--- title: 'Tutorial: Authenticate Using SAML with Microsoft Entra ID' canonical: https://openvpn.net/cloud-docs/tutorials/configuration-tutorials/authentication/saml/tutorial--authenticate-using-saml-with-microsoft-entra-id/ product: CloudConnexa Docs description: Configure Microsoft Entra ID as a SAML identity provider for CloudConnexa using the SAML Setup Wizard — covers sharing SP metadata, creating the Entra enterprise app, mapping fixed URI claims, testing the connection, and setting up optional User Group Mapping and SCIM. keywords: Microsoft Entra ID --- # Tutorial: Authenticate Using SAML with Microsoft Entra ID ## Overview Configure Microsoft Entra ID (formerly Azure Active Directory) as a SAML 2.0 identity provider (IdP) for CloudConnexa using the SAML Setup Wizard. This lets your users authenticate to CloudConnexa with their Microsoft Entra ID credentials. You'll create an enterprise application in Microsoft Entra ID, exchange configuration details between Microsoft Entra ID and CloudConnexa, review user attribute mappings, and test authentication before completing the setup. ## Before you begin You need: - **CloudConnexa:** The Owner or Administrator role for the WPC you're configuring. - **Microsoft Entra ID:** The Cloud Application Administrator or Application Administrator role. - **Microsoft Entra ID P1 or P2:** Required if you plan to assign application access through groups. - **Access to both administration portals:** Keep both open while you configure SAML because you'll exchange values between them. > **Note** > > If you manage multiple WPCs, ensure you're configuring the correct Cloud ID. Each WPC has its own SAML authentication configuration. ## Step 1: Start the SAML Setup Wizard Start by selecting Microsoft Entra ID as your IdP in CloudConnexa. 1. Sign in to your WPC's Administration portal at your **Cloud ID** address (for example, `yourcompany.openvpn.com`). 2. Navigate to **Settings → User Authentication**. 3. Select **Edit**. 4. On the **SAML Single Sign-On** card, select **Setup**. 5. Under **Select Your Identity Provider**, select **Microsoft Entra ID**. - The wizard displays the configuration instructions and default attribute mappings for Microsoft Entra ID. > **Tip** > > If you selected the wrong provider, select **Change** next to **Your Identity Provider** on the next screen. ## Step 2: Get the service provider values for CloudConnexa Microsoft Entra ID needs service provider (SP) values from CloudConnexa to send SAML authentication responses to the correct WPC. 1. Under **Share CloudConnexa Metadata**, select **Download**. - The metadata file (.xml) downloads to your machine. 2. Or, you can copy the following values: | **CloudConnexa value** | **Use in Microsoft Entra ID** | **Format** | | --- | --- | --- | | Single Sign-On URL (ACS) | Reply URL (Assertion Consumer Service URL) | `https://sso-backend.openvpn.com/sso/api/v1/saml/acs` | | Issuer Name | Identifier (Entity ID) | `.openvpn.com` | > **Tip** > > The ACS URL is the same for every CloudConnexa WPC. > > For the Issuer Name, the `` is replaced with your WPC's Cloud ID prefix. 3. Keep the wizard open. You'll return to it after configuring Microsoft Entra ID. For more information, refer to [SAML and SCIM Service Provider Endpoints for CloudConnexa](https://openvpn.net/cloud-docs/owner/settings/settings---user-authentication/saml-and-scim-service-provider-endpoints-for-cloudconnexa.md). ## Step 3: Create an enterprise application in Microsoft Entra ID Create a non-gallery enterprise application to connect Microsoft Entra ID to CloudConnexa. 1. Sign in to the [Microsoft Entra admin center](https://entra.microsoft.com/). 2. Navigate to **Entra ID → Enterprise applications**. 3. Select **New application**. 4. Select **Create your own application**. 5. Enter a name for your app. 6. Select **Integrate any other application you don't find in the gallery (Non-gallery)**. 7. Select **Create**. 8. Under **Getting Started** for the new app, select **Get started** for **2. Set up single sign-on**. 9. Select **SAML** as the method. ### Configure the service provider details Configure the SAML application using the values from CloudConnexa. 1. Select **Upload metadata file** at the top of the SAML setup page. 2. Select the XML file downloaded in Step 2 and select **Add** to upload it. 3. Review the populated fields from the XML file in the **Basic SAML Configuration** panel and select **Save**. - The **Basic SAML Configuration** card displays the configured values. 1. Alternatively, you can edit **Basic SAML Configuration** and manually enter the values: | **Microsoft Entra ID field** | | | --- | --- | | Identifier (Entity ID) | **Issuer Name** from Step 2 | | Reply URL (Assertion Consumer Service URL) | **Single Sign-On URL (ACS)** from Step 2 | 2. Save the configuration. ### Review user attributes and claims Microsoft Entra ID sends user information through SAML claims. 