Setting Up MS Azure Entra SSO Authentication
MS Azure / Entra
MS Entra web portal: Microsoft Entra admin center
Prerequisites
To configure SSO, you need:
-
A Microsoft Entra user account. If you don't already have one, you can Create an account for free.
-
One of the following roles: Cloud Application Administrator, Application Administrator, or owner of the service principal.
Create a MS Entra Application
To create an application:
Sign in to the Microsoft Entra admin center as at least a Cloud Application Administrator.
Browse to Identity > Applications > Enterprise applications > New Application.
Select Create your own application.
Write a name for your Application and choose the “Integrate any other application you don’t find in the gallery (Non-gallery)” option [IMPORTANT]. Then click in the “Create” button.
After your it is created you will be directed to your application main page:
Enable Single Sign-On for your Application
-
To enable SSO for an application:
Browse to Identity > Applications > Enterprise applications > All applications > Select your Application.
In the Manage section of the left menu, select Single sign-on to open the Single sign-on panel for editing. Or choose the Set up single sign on section (shown in the image above).
Select SAML method:
That will open the SSO configuration page:
Configure with HQ Application
In HQ app, go to User & Authentication > SAML Login.
Turn on the Enable for sign-up and sign-in toggle button.
Take note on the Sign-ON URL and Audience fields.
Go back to the MS Entra SSO configuration page.
Select to Edit the 1) Basic SAML Configuration section and fill the next fields with their respective HQ value. Then Save those changes:
Locate the 3) SAML Certificates section:
- Edit the Token signing certificate.
-In the Signing Option field select Sign SAML response and assertion.
-Save the changes.
- Copy the value of the App Federation Metadata Url field.
- Go to HQ application and paste that value into the Metadata URL field.
-Save changes.
Now you can use your MS credentials to login via SSO into HQ application!
* Only the Users / Groups defined in the MS Entra application will be granted access.
For more references and details about MS Entra, we can check official documentation here:
Enable SAML single sign-on for an enterprise application - Microsoft Entra ID