Create SAML application with Microsoft Entra ID (Azure)

This guide outlines the steps to create and configure a SAML application in icrosoft Entra ID (Azure), including setup, user assignments, and metadata submission.

Step 1: Create an enterprise app

1. Go to Azure Portal, open the portal menu and select Enterprise applications.

2. Click New application.

3. Click Create your own application.

4. Provide a name for your app, Select Integrate any other application you don't find in the gallery (Non-gallery), and click Create.

Step 2: Basic SAML configuration

1. In the Overview page, select Set up single sign-on.

2. Select SAML.

3. Click Edit.

4. Paste following values in the appropriate fields and click Save.

Step 3: Assign users

After creating the enterprise application, you should proceed to assign individual users or groups so that they can authenticate using SAML.

1. Select Users and groups from the left menu.

2. Click Add user/group.

3. Click None Selected.

4. Search for the user or group you wish to add and click Select.

5. Click Assign.

Step 4: Fill attribute statements (optional)

1. Under Attributes & Claims (optional), click Edit.

2. Map the following user attributes:

3. Add a groups claim for passing user's groups.

4. Choose whether the groups attribute will be transferred as an ID or as a name and edit the attribute name to be groups.

5. When using groups to roles mapping, make sure to map the correct attribute type to application roles on the Manage Authorization step.

Step 5: Upload Identity Provider metadata

The final step for implementing SAML SSO requires sharing your identity provider's metadata with the application.

Automatic configuration

1. Click on the Single sign-on from the left menu.
2. Locate App Federation Metadata Url under SAML Signing Certificates.
3. Select Copy to copy the link, then paste it below.

Manual configuration

1. Click on the Single sign-on from the left menu.
2. Download the certificate as Base64 and paste its content into the Public Certificate section.
3. Copy the Login URL and paste it as the SSO Endpoint.

Step 6: Proceed with domain claiming and role assignment

1. Click on Proceed with domain claiming and role assignment to confirm the completion the configuration of the IDP form.
2. Follow the instructions in the Self-service SAML configuration guide to complete this step and manage authorization.