> For clean Markdown of any page, append .md to the page URL.
> For a complete documentation index, see https://docs.itential.com/llms.txt.
> For AI client integration (Claude Code, Cursor, etc.), connect to the MCP server at https://docs.itential.com/_mcp/server.

# Configure SAML SSO with Azure Entra ID

> How to set up SAML SSO between Itential Platform and Azure Entra ID, including issuer configuration, claim mapping, and enabling the identity provider.

This page provides IT administrators the information needed to set up SAML SSO between Itential Platform and Azure Entra ID.

Beginning with version 2023.2 and higher, access management in Itential Platform was expanded to include [SSO via SAML Authentication](/itential-platform/configure/auth/saml-sso/overview).

Itential assumes the reader has completed the process of setting up SAML SSO Authentication in Itential Platform via Admin Essentials, and has mapped their Identity Provider (**Admin Essentials > Authorization > Identity Providers**).

Keep in mind that each organization may have set up their Azure Entra ID system differently and this guide is not all-inclusive of every system environment.

## Add the issuer ID

When configuring an Identity Provider (IdP) in Itential Platform, you will need to enter an Entity ID (called the "Issuer") that identifies the identity provider.

#### Find the Application ID in Azure Entra ID

Sign in to Azure Entra ID and go to the Itential application that was set up.

![](/_fern-img/cbb9ef7b66be0a0aea49d27f51b9d377912c0189e2581e3429dc0b6c33da44a2.webp)

Under **Properties**, copy the `Application ID`. This will be used to satisfy the **Issuer** parameter.

#### Open the Identity Providers configuration in Itential Platform

Sign in to Itential Platform and navigate to **Admin Essentials > Authorization > Identity Providers > Configuration**.

#### Paste the Application ID into the Issuer field

Paste the `Application ID` into the **Issuer** field.

![](/_fern-img/2f16c2f7e99d328718e0b79b87b479360124c746b1e4cd36fbb864ca09e15e88.webp)

#### Add the spn: prefix if needed

Add the prefix `spn:` if the Application ID is in `UUID` format, so the resulting variable is changed to `URI` format and looks like this: `spn:12121-121212-12212-12212-1212`

The prefix is not required if the Application ID is already in URI format.

#### Save

Click **Save** to retain your input.

## Set up SSO in Azure Entra ID

These steps walk through setting up and obtaining the variables required to complete the configuration of SAML SSO in Itential Platform.

#### Open Single sign-on settings

Go back to the Itential application in Azure Entra ID and select **Single sign on**.

![](/_fern-img/de05c6be9818939bb13d675989d16e9eb0a4832f38bd4bde509a33423196cf0c.webp)

#### Configure Basic SAML Configuration

Click **Edit** under "Basic SAML Configuration" and enter the unique **Identifier** (Entity ID) that identifies Itential Platform and the **Reply URL** to receive the authentication token.

Append `/saml/callback` to the **Reply URL** so the format looks like this:

```
https://myorg-account.companytoso.com/saml/callback
```

Click **Save** to finalize your Basic SAML Configuration changes.

![](/_fern-img/b481df467708ce58bdb990fc6cccf712a45d026f4b08c9920a48b94627c756da.webp)

#### Add a group claim

Go to **Attributes & Claims**, click **Edit**, and then click **+ Add a group claim**.

![](/_fern-img/85685e2bb9a51eb3efc8548b35f4423a31314c0fcadf0ff3f33ec55c45ba65d8.webp)

Select the **All groups** button and then select `Group ID` from the dropdown under **Source attribute**.

![](/_fern-img/1c3d2a8ae8f8175b3f17f2012fd42f51768551642c88e8dc770923da3f6cf009.webp)![](/_fern-img/55a6e7b72f8e53e20bf732d0713ea2fa7612f99dafa2e69d0330bf7053b3b95b.webp)

Click **Save** to finalize your changes. The `user.groups` claim name value displays under **Additional Claims**.

![](/_fern-img/4f184602ad3ff9fbd69917f256b3d4aa985692524895bf3bb560a26c81e51115.webp)

Entra ID limits the number of groups it will emit in a token to 150 for SAML assertions and 200 for OIDC authorization code flow. To avoid hitting the groups limit when users have large numbers of group memberships, restrict the groups emitted in claims to the relevant groups for the application by selecting the **Groups assigned to the application** option.

![](/_fern-img/e4bc17a9bcd3f470e384e9c6899bd212f200665f4cac8fc01925bc1fba218415.webp)

Further reading:

* [Configuring group claims using Microsoft Entra ID](https://learn.microsoft.com/en-us/entra/identity/hybrid/connect/how-to-connect-fed-group-claims)
* [Configure group claims for applications using Entra ID](https://learn.microsoft.com/en-us/entra/identity/hybrid/connect/how-to-connect-fed-group-claims)
* [Video: Overview of group assignment and claims in Entra ID](https://youtu.be/uws-5Yz163k?si=wuA31ncGBWKAM5tP)

## Configure Azure SAML SSO variables in Itential Platform

After setting up the variables in Azure Entra ID, finalize the identity provider configurations in Itential Platform.

#### Open the Identity Providers configuration

Navigate to **Admin Essentials > Authorization > Identity Providers > Configuration**.

#### Locate the claim names in Azure Entra ID

Locate the following attributes from **Attributes & Claims** in Azure Entra ID:

* name — `user.userprincipalname`
* groups — `user.groups`
* email address — `user.mail`
* given name — `user.givenname`

![](/_fern-img/55c47f662144c908e109002e4973b51998fb7db454f9595887dc972e9c8a5bab.webp)

#### Map claim names to Itential Platform fields

Copy the Azure Entra ID **Claim name** into the appropriate field in the Identity Providers **Configuration**. Use the following mapping:

| Itential Platform field | Claim name                                                             | Value                    |
| ----------------------- | ---------------------------------------------------------------------- | ------------------------ |
| Username Attribute      | `http://schemas.microsoft.com/ws/2005/05/identity/claims/name`         | `user.userprincipalname` |
| Groups Attribute        | `http://schemas.microsoft.com/ws/2005/05/identity/claims/groups`       | `user.groups`            |
| Email Attribute         | `http://schemas.microsoft.com/ws/2005/05/identity/claims/emailaddress` | `user.mail`              |
| First Name Attribute    | `http://schemas.microsoft.com/ws/2005/05/identity/claims/givenname`    | `user.givenname`         |

#### Enter the Login URL

Locate the `Login URL` from the **Set Up Itential - SAML** area in Azure Entra ID and enter it into the **Login URL** field on the Identity Providers **Configuration** tab.

![](/_fern-img/70c9d2dab5a4a76f348aedf6c5ef0210b164cd1b1e8e08a9649834631d2dce66.webp)

#### Upload the certificate

Download the `Base64` certificate file under **SAML Certificates** in Azure Entra ID. Upload the certificate file to the Identity Providers **Configuration** page by drag-and-drop, or use the **Click to Browse** link to find and select the file.

![](/_fern-img/184ede28d90be5dd9c84577d19f28be9b5611597dd3f799a783de66cd581f468.webp)

#### Save

Click **Save** to retain all Itential Platform Identity Provider configurations.

## Test the Azure Entra ID configuration

To enable Azure Entra ID in Itential Platform, you must successfully test the configuration. Click the **Test Connection** button at the top of the Identity Providers page (under the **Configuration** tab). This initiates SSO SAML authentication with Azure Entra ID in a new tab.

This message indicates a problem with the parameters or certificate:

![](/_fern-img/fe9e8dc0b5c629043397d93b4e13e4c258f6d5967ba7b6a5a9cbe947ac4ad332.webp)

This message indicates a successful test and all parameters are set correctly:

![](/_fern-img/96fa9240e7d1077d24a0d4f0f25ec08499f37b49b22d4ba1ff89bbd1e7f0afa1.webp)