1. Locate the **Attributes & Claims** card and select **Edit**. 2. Review the configured claims and verify that the application sends the email, username, first name, and last name information required by CloudConnexa. - You'll review the claim names and their mappings in Step 5. ### Optional: Include group membership in SAML assertions If you want CloudConnexa to assign users to user groups based on their Microsoft Entra ID group membership, configure a group claim. 1. From the **Attributes & Claims** page, select **Add a group claim**. 2. Select the groups you want to include in the SAML assertion. 3. Set **Source attribute** to **Group ID**. 4. Save the configuration. - With **Group ID** selected, Microsoft Entra ID sends group object IDs rather than display names. For example, a group named `Engineering` might be represented by a GUID such as `a3d1f920-7b6e-4d15-9c72-8e3f10b6a245` > **Tip** > > When configuring CloudConnexa user group mapping rules, use the actual group object IDs from Microsoft Entra ID rather than the group names. > **Note** > > Microsoft Entra ID limits the number of groups included in SAML assertions. If users belong to many groups, consider configuring the claim to include only groups assigned to the application. ### Assign users or groups to the application Users need access to the enterprise application before they can authenticate to CloudConnexa. 1. Open **Users and groups** for the enterprise application. 2. Select **Add user/group**. 3. Assign the users or groups who need CloudConnexa access. > **Note** > > Assigning application access through groups requires Microsoft Entra ID P1 or P2 licensing. ### Retrieve the Microsoft Entra ID metadata URL 1. Open **Single Sign-on** for the enterprise application. 2. Under **SAML Certificates**, locate **App Federation Metadata Url**. 3. Copy the URL. - You'll use this URL to connect Microsoft Entra ID to CloudConnexa. ## Step 4: Connect Microsoft Entra ID to CloudConnexa Now provide the Microsoft Entra ID SAML configuration to CloudConnexa. 1. Return to the SAML Setup Wizard in CloudConnexa. 2. Select **Next Step**. - **Provide Microsoft Entra ID Details** is displayed. 3. Paste the **App Federation Metadata Url** copied from Microsoft Entra ID into **IdP Federation Metadata URL**. > **Tip** > > Using the metadata URL lets CloudConnexa retrieve the identity provider configuration without manually entering the authentication endpoint and signing certificate. 4. Wait for CloudConnexa to retrieve the metadata. 5. Verify that the wizard displays **Metadata retrieved**, along with the issuer and signing certificate expiration date. 6. Leave **Advanced Settings** at their defaults. 7. Select **Next Step**. > **Note** > > You can also provide a metadata XML document or enter the identity provider details manually. Use these alternatives if the metadata URL isn't available or can't be retrieved. ## Step 5: Map user attributes CloudConnexa uses SAML claims to identify users and retrieve their information from Microsoft Entra ID. The **Map User Attributes** step displays after you select **Next Step**. The wizard provides default Microsoft Entra ID mappings. Unlike the short attribute names commonly used in Okta and JumpCloud, Microsoft Entra ID uses URI-based claim names. 1. Enable **Allow user attributes mapping (Optional)**. 2. Review the default mappings for JumpCloud. | **CloudConnexa field** | **Microsoft Entra ID SAML claim** | | --- | --- | | Email Address | ``` http://schemas.xmlsoap.org/ws/2005/05/identity/claims/emailaddressemail ``` | | Username | ``` http://schemas.xmlsoap.org/ws/2005/05/identity/claims/name ``` | | Group | ``` http://schemas.microsoft.com/ws/2008/06/identity/claims/groups ``` | | First Name | ``` http://schemas.xmlsoap.org/ws/2005/05/identity/claims/givenname ``` | | Last Name | ``` http://schemas.xmlsoap.org/ws/2005/05/identity/claims/surname ``` | 3. Compare the mappings with the claim names configured under **Attributes & Claims** in Microsoft Entra ID. 4. If the default values match, leave them unchanged. 5. If your application sends different claim names, update the corresponding fields. Ensure each mapping matches the complete claim URI, including capitalization. 6. Select **Next Step**. > **Tip** > > For group mapping, the group claim contains Microsoft Entra ID group object IDs when **Source attribute** is set to **Group ID**. Use these IDs when creating CloudConnexa user group mapping rules. ## Step 6: Test SAML authentication Test the connection before completing the configuration to confirm that CloudConnexa can authenticate users through Microsoft Entra ID. 1. In the wizard, the **Test Microsoft Entra ID Connection** step displays. 