Tutorial: How to Configure SAML with Entra ID⁠

You need the following to get started:

• An Entra ID tenant.

• A deployed Access Server.

With Entra ID, you must create a custom SAML application for SSO.

First, gather information about your Access Server as the service provider (SP).

1. Sign in to your Access Server Admin Web UI.

2. Select Authentication → SAML.

3. You'll need the following information:

   1. SP Identity.

   2. SP ACS.

Now that you have your SP information, you can create a new Entra ID SAML app and enter that information during app creation:

1. Sign in to your Azure portal as a global administrator.

2. Click to manage Microsoft Entra ID.

3. Click Enterprise Applications from the menu.

4. Click +New application.

5. Click Create your own application.

6. Enter a name for the application.

7. Select Integrate any other application you don't find in the gallery and click Create.

8. After the application is created, click Set up Single Sign-On under Getting Started.

9. Click SAML under Select a single sign-on method.

10. Click Edit for Basic SAML Configuration.

11. Use the SP information from Access Server to enter the following into the Entra ID SAML app configuration:

    • Identifier (Entity ID): Enter the Access Server SP Identity.

    • Reply URL (Assertion Consumer Service URL): Enter the Access Server SP ACS.

    • Relay State (Optional): Enter 'cws' for the Client Web UI or 'profile' to provide users with a downloadable profile. (See "How to set IdP-initiated flow" for details.)

12. Click Save.

Now, we need to assign users or groups that will be authenticated via SAML to the newly created app.

Then, you'll provide the Entra ID SAML app data to Access Server. The simplest way is to provide metadata through a URL (option 1) or downloaded file (option 2).

Now that you have the Entra ID metadata, you can provide it to Access Server, which can automatically populate information for the identity provider.

If you copied the URL, follow the steps below to paste it into the SAML page for Access Server. If you downloaded the XML file, follow the steps below to upload it to the SAML page for Access Server.

You can now enable SAML as the global default authentication or for specific groups and users.

You can configure an IdP-initiated flow for signing into Access Server from their Azure My Apps portal with the following steps:

1. Sign in to the Azure portal.

2. Browse to Identity > Applications > Enterprise applications.

3. Select your SAML application.

4. Once the application loads, select Single sign-on from the left-hand menu.

5. Edit the Basic SAML Configuration.

6. Enter one of the following under Relay State (Optional):

   1. cws: This directs your users to the Client Web UI after sign-in.

   2. profile: This directs your users to a profile download after sign-in.

7. Save changes.

Test that the option displays for your user (for example, using the 'cws' relay state):

1. Sign in to your Azure My Apps as a SAML user.

2. Find the SAML application linked with Access Server and click on it.

3. You should be directed to the Access Server Client Web UI without additional authentication requirements.

You can automate group assignments for access control rules using a post-authentication Python script.

Refer to the steps in this tutorial:

• Tutorial: How to Set Up SAML Group Mapping with a Post-Auth Script