="info" %}
**Before you begin:** Access Trust and copy the **Identifier** and **Reply URL** fields as described in [Step 2 of the SSO Configuration Guide](/caf-docs/user-guide/trust-platform/sso-configurations.md#step-2-select-protocol-and-obtain-data).
{% endhint %}

***

## Prerequisites

* Administrator access to Microsoft Entra ID
* Administrator access to Trust
* Verified corporate email domain

***

## Create Application in Microsoft Entra ID

1. Access the [Azure Portal](https://portal.azure.com)
2. Navigate to **Microsoft Entra ID** → **Enterprise Applications**
3. Click **New application**

<div data-with-frame="true"><img src="/files/PfCsWxvd7pOHxWgxIfJ6" alt="Entra ID - Create App Integration"></div>

4. Click **Create your own application**
5. Enter the application name (e.g., "Trust - Caf")
6. Select **Integrate any other application you don't find in the gallery (Non-gallery)**
7. Click **Create**

<div data-with-frame="true"><img src="/files/U5GKmNfgluwCgiqpQZhJ" alt="Entra ID - Create Application"></div>

***

## Configure SAML

1. In the created application, access **Single sign-on** in the side menu
2. Select **SAML** as the authentication method

<div data-with-frame="true"><img src="/files/QnKFiwLW6U1VcuSvfwU0" alt="Entra ID - Select SAML"></div>

3. In the **Basic SAML Configuration** section, click **Edit** and configure:

<div data-with-frame="true"><img src="/files/KEDLmaTLXzMI4lxijiZ0" alt="Entra ID - Basic SAML Edit Configuration"></div>

| Entra ID Field                                 | Value                                      |
| ---------------------------------------------- | ------------------------------------------ |
| **Identifier (Entity ID)**                     | Paste the **Identifier** copied from Trust |
| **Reply URL (Assertion Consumer Service URL)** | Paste the **Reply URL** copied from Trust  |
| **Sign-on URL**                                | Leave blank (optional)                     |
| **Relay State**                                | Leave blank                                |
| **Logout Url**                                 | Leave blank (optional)                     |

<div data-with-frame="true"><img src="/files/b93YGHko46j13jznYyIL" alt="Entra ID - Basic SAML Configuration"></div>

4. Click **Save**

***

## Configure Attributes and Claims

In the **Attributes & Claims** section, configure the attributes that will be sent to Trust:

1. Click **Edit**

<div data-with-frame="true"><img src="/files/BTAHvx80XVNWOWlXz1LC" alt="Entra ID - Edit Attributes &#x26; Clains"></div>

2. Configure the following claims:

| Claim Name                                                           | Source Attribute         |
| -------------------------------------------------------------------- | ------------------------ |
| `http://schemas.xmlsoap.org/ws/2005/05/identity/claims/emailaddress` | `user.userprincipalname` |
| `http://schemas.xmlsoap.org/ws/2005/05/identity/claims/givenname`    | `user.givenname`         |
| `http://schemas.xmlsoap.org/ws/2005/05/identity/claims/name`         | `user.userprincipalname` |
| `http://schemas.xmlsoap.org/ws/2005/05/identity/claims/surname`      | `user.surname`           |

<div data-with-frame="true"><img src="/files/6QnbCxYM9wXzNGoGrqgN" alt="Entra ID - Attributes &#x26; Clains"></div>

### Configure Group Claim (Optional)

If you want to use custom group mapping:

1. Click **Add a group claim**
2. Select **Security groups** or **Groups assigned to the application**
3. In **Source attribute**, select **Group ID** or **Cloud-only group display names**
4. Click **Save**

<div data-with-frame="true"><img src="/files/OVYz1us7ksad0H8Vp063" alt="Entra ID - Add Group Claim"></div>

5. The claim will be: `http://schemas.microsoft.com/ws/2008/06/identity/claims/groups`

{% hint style="warning" %}
**Important:** If using Group ID, you will need to map the group IDs (GUIDs) in Trust, not the names.
{% endhint %}

***

## Obtain Metadata URL

1. In the **SAML Certificates** section, locate **App Federation Metadata Url**
2. Copy the URL, which will have the format:

```
https://login.microsoftonline.com/{tenant-id}/federationmetadata/2007-06/federationmetadata.xml
```

<div data-with-frame="true"><img src="/files/Oq8zzgdpdj30YYHaPraA" alt="Entra ID - Metadata URL"></div>