2. Select **Sign in With SAML SSO**. 3. Authenticate using a Microsoft Entra ID account assigned to the enterprise application. 4. Review the test results. CloudConnexa checks the SAML response for: - A response received at the ACS endpoint. - A valid signature. - An issuer that matches the configuration. - An audience that matches the SP Entity ID. - An assertion timestamp within the allowed clock skew. 5. The wizard shows whether each check passed or failed. ### Verify the user attributes 1. The test also displays the user information received from Microsoft Entra ID: - Email - First Name - Last Name - IdP Group - Username 2. If a field displays `-`, CloudConnexa didn't receive a value under the expected claim name. Compare the claims in Microsoft Entra ID with the mappings from Step 5. > **Tip** > > Test with an account in a group you plan to map. This lets you verify that Microsoft Entra ID sends the expected group object ID. > **Note** > > A successful test confirms authentication for the account you used. It doesn't verify every user in your directory. ### If the test fails 1. Review the check. 2. Correct the configuration. 3. Select **Run Test Again**. - Although the wizard allows you to continue after a failed test, we recommend resolving the errors before completing setup. Otherwise, users may be unable to authenticate. ## Step 7: Review and complete the configuration The **Configuration Details** step summarizes the SAML settings you've configured. 1. Review the following information: | **Setting** | **What to verify** | | --- | --- | | Metadata Source | How CloudConnexa retrieves the Microsoft Entra ID configuration | | Attributes Mapped | The number of configured attribute mappings | | Issuer | The issuer value received from Microsoft Entra ID | | Signing Certificate | Certificate validity and expiration date | 2. You can also review the advanced settings, including Data Binding, Authentication Lifetime, Reconnecting, Authentication Context, and Logout URL. - The wizard may display additional setup options for user group mapping and SCIM provisioning. 3. When you're satisfied with the configuration, select **Complete**. - Your SAML configuration is now available for users who have access to the custom SAML app in Microsoft Entra ID. ## Optional: Configure user group mapping If you want CloudConnexa to assign users to user groups based on their IdP group membership, configure SAML user group mapping. 1. In the CloudConnexa Administration portal, navigate to **Settings → User Authentication → SAML Single Sign-On → Configuration → User Group Mapping**. 2. Configure mapping rules for the group information the IdP sends. For detailed instructions, refer to [Set SAML User Group Mapping Rules](https://openvpn.net/cloud-docs/owner/settings/settings---user-authentication/set-saml-single-sign-on-user-group-mapping-rules.md). Group mapping is evaluated when users authenticate. If you change a user's group membership in the IdP, the updated mapping takes effect the next time they authenticate to CloudConnexa. ## Optional: Configure SCIM provisioning SAML authenticates users when they access CloudConnexa. You can also configure System for Cross-domain Identity Management (SCIM) 2.0 to automate user provisioning. With SCIM provisioning, the IdP can create, update, and deactivate users in CloudConnexa without waiting for authentication. 1. To configure SCIM, navigate to **Settings → User Authentication → SAML Single Sign-On → Configuration → SCIM 2.0**. > **Note** > > SCIM provisions users, not user groups. Group membership still comes from SAML group claims and your user group mapping rules. ## Manage your SAML configuration After completing the wizard, you can review or change your configuration under **Settings → User Authentication → SAML Single Sign-On → Configuration**. | **Configuration** | **What you can manage** | | --- | --- | | IdP Configuration | Microsoft Entra ID metadata, SSO endpoint, issuer, and signing certificate | | Attribute Mapping | How Microsoft Entra ID claims map to CloudConnexa user fields | | User Group Mapping | Rules for assigning CloudConnexa user groups | | SCIM 2.0 | Automatic user provisioning | ## Troubleshooting Use these checks if authentication fails or CloudConnexa doesn't receive the expected user information. | Issue | Likely cause | What to check | | --- | --- | --- | | The test reports that it didn't receive a response at the ACS endpoint. | Microsoft Entra ID sent the response to a different URL or didn't use HTTP POST. | Verify that **Reply URL (Assertion