Steps to configure SAML SSO for Microsoft Entra ID

About Microsoft Entra ID

Microsoft Entra ID, previously known as Azure Active Directory (Azure AD), is a cloud-based identity and access management (IAM) solution that enables organizations to manage user identities and access permissions securely. Microsoft Entra ID provides users with a range of functionalities for efficient and secure access to organizational resources.

The following steps will help you enable SAML-based single sign-on (SSO) for Entra ID from Identity360.

Prerequisites

Updating the ImmutableID value in Entra ID

To enable SSO to Entra ID through Identity360, it is mandatory to have the ImmutableID attribute as the unique identifier in Entra ID. You can create new users with the ImmutableID attribute or update existing users' ImmutableID attribute value in Entra ID using the following PowerShell commands.

         
             
Connect-MsolService 
             
New-MsolUser -UserPrincipalName "<user_principal_name>" -ImmutableId "<immutable_id>" -DisplayName "<display_name>" -FirstName "<first_name>" -LastName "<last_name>" -LicenseAssignment "<service_pack>" -UsageLocation "<location>"
         
     

         
             
Connect-MsolService
             
Set-Msoluser -UserPrincipalName "<user_principal_name>" -ImmutableID “<immutable_id> ”
         
     

Get-MsolUser -UserPrincipalName "<user_mailID>"  | select userprincipalname, Immutableid

1. PowerShell access with administrative rights is required in order to set up SSO in Entra ID.
2. The MFA and SSO license for Identity360 is required to enable SSO for enterprise applications. For more information, refer to the pricing details.
3. Log in to Identity360 as an Admin or Super Admin, or Technician with a role that has Application Integration and Single Sign-on permissions.
4. Navigate to Applications > Application Integration > Create New Application and select Azure Active Directory from the applications displayed.
   Note: You can also find Azure Active Directory from the search bar located at the top.
5. Under the General Settings tab, enter the Application Name and Description.
6. Under Choose Capabilities, select SSO, then click Continue.
   General Settings of SSO configuration for Entra ID
7. Under Integration Settings, navigate to the Single Sign On tab and click Metadata Details.
8. Copy the Login URL, Logout URL, Entity ID/Issuer URL, and Signing Certificate values, which will be used during the configuration of Entra ID.
   Integration Settings of SSO configuration for Entra ID

Entra ID (service provider) configuration steps

1. Open PowerShell with admin rights.
2. Connect with MsolService using the following command.
   Command to connect with MsolService

   Copy

   Connect-MsolService

3. Use this command to get the list of domains available.
   Command to fetch the list of domains

   Copy

   Get-MsolDomain

4. Enter the domain for which you would like to enable SSO.
   Command to enable SSO for the domain

   Copy

   $dom = "mycompany.com"

5. Enter the Login URL, Entity ID/Issuer URL, and Logout URL values copied from Step 7 of the prerequisites for the $url, $uri, and $logouturl commands respectively.

   $url = "<login URL value>"

   For example, $url = "https://id360.manageengine.com/iamapps/ssologin/AZURE_DIRECTORY/0f60f225259698fa55c235f7ab956cc40012e8db"

   $uri = "<login URL value>"

   For example, $uri = "https://id360.manageengine.com:8443/iamapps/ssologin/AZURE_DIRECTORY/ab6ca4dcfb2c1b18a8d2dcaa34346fd90c42b3f9"

   $logouturl = "<logout URL value>"

   For example, $logouturl = "https://id360.manageengine.com/iamapps/ssologout/AZURE_DIRECTORY/0f60f225259698fa55c235f7ab956cc40012e8db"

6. Now paste the Signing Certificate file copied from Step 7 of the prerequisites for the command mentioned below.

   $cert = "<SSO certificate file>"

   For example, $cert = "MIICqjCCAhOgAwIBAgIJAN..........dTOjFfqqA="

   Configuring Identity360's SSO in Microsoft Entra ID
7. Run the following command to enable SSO in Entra ID.
   Command to enable SSO in Entra ID

   Copy

   Set-MsolDomainAuthentication -DomainName $dom -FederationBrandName $dom -Authentication Federated -PassiveLogOnUri $url -SigningCertificate $cert -IssuerUri $uri -LogOffUri $logouturl -PreferredAuthenticationProtocol SAMLP

8. Execute the command below to confirm the SSO setup by verifying the Login URL, Logout URL, Entity ID/Issuer URL, and Signing certificate values that were configured previously.
   Command to confirm the SSO setup

   Copy

   Get-MSolDomainFederationSettings -DomainName "mycompany.com" | Format-List *

   Note: The completion of the SSO configuration will take time. Once it is set up, users will be able to sign in using SSO.
   Confirmation of SSO setup in Microsoft Entra ID
9. Reconfigure or update SSO settings: If you are already using SSO for Entra ID from another IdP or want to update Identity360 SSO settings, you must first disable SSO in Entra ID, then proceed with the reconfiguration by referring to step 2 in this guide. To disable SSO in Entra ID, use the command given below.
   Command to reconfigure SSO in Entra ID

   Copy

   $dom = "mycompany.com" Set-MsolDomainAuthentication -DomainName $dom -FederationBrandName $dom -Authentication Managed

Identity360 (identity provider) configuration steps

1. Switch back to Identity360's Integration Settings tab.
2. Enter the Relay State parameter, if necessary.
   Note: Relay State is an optional parameter used with a SAML message to help you remember where you were or to direct you to a specific page after logging in.
   Integration Settings of SSO configuration for Entra ID
3. Click Save.

To learn how to assign users and groups to one or more applications, refer to this page.

Your users should now be able to log in to Entra ID through the Identity360 portal.