SSO Azure Onboarding

Purpose

Step-by-step Azure Entra ID SAML onboarding for SailPoint Entro.

Complete the following:

1. Request SSO support

   Request SSO support from SailPoint Entro Support. Provide tenant name and allowed domains.

2. Receive SP metadata

   SailPoint Entro returns SP metadata or SP values (Entity ID, ACS, SLO).

3. Create application in Azure

   Microsoft Entra ID → Enterprise applications → New application → Create your own application (Non-gallery).

4. Configure SAML single sign-on

   Set up Single sign-on → SAML → Edit.

5. Add Identifier (Entity ID)

   Add Identifier (Entity ID) = SP Entity ID (from SailPoint Entro).

6. Add Reply URL (ACS)

   Add Reply URL (ACS) = SP Reply URL (from SailPoint Entro).

7. Download certificate

   Save and download Certificate (Base64) from SAML Certificates.

8. Provide Azure endpoints to SailPoint Entro

   Copy Login URL and Microsoft Entra Identifier to SailPoint Entro onboarding form.

9. Configure Attributes & Claims

   Configure Attributes & Claims:

   • email to user.mail or user.userPrincipalName

   • givenName to givenName

   • familyName to surname

   • groups to optional group claim

10. Assign users and groups

    Users and groups → Add user/group → Select → Assign.

11. Notify SailPoint Entro Support

    Notify SailPoint Entro Support and request activation.

12. Test

    Test in incognito. Capture SAML assertion with tracer if issues.

What to Send to SailPoint Entro

• Metadata XML or metadata URL

• Certificate (Base64) PEM

• Login URL

• Microsoft Entra Identifier

• Allowed domains

• Attribute mapping examples

• Test user email and time