Ctrlk
For the complete documentation index, see llms.txt. This page is also available as Markdown.

Microsoft Entra ID (SAML)

Configure SSO with Microsoft Entra ID (Azure AD) using the SAML protocol.

This guide explains how to configure SSO integration between Trust and Microsoft Entra ID (formerly Azure AD) using the SAML protocol. After configuring Entra ID, return to the Trust SSO Configuration Guide to complete the setup.

Before you begin: Access Trust and copy the Identifier and Reply URL fields as described in Step 2 of the SSO Configuration Guide.

Prerequisites

  • Administrator access to Microsoft Entra ID

  • Administrator access to Trust

  • Verified corporate email domain

Create Application in Microsoft Entra ID

  1. Access the Azure Portal

  2. Navigate to Microsoft Entra ID → Enterprise Applications

  3. Click New application

Entra ID - Create App Integration

  1. Click Create your own application

  2. Enter the application name (e.g., "Trust - Caf")

  3. Select Integrate any other application you don't find in the gallery (Non-gallery)

  4. Click Create

Entra ID - Create Application

Configure SAML

  1. In the created application, access Single sign-on in the side menu

  2. Select SAML as the authentication method

Entra ID - Select SAML

  1. In the Basic SAML Configuration section, click Edit and configure:

Entra ID - Basic SAML Edit Configuration
Entra ID Field
Value

Identifier (Entity ID)

Paste the Identifier copied from Trust

Reply URL (Assertion Consumer Service URL)

Paste the Reply URL copied from Trust

Sign-on URL

Leave blank (optional)

Relay State

Leave blank

Logout Url

Leave blank (optional)

Entra ID - Basic SAML Configuration

  1. Click Save

Configure Attributes and Claims

In the Attributes & Claims section, configure the attributes that will be sent to Trust:

  1. Click Edit

Entra ID - Edit Attributes & Clains

  1. Configure the following claims:

Claim Name
Source Attribute

http://schemas.xmlsoap.org/ws/2005/05/identity/claims/emailaddress

user.userprincipalname

http://schemas.xmlsoap.org/ws/2005/05/identity/claims/givenname

user.givenname

http://schemas.xmlsoap.org/ws/2005/05/identity/claims/name

user.userprincipalname

http://schemas.xmlsoap.org/ws/2005/05/identity/claims/surname

user.surname

Entra ID - Attributes & Clains

Configure Group Claim (Optional)

If you want to use custom group mapping:

  1. Click Add a group claim

  2. Select Security groups or Groups assigned to the application

  3. In Source attribute, select Group ID or Cloud-only group display names

  4. Click Save

Entra ID - Add Group Claim

  1. The claim will be: http://schemas.microsoft.com/ws/2008/06/identity/claims/groups

Important: If using Group ID, you will need to map the group IDs (GUIDs) in Trust, not the names.

Obtain Metadata URL

  1. In the SAML Certificates section, locate App Federation Metadata Url

  2. Copy the URL, which will have the format:

Entra ID - Metadata URL

Assign Users and Groups

  1. In the side menu, access Users and groups

  2. Click Add user/group

Entra ID - Users and Groups

  1. Click to add users

  2. Select the users or groups that will have access to Trust via SSO

  3. Click Select

Entra ID - Add Users

Configure in Trust

Return to the Trust SSO Configuration Guide and configure:

Trust Field
Value

Protocol

SAML

Metadata URL

Paste the copied URL

Attribute Statements:

Trust Attribute
Claim Value

E-mail

http://schemas.xmlsoap.org/ws/2005/05/identity/claims/emailaddress

Name

http://schemas.xmlsoap.org/ws/2005/05/identity/claims/name

Given Name

http://schemas.xmlsoap.org/ws/2005/05/identity/claims/givenname

Family Name

http://schemas.xmlsoap.org/ws/2005/05/identity/claims/surname

Groups (optional)

http://schemas.microsoft.com/ws/2008/06/identity/claims/groups

Next Steps

After configuring Microsoft Entra ID, return to the Trust SSO Configuration Guide to:

  1. Configure Properties and Scopes

  2. Configure Permission Groups

  3. Configure Attribute Statements

  4. Configure Domains

  5. Save and Test

Troubleshooting

Problem
Probable Cause
Solution

Certificate error

Invalid or expired Metadata URL

Verify that the URL is correct and accessible

Unauthorized user

User not assigned to the application

Add the user in Users and groups

Attributes not received

Claims not configured correctly

Review the Attributes & Claims section

Reply URL error

Reply URL does not match

Verify that the URL in Entra ID is identical to Trust's

References

Last updated