---
title: 'Tutorial: How to Configure SAML with Entra ID'
canonical: https://openvpn.net/as-docs/tutorials/saml-entra-id/
product: Access Server Docs
description: A step-by-step guide for configuring SAML authentication on Access Server with Microsoft Entra ID (formerly Azure AD).
---

# Tutorial: How to Configure SAML with Entra ID

## Overview

Access Server 2.11 and newer supports authentication using SAML with Microsoft Entra ID as the identity provider. You can configure this in Entra ID with Access Server as your service provider.

The following steps walk you through enabling SAML authentication for users and groups from Entra ID to Access Server.

## Prerequisites

You need the following to get started:

- An [Entra ID tenant](https://learn.microsoft.com/en-us/entra/identity-platform/quickstart-create-new-tenant).
- A deployed [Access Server](https://openvpn.net/quick-start-guide/).

> **Important**
>
> We recommend using all lowercase usernames when signing in with SAML.

## Step 1: Create the Entra ID SSO application

With Entra ID, you must create a custom SAML application for SSO.

First, gather information about your Access Server as the service provider (SP).

1. Sign in to your Access Server Admin Web UI.
2. Select **Authentication → SAML**.
3. You'll need the following information:
   1. **SP Identity**.
   2. **SP ACS**.

Now that you have your SP information, you can create a new Entra ID SAML app and enter that information during app creation:

1. Sign in to your Azure portal as a global administrator.
2. Click to manage **Microsoft Entra ID**.
3. Click **Enterprise Applications** from the menu.
4. Click **+New application**.
5. Click **Create your own application**.
6. Enter a name for the application.
7. Select **Integrate any other application you don't find in the gallery** and click **Create**.
8. After the application is created, click **Set up Single Sign-On** under **Getting Started**.
9. Click **SAML** under **Select a single sign-on method**.
10. Click **Edit** for **Basic SAML Configuration**.
11. Use the SP information from Access Server to enter the following into the Entra ID SAML app configuration:
    - **Identifier (Entity ID):** Enter the Access Server **SP Identity**.
    - **Reply URL (Assertion Consumer Service URL):** Enter the Access Server **SP ACS**.
    - **Relay State (Optional):** Enter 'cws' for the Client Web UI or 'profile' to provide users with a downloadable profile. (See "How to set IdP-initiated flow" for details.)
12. Click **Save**.

Now, we need to assign users or groups that will be authenticated via SAML to the newly created app.

Then, you'll provide the Entra ID SAML app data to Access Server. The simplest way is to provide metadata through a URL (option 1) or downloaded file (option 2).

### Assign users or groups to SAML app

1. For the SAML app, select **Users and Groups** under **Manage** in the navigation menu.
2. Click **+ Add user/group**.
3. Click on **Non Selected** under **Users and Groups**.
4. Select users or groups you want to assign, click **Select**, then click **Assign**.

### Option 1: Copy the Entra ID metadata URL

1. Ensure you’re still in the **Single sign-on** section of your SAML app.
2. Under **SAML Certificates**, copy the **App Federation Metadata Url**.

### Option 2: Download the Entra ID metadata file

1. Ensure you’re still in the **Single sign-on** section of your SAML app.
2. Under **SAML Certificates**, locate the **Federation Metadata XML** and click **Download**.

## Step 2: Provide Entra ID metadata to Access Server

Now that you have the Entra ID metadata, you can provide it to Access Server, which can automatically populate information for the identity provider.

If you copied the URL, follow the steps below to paste it into the SAML page for Access Server. If you downloaded the XML file, follow the steps below to upload it to the SAML page for Access Server.

### Option 1: Paste the Entra ID metadata URL in the Admin Web UI

1. Sign in to the Admin Web UI.
2. Click **Authentication \> SAML**.
3. Click **Configure Identity Provider (IdP) Automatically via Metadata** to expand the section.
4. In the field, **IdP Metadata URL**, paste the URL you copied from Entra ID and click **Get** and **Update Running Server**.
   - The IdP fields are now populated under **Configure Identity Provider (IdP) Manually**.
5. [Enable SAML authentication](https://openvpn.net/as-docs/tutorials/tutorial--change-auth-mode-admin-web-ui.md).

### Option 2: Upload the Entra ID metadata file in the Admin Web UI

1. Sign in to the Admin Web UI.
2. Click **Authentication \> SAML**.
3. Click **Configure Identity Provider (IdP) Automatically via Metadata** to expand the section.
4. In the field, **Select IdP Metadata**, click **Choose File** to upload the XML file you downloaded from Entra ID, then click **Upload** and **Update Running Server**.
   - The IdP fields are now populated under **Configure Identity Provider (IdP) Manually**.
5. [Enable SAML authentication](https://openvpn.net/as-docs/tutorials/tutorial--change-auth-mode-admin-web-ui.md).

After saving, you should see the following data populated automatically by either the URL or the XML file:

- IdP EntityId.
- Sign On Endpoint.
- Certificate (PEM format).

## Step 3: Assign SAML as user authentication

Once you’ve provided the SAML configuration for your IdP, you can enable it for users.

1. Sign in to the Admin Web UI.
2. Select **Authentication → SAML**.
3. Select the toggle to turn on **Enable SAML authentication**.
4. Select **Save Settings** and **Update Running Server**.

You can now enable SAML as the [global default authentication](https://openvpn.net/as-docs/tutorials/saml-default-auth.md) or for [specific groups and users](https://openvpn.net/as-docs/tutorials/saml-users-groups.md).

## Optional: How to set up IdP-initiated flow

You can configure an IdP-initiated flow for signing into Access Server from their [Azure My Apps portal](https://learn.microsoft.com/en-us/entra/identity/enterprise-apps/myapps-overview) with the following steps:

1. Sign in to the Azure portal.
2. Browse to **Identity \> Applications \> Enterprise applications**.
3. Select your SAML application.
4. Once the application loads, select **Single sign-on** from the left-hand menu.
5. Edit the **Basic SAML Configuration**.
6. Enter one of the following under **Relay State (Optional)**:
   1. **cws:** This directs your users to the Client Web UI after sign-in.
   2. **profile:** This directs your users to a profile download after sign-in.
7. Save changes.

Test that the option displays for your user (for example, using the 'cws' relay state):

1. Sign in to your Azure My Apps as a SAML user.
2. Find the SAML application linked with Access Server and click on it.
3. You should be directed to the Access Server Client Web UI without additional authentication requirements.

## Optional: Map group access control

You can automate group assignments for access control rules using a post-authentication Python script.

Refer to the steps in this tutorial:

- [Tutorial: How to Set Up SAML Group Mapping with a Post-Auth Script](https://openvpn.net/as-docs/tutorials/tutorial--post-auth-saml-group-mapping.md)

---

Prev: [SAML Integration](https://openvpn.net/as-docs/tutorials/saml.md)
Next: [Tutorial: How to Configure SAML with Google Workspace for VPN Authentication](https://openvpn.net/as-docs/tutorials/saml-google-workspace.md)
Index: https://openvpn.net/as-docs/llms.txt