Talk with SupportBook a DemoTry for free

Tutorial: Authenticate Using SAML with Microsoft Entra ID⁠

Overview⁠

Configure Microsoft Entra ID (formerly Azure Active Directory) as a SAML 2.0 identity provider (IdP) for CloudConnexa using the SAML Setup Wizard. This lets your users authenticate to CloudConnexa with their Microsoft Entra ID credentials.

You'll create an enterprise application in Microsoft Entra ID, exchange configuration details between Microsoft Entra ID and CloudConnexa, review user attribute mappings, and test authentication before completing the setup.

Before you begin⁠

You need:

  • CloudConnexa: The Owner or Administrator role for the WPC you're configuring.

  • Microsoft Entra ID: The Cloud Application Administrator or Application Administrator role.

  • Microsoft Entra ID P1 or P2: Required if you plan to assign application access through groups.

  • Access to both administration portals: Keep both open while you configure SAML because you'll exchange values between them.

Step 1: Start the SAML Setup Wizard⁠

Start by selecting Microsoft Entra ID as your IdP in CloudConnexa.

  1. Sign in to your WPC's Administration portal at your Cloud ID address (for example, yourcompany.openvpn.com).

  2. Navigate to Settings → User Authentication.

  3. Select Edit.

  4. On the SAML Single Sign-On card, select Setup.

  5. Under Select Your Identity Provider, select Microsoft Entra ID.

    • The wizard displays the configuration instructions and default attribute mappings for Microsoft Entra ID.

Step 2: Get the service provider values for CloudConnexa⁠

Microsoft Entra ID needs service provider (SP) values from CloudConnexa to send SAML authentication responses to the correct WPC.

  1. Under Share CloudConnexa Metadata, select Download.

    • The metadata file (.xml) downloads to your machine.

  2. Or, you can copy the following values:

    CloudConnexa value

    Use in Microsoft Entra ID

    Format

    Single Sign-On URL (ACS)

    Reply URL (Assertion Consumer Service URL)

    https://sso-backend.openvpn.com/sso/api/v1/saml/acs

    Issuer Name

    Identifier (Entity ID)

    <cloud-id>.openvpn.com

  3. Keep the wizard open. You'll return to it after configuring Microsoft Entra ID.

For more information, refer to SAML and SCIM Service Provider Endpoints for CloudConnexa.

Step 3: Create an enterprise application in Microsoft Entra ID⁠

Create a non-gallery enterprise application to connect Microsoft Entra ID to CloudConnexa.

  1. Sign in to the Microsoft Entra admin center.

  2. Navigate to Entra ID → Enterprise applications.

  3. Select New application.

  4. Select Create your own application.

  5. Enter a name for your app.

  6. Select Integrate any other application you don't find in the gallery (Non-gallery).

  7. Select Create.

  8. Under Getting Started for the new app, select Get started for 2. Set up single sign-on.

  9. Select SAML as the method.

Configure the service provider details⁠

Configure the SAML application using the values from CloudConnexa.

  1. Select Upload metadata file at the top of the SAML setup page.

  2. Select the XML file downloaded in Step 2 and select Add to upload it.

  3. Review the populated fields from the XML file in the Basic SAML Configuration panel and select Save.

    • The Basic SAML Configuration card displays the configured values.

  1. Alternatively, you can edit Basic SAML Configuration and manually enter the values:

    Microsoft Entra ID field

    Identifier (Entity ID)

    Issuer Name from Step 2

    Reply URL (Assertion Consumer Service URL)

    Single Sign-On URL (ACS) from Step 2

  2. Save the configuration.

Review user attributes and claims⁠

Microsoft Entra ID sends user information through SAML claims.

  1. Locate the Attributes & Claims card and select Edit.

  2. Review the configured claims and verify that the application sends the email, username, first name, and last name information required by CloudConnexa.

    • You'll review the claim names and their mappings in Step 5.

Optional: Include group membership in SAML assertions⁠

If you want CloudConnexa to assign users to user groups based on their Microsoft Entra ID group membership, configure a group claim.

  1. From the Attributes & Claims page, select Add a group claim.

  2. Select the groups you want to include in the SAML assertion.

  3. Set Source attribute to Group ID.

  4. Save the configuration.

    • With Group ID selected, Microsoft Entra ID sends group object IDs rather than display names. For example, a group named Engineering might be represented by a GUID such as a3d1f920-7b6e-4d15-9c72-8e3f10b6a245

Assign users or groups to the application⁠

Users need access to the enterprise application before they can authenticate to CloudConnexa.

  1. Open Users and groups for the enterprise application.

  2. Select Add user/group.

  3. Assign the users or groups who need CloudConnexