Steps to configure SAML SSO for Microsoft Entra ID

About Microsoft Entra ID

Microsoft Entra ID, previously known as Azure Active Directory (Azure AD), is a cloud-based identity and access management (IAM) solution that enables organizations to manage user identities and access permissions securely. Microsoft Entra ID provides users with a range of functionalities for efficient and secure access to organizational resources.

The following steps will help you enable SAML-based single sign-on (SSO) for Entra ID from Identity360.

Updating the ImmutableID value in Entra ID

To enable SSO to Entra ID through Identity360, it is mandatory to have the ImmutableID attribute as the unique identifier in Entra ID. You can create new users with the ImmutableID attribute or update existing users' ImmutableID attribute value in Entra ID using the following PowerShell commands.

Prerequisites

1. Open PowerShell with administrator privileges.
2. Run the following command to install the Microsoft Graph PowerShell, if it is not already installed:
   Command to install the Microsoft Graph PowerShell

   Copy

   Install-Module Microsoft.Graph -Scope CurrentUser

3. Command to connect to Microsoft Graph PowerShell:
   Command to connect to Microsoft Graph PowerShell

   Copy

   Connect-MgGraph -Scopes "Directory.AccessAsUser.All"

   Note: Sign in with a Microsoft Entra ID account that has Global Admin privileges.
4. Command to update ImmutableID attribute for existing users:
   Command to update ImmutableID attribute

   Copy

   Update-MgUserByUserPrincipalName -UserPrincipalName "<user_mailID>" -OnPremisesImmutableId "<immutable_id>"

5. Command to create new users with the ImmutableID attribute
   Command to create new users

   Copy

   New-MgUser -AccountEnabled:$true -UserPrincipalName "user01@mycompany.com" -MailNickname "user01" -OnPremisesImmutableId "<immutable_id>" -DisplayName "user01" -GivenName "user" -Surname "S"

6. Command to confirm whether the ImmutableID attribute update was successful
   Command to confirm

   Copy

   Get-MgUserByUserPrincipalName -UserPrincipalName "<user_mailID>" -Property UserPrincipalName, OnPremisesImmutableId | select UserPrincipalName, OnPremisesImmutableId

1. PowerShell access with administrative rights is required in order to set up SSO in Entra ID.
2. The MFA and SSO license for Identity360 is required to enable SSO for enterprise applications. For more information, refer to the pricing details.
3. Log in to Identity360 as an Admin or Super Admin, or Technician with a role that has Application Integration and Single Sign-on permissions.
4. Navigate to Applications > Application Integration > Create New Application and select Azure Active Directory from the applications displayed.
   Note: You can also find Azure Active Directory from the search bar located at the top.
5. Under the General Settings tab, enter the Application Name and Description.
6. Under Choose Capabilities, select SSO, then click Continue.
   General Settings of SSO configuration for Entra ID
7. Under Integration Settings, navigate to the Single Sign On tab and click Metadata Details.
8. Copy the Login URL, Logout URL, Entity ID/Issuer URL, and Signing Certificate values, which will be used during the configuration of Entra ID.
   Integration Settings of SSO configuration for Entra ID

Entra ID (service provider) configuration steps

1. Open PowerShell with administrator privileges.
2. Run the following command to install the Microsoft Graph PowerShell, if it is not already installed:
   Command to install the Microsoft Graph PowerShell

   Copy

   Install-Module Microsoft.Graph -Scope CurrentUser

3. Connect to Microsoft Graph PowerShell using the command below. Sign in with a Microsoft Entra ID account that has Global Admin privileges:
   Connect to Microsoft Graph PowerShell

   Copy

   Connect-MgGraph -Scopes "Directory.AccessAsUser.All"

4. Retrieve a list of domains by running:
   Retrieve a list of domains

   Copy

   Get-MgDomain

5. Specify the domain for which you want to enable SSO:
   Specify the domain

   Copy

   $dom = "mycompany.com"

6. Define the Login URL, Entity ID, and Logout URL from step 7 of the prerequisites for $url, $uri and $logouturl commands.

   $url = "<login URL value>"

   $uri = "<entity ID value>"

   $logouturl = "<logout URL value>"

   Example values:

   $url = "https://id360.manageengine.com/iamapps/ssologin/office365/1352163ea82348a5152487b2eb05c5adeb4aaf73"

   $uri = "https://id360.manageengine.com/iamapps/ssologin/office365/1352163ea82348a5152487b2eb05c5adeb4aaf73"

   $logouturl = "https://id360.manageengine.com/iamapps/ssologout/office365/1352163ea82348a5152487b2eb05c5adeb4aaf73"

7. Now copy the SSO certificate file content and assign it to the $cert variable as shown below:

   $cert = "MIICqjCCAhOgAwIBAgIJAN..........dTOjFfqqA="

   Configuring Identity360's SSO in Microsoft Entra ID
8. Run the following command to enable SSO in Microsoft Entra ID:
   Command to enable SSO in Entra ID

   Copy

   New-MgDomainFederationConfiguration -DomainId $dom -IssuerUri $uri -PassiveSignInUri $url -SignOutUri $logouturl -SigningCertificate $cert -PreferredAuthenticationProtocol saml -federatedIdpMfaBehavior rejectMfaByFederatedIdp

9. To test the configuration, use the following command.
   Command to confirm the SSO setup

   Copy

   Get-MgDomainFederationConfiguration -DomainId $dom | Format-List

   Confirmation of SSO setup in Microsoft Entra ID
   Note: If you have already enabled Microsoft Entra ID SSO using another IdP or want to update Identity360' SSO settings, then you must first disable SSO in Microsoft Entra ID, and then follow the steps given in this guide. To disable SSO in Microsoft Entra ID, use the command given below:
   Command to confirm the SSO setup

   Copy

   $dom = "mycompany.com" 
   
   $federations = Get-MgDomainFederationConfiguration -DomainId $dom 
   
   Remove-MgDomainFederationConfiguration -DomainId $dom -InternalDomainFederationId $federations.Id

   Confirmation of SSO setup in Microsoft Entra ID

Please note that the above change may take some time to get implemented in Microsoft Entra ID.

Identity360 (identity provider) configuration steps

1. Switch back to Identity360's Integration Settings tab.
2. Enter the Relay State parameter, if necessary.
   Note: Relay State is an optional parameter used with a SAML message to help you remember where you were or to direct you to a specific page after logging in.
   Integration Settings of SSO configuration for Entra ID
3. Click Save.

To learn how to assign users and groups to one or more applications, refer to this page.

Your users should now be able to log in to Entra ID through the Identity360 portal.