The following is a sample testing certificate for Azure/Entra ID SSO configuration:

```json
{
  "name": "Azure test",
  "ssoType": "saml",
  "settings": {
    "issuer": "spn:1472b53e-4e4b-496c-b8e3-94c0bc01cfa9",
    "loginURL": "https://login.microsoftonline.com/03c6bbc9-f28e-464a-80db-04438fdd29bd/saml2",
    "forceLogin": false,
    "certificate": "-----BEGIN CERTIFICATE-----\r\nMIIC8DCCAdigAwIBAgIQFrhUIP3FmJxFBzG7ADXznTANBgkqhkiG9w0BAQsFADA0MTIwMAYDVQQD\r\nEylNaWNyb3NvZnQgQXp1cmUgRmVkZXJhdGVkIFNTTyBDZXJ0aWZpY2F0ZTAeFw0yMzA2MjkxNjQ5\r\nMTJaFw0yNjA2MjkxNjQ5MTJaMDQxMjAwBgNVBAMTKU1pY3Jvc29mdCBBenVyZSBGZWRlcmF0ZWQg\r\nU1NPIENlcnRpZmljYXRlMIIBIjANBgkqhkiG9w0BAQEFAAOCAQ8AMIIBCgKCAQEA1iGG2YcyIg4Y\r\nxYyelREqGxXbEFq7+/9iAfWkaSpzj4Tp+71jbe8lHC1vg6Yi0qRmD+Ln1YBy5qGH/lBWHyh2+30e\r\ncgEimEmoxnI8LLyu6PdRdzYy3bKUCYoMjoa1BW1EOxBxXN2GA9dTFzHVsnRq1vOcj9fUSrjJFGPn\r\noMT50TZBAgE+gcET3CSGsrhq50xl93/AMg7xZJ9VIlk1w7OMR2317TeBWa7Vf1vVKAEM8vM//XNK\r\ngVK6wtnm8reC642W8I8jz2WxLOV8AAaFzx4b7cJbD3hytkKWJzWVURQKht7wesf4SIVnNf+oOWDb\r\nvhUcmsmTz5qOE7OTJZshX0cdEQIDAQABMA0GCSqGSIb3DQEBCwUAA4IBAQDFKBJp8595K/rgV4gO\r\nT9t0ClLCoLAPSDf2tNQHCRbWhh5edOUA7spNfBOHS80idpfeNNRlH0aC6HbRZAfHtpLR8R2O/6It\r\nD9aEvLxp0WStRs/YO/ptTglnjpTtpeEe/t46cnh/0z/GcK4yqp9vctpQ/UAILg4qQizStsG7XyIS\r\nuhmLJScgPK8FW06W1a2H8pfJ23GorG4UHhLWOTw17ViEWhm6hURPOz8ut1uCx/bgP0L3X438bY0v\r\nP+Gu9vHOCLnHmo2JCirgcPxz8+hOnxH9AHy+x0TitKxfhj9G79XMuVXCsFcSXQFLUQeRe/qAJ0HU\r\nhY5F3kBP2W92/4RFdG7/\r\n-----END CERTIFICATE-----\r\n",
    "samlEmailAttribute": "http://schemas.xmlsoap.org/ws/2005/05/identity/claims/emailaddress",
    "samlUserNameAttribute": "http://schemas.xmlsoap.org/ws/2005/05/identity/claims/name",
    "description": "asdf",
    "samlGroupsAttribute": "http://schemas.microsoft.com/ws/2008/06/identity/claims/groups",
    "samlFirstNameAttribute": "http://schemas.xmlsoap.org/ws/2005/05/identity/claims/givenname"
  }
}
```

After a successful test connection, **Groups** from the authentication server display and can be mapped to internal Itential Platform groups and roles under the **Mappings** tab of the Identity Providers config. Map at least the `pronghorn` admin group to provide permissions within Itential Platform.

## Enable Azure Entra ID SSO

Navigate to **Admin Essentials > Authorization > Identity Providers**. Locate the Azure Entra ID IdP and slide the toggle switch to **Enabled**.

Once Azure Entra ID is enabled, the Itential Platform authentication method immediately switches to SSO SAML.

![](/_fern-img/9fffba277df9198dfe5d0e621f45788e47bb9fdf11a5fd468c54c775cf255d2d.webp)