Consumer Service URL)** matches the **Single Sign-On URL (ACS)** from Step 2. | | The test reports a signature failure. | The signing certificate configured in CloudConnexa doesn't match the certificate Microsoft Entra ID is using. | Refresh the identity provider metadata under **IdP Configuration**. | | The test reports an issuer mismatch. | The issuer configured in CloudConnexa doesn't match the issuer Microsoft Entra ID sends. | Compare the issuer shown in Step 7 with the value in the Microsoft Entra admin center. | | The test reports an audience mismatch. | Microsoft Entra ID has an incorrect **Identifier (Entity ID)**. | Verify that **Identifier (Entity ID)** matches the **Issuer Name** from Step 2. | | The test reports a timestamp failure. | The assertion has expired or its validity period doesn't match the allowed clock skew. | Retry the test. If it continues to fail, investigate the assertion timestamps and clock synchronization. | | The user authenticates but has no name or email. | The SAML attributes are missing or use different names from the CloudConnexa mappings. | Compare the **Service Provider Attribute Names** in JumpCloud with the mappings in Step 5. | | The user isn't assigned to the expected CloudConnexa user group. | The group claim isn't included in the assertion or no matching mapping rule exists. | Verify the group claim, its **Source attribute**, and the CloudConnexa user group mapping rules. | | Authentication worked previously but now fails. | The Microsoft Entra ID signing certificate expired or changed. | Check the certificate expiration date and refresh the metadata under **IdP Configuration**. | | The user can't access the enterprise application. | The user isn't assigned to the application in Microsoft Entra ID. | Open **Users and groups** and assign the user or an appropriate group. | | Group mapping doesn't work for cloud-only groups. | The group claim uses an on-premises group attribute instead of a group object ID. | Set **Source attribute** to **Group ID** and configure CloudConnexa mapping rules using the group object IDs. | | The group claim is missing for users with many memberships. | The user exceeds the SAML group limit of 150, so Microsoft Entra ID omits the normal group claim. | Consider limiting the group claim to groups assigned to the application. | | SCIM provisioning enters quarantine. | Provisioning credentials are invalid or repeated provisioning failures have occurred. | Review **Provisioning logs** in Microsoft Entra ID, correct the underlying issue, and restart provisioning when appropriate. | | Testing from Microsoft Entra ID fails, but testing from CloudConnexa works. | The Microsoft Entra ID test initiates authentication from the identity provider and might require Relay State. | Test from the CloudConnexa SAML Setup Wizard. Review Relay State requirements if users need to initiate authentication from Microsoft Entra ID. | | Microsoft Entra ID returns `AADSTS75011` during the SAML authentication test. | The authentication method used in Microsoft Entra ID doesn't match the password-based authentication context requested by CloudConnexa. | In the CloudConnexa SAML Setup Wizard, expand **Advanced Settings**. Under **Authentication context**, select **Allow passwordless or certificate-based IdP authentication method**. Run the authentication test again. | ## Related resources - [SAML and SCIM Service Provider Endpoints for CloudConnexa](https://openvpn.net/cloud-docs/owner/settings/settings---user-authentication/saml-and-scim-service-provider-endpoints-for-cloudconnexa.md) - [Set SAML Single Sign-On Authentication for Users](https://openvpn.net/cloud-docs/owner/settings/settings---user-authentication/set-saml-single-sign-on-authentication-for-users.md) - [Set SAML User Group Mapping Rules](https://openvpn.net/cloud-docs/owner/settings/settings---user-authentication/set-saml-single-sign-on-user-group-mapping-rules.md) - [About Multiple Authentication Methods](https://openvpn.net/cloud-docs/owner/settings/settings---user-authentication/about-multiple-authentication-methods.md) - [Video: Configure Authentication With SAML and Okta](https://openvpn.net/cloud-docs/videos/configuration/authentication/video--configure-authentication-with-saml-and-okta.md) - [SAML authentication with CloudConnexa](https://openvpn.net/connect-docs/tutorials/saml-with-cloudconnexa.md) --- Prev: [SAML](https://openvpn.net/cloud-docs/tutorials/configuration-tutorials/authentication/saml.md) Next: [Tutorial: Authenticate Using SAML with Google Workspace](https://openvpn.net/cloud-docs/tutorials/configuration-tutorials/authentication/saml/tutorial--authenticate-using-saml-with-google-workspace.md) Index: https://openvpn.net/cloud-docs/llms.txt