***

## Assign Users and Groups

1. In the side menu, access **Users and groups**
2. Click **Add user/group**

<div data-with-frame="true"><img src="/files/EHVpr5BVJrx2DOvTk0UW" alt="Entra ID - Users and Groups"></div>

3. Click to add users
4. Select the users or groups that will have access to Trust via SSO
5. Click **Select**

<div data-with-frame="true"><img src="/files/2DLHdsCWwcgZAnGYH7mD" alt="Entra ID - Add Users"></div>

***

## Configure in Trust

Return to the [Trust SSO Configuration Guide](/caf-docs/user-guide/trust-platform/sso-configurations.md#step-2-select-protocol-and-obtain-data) and configure:

| Trust Field      | Value                |
| ---------------- | -------------------- |
| **Protocol**     | SAML                 |
| **Metadata URL** | Paste the copied URL |

**Attribute Statements:**

| Trust Attribute       | Claim Value                                                          |
| --------------------- | -------------------------------------------------------------------- |
| **E-mail**            | `http://schemas.xmlsoap.org/ws/2005/05/identity/claims/emailaddress` |
| **Name**              | `http://schemas.xmlsoap.org/ws/2005/05/identity/claims/name`         |
| **Given Name**        | `http://schemas.xmlsoap.org/ws/2005/05/identity/claims/givenname`    |
| **Family Name**       | `http://schemas.xmlsoap.org/ws/2005/05/identity/claims/surname`      |
| **Groups** (optional) | `http://schemas.microsoft.com/ws/2008/06/identity/claims/groups`     |

***

## Next Steps

After configuring Microsoft Entra ID, return to the [Trust SSO Configuration Guide](/caf-docs/user-guide/trust-platform/sso-configurations.md) to:

1. [Configure Properties and Scopes](/caf-docs/user-guide/trust-platform/sso-configurations.md#step-2-select-protocol-and-obtain-data)
2. [Configure Permission Groups](/caf-docs/user-guide/trust-platform/sso-configurations.md#step-3-configure-permission-groups)
3. [Configure Attribute Statements](/caf-docs/user-guide/trust-platform/sso-configurations.md#step-4-configure-attribute-statements)
4. [Configure Domains](/caf-docs/user-guide/trust-platform/sso-configurations.md#step-5-configure-domains)
5. [Save and Test](/caf-docs/user-guide/trust-platform/sso-configurations.md#step-6-save-and-test)

***

## Troubleshooting

| Problem                 | Probable Cause                       | Solution                                                |
| ----------------------- | ------------------------------------ | ------------------------------------------------------- |
| Certificate error       | Invalid or expired Metadata URL      | Verify that the URL is correct and accessible           |
| Unauthorized user       | User not assigned to the application | Add the user in **Users and groups**                    |
| Attributes not received | Claims not configured correctly      | Review the **Attributes & Claims** section              |
| Reply URL error         | Reply URL does not match             | Verify that the URL in Entra ID is identical to Trust's |

***

## References

* [Microsoft Entra ID Documentation - SAML SSO](https://learn.microsoft.com/en-us/entra/identity/enterprise-apps/add-application-portal-setup-sso)
* [Configure group claims](https://learn.microsoft.com/en-us/entra/identity/hybrid/connect/how-to-connect-fed-group-claims)


---

# Agent Instructions
This documentation is published with GitBook. GitBook is the documentation platform designed so that both humans and AI agents can read, navigate, and reason over technical content effectively. Learn more at gitbook.com.

## Querying This Documentation
If you need additional information that is not directly available in this page, you can query the documentation dynamically by asking a question.

Perform an HTTP GET request on the current page URL with the `ask` query parameter, and the optional `goal` query parameter:

```
GET https://docs.caf.io/caf-docs/user-guide/trust-platform/sso-configurations/microsoft-entra-id.md?ask=<question>&goal=<endgoal>
```

`ask` is the immediate question: it should be specific, self-contained, and written in natural language.
`goal` is optional and describes the broader end goal you are ultimately trying to accomplish on behalf of the user. GitBook uses it to tailor the answer towards what is most useful for that goal.

The response will contain a direct answer to the question and relevant excerpts and sources from the documentation.

Use this mechanism when the answer is not explicitly present in the current page, you need clarification or additional context, or you want to retrieve related documentation sections.