# Use Microsoft Entra SAML as an IdP The **Microsoft Entra Identity Provider (IdP)** is a trusted entity that allows you to enable single sign-on (SSO) to access other sites or services, such as Azion. Your users can continue using their corporate user identities without remembering a specific password or entering credentials each time they access Azion's platform. :::note This feature is available to customers with **Enterprise** and **Mission-Critical** [Support](https://www.azion.com/en/professional-services/). ::: To set up a Microsoft Entra custom SAML app as your account IdP for Azion's platform, follow the next steps. :::caution[warning] Even if you're using an IdP, it's necessary to register all account users on Azion's platform as they're synced in both Azion's platform and IdP. An inexistent user on Azion's platform won't be able to log in to it. ::: --- ## Configuring the SAML app on Microsoft Entra :::note You need to be an administrator of the Microsoft Entra account to perform the following tasks. ::: 1. Access [Microsoft Entra admin center](https://entra.microsoft.com/). 2. In the main left menu, select **Applications** > **Enterprise Applications**. 3. Click the **New Application** button. - It'll show some cards with predefined applications and other options to create your own one. 4. Click the **Create your own application** button. 5. On the configuration page, give a name and, optionally, a description for your application. Example: `Azion IdP integration` 6. Select the **Integrate any other application you don't find in the gallery (Non-gallery)** option. 7. Click the **Create** button. 8. After your application is created, select the **Sigle sign-on** option. 9. Select the **SAML** card. - It'll open the **Basic SAML Configuration** form. 10. In the form, you must fill in the following fields: - In **Identifier (Entity ID)**, enter https://sso.azion.com. - In **Reply URL (Assertion Consumer Service URL)**, enter https://sso.azion.com. - These fields are required to save the configuration. However, they'll be updated later to guarantee the integration works adequately. 11. Click the **Save** button. - It'll redirect you to the application's page. 12. In the **SAML Certificates** section, select the **Download Certificate (Base64)** to download the information about the SAML application. - You'll use this information later to configure the integration on Azion's platform. --- ## Configuring the Identity Provider on Azion :::note You must be the **Account Owner** on Azion's platform to perform these settings. ::: 1. Access [Azion Console](https://console.azion.com/). 2. On the upper-right corner of the page, select the avatar menu. This is the **Account menu**. 3. Select the **SSO Management** option. 4. Click the **Add Identity Provider** button and select **SAML**. 5. On the **Identity Provider** page, choose a name that identifies your identity provider. Example: `Microsoft Entra IdP integration`. 6. Fill in the following fields with the data in the certificate file you downloaded in the Microsoft Entra portal: - Identity provider's Entity ID URI. - Sign-in URL. - Certificate. It must include the `-----BEGIN CERTIFICATE-----` and `-----END CERTIFICATE-----` tags. 7. Click **Save**. You'll be redirected to the list of identity providers, where you can view all the providers created in your account. --- ## Completing the registration of the app on Microsoft Entra Still on the **SSO Management** page of Console: 1. Find the card of your recently created identity provider. 2. Click the context menu, represented by three dots, and select **Edit**. :::caution[warning] Don't click **Activate and turn on identity Origin** before you complete the configuration on the Microsoft Entra portal. ::: 3. On the **Identity Provider** page, you'll need to copy the following information to finish the configuration on the Microsoft Entra portal: - Assertion Consumer Service URL. - Service Provider's Entity ID URI. - Sign-in URL. Once you've copied this information: 1. Access [Microsoft Entra admin center](https://entra.microsoft.com/). 2. Return to the **Single sign-on** section, selecting it from the left side menu. 3. On the **Basic SAML Configuration** box, click **Edit** and provide the following information: - In the **Identifier (Entity ID)** field, paste the **Service Provider's Entity ID URI** you've copied from Azion's interface. - In the **Reply URL (Assertion Consumer Service URL)** field, paste the Assertion Consumer Service URL you've copied from Azion's interface. - In the **Sign on URL** field, paste the Login URL you've copied from Azion's interface. 4. Click the **Save** button. 5. In the **Attributes & Claims** box, click **Edit**. After copying this information: 1. Access [Microsoft Entra admin center](https://entra.microsoft.com/). 2. Return to the **Single sign-on** section, by selecting it in the left menu. 3. In the **Basic SAML Configuration** box, click **Edit** and provide the following information: - In the **Identifier (Entity ID)** field, paste the **Service Provider Entity ID URI** that you copied from the Azion interface. - In the **Reply URL (Assertion Consumer Service URL)** field, paste the Assertion Consumer Service URL that you copied from the Azion interface. - In the **Sign on URL** field, paste the Login URL that you copied from the Azion interface. - Click the **Save** button. 5. In the **Attributes & Claims** box, click **Edit** and provide the following information: - In the **Unique User Identifier**, set the string *user.primaryauthoritativeemail* to use the email address as the identifier. 6. In the **SAML Certificates** box - **Token signing certificate** topic, click **Edit** and provide the following information: - Under **Signing Options** select the option **Sign SAML response and assertion**. - Click the **Save** button. 7. Under **Signing Options**, edit and select **Sign SAML response and assertion**. 8. Click the **Save** button. After setting the service provider details, you can add users and groups, by selecting the **Users and groups** on the left side menu. Alternatively, you can enable Automated User Provisioning, using the SCIM protocol. Check the [how-to guide](/en/documentation/products/guides/microsoft-entra-automated-user-provisioning/) to get more information. :::caution[warning] Even if you're using an IdP, it's necessary to register all account users on Azion's platform as they're synced in both Azion's platform and IdP. An inexistent user on Azion's platform won't be able to log in to it. ::: --- ## Turning on the Identity Provider on Azion Finally, you must return to the **SSO Management** page on Azion's Console. 1. [Back on Azion Console](https://console.azion.com/), access the **SSO Management** page. 2. On the box of the Identity Provider you've added, click **Activate and turn on identity Origin** and then click **Confirm**. Now all the users of the account, except for the **Account Owner**, will be able to access Azion using Microsoft Entra as the Identity Provider. :::note When the IdP app is activated, the Multi-Factor Authentication (MFA) stops being verified by Azion's platform and starts to be authenticated by the IdP. If the account returns to Azion's SSO, it'll use the last active status of the MFA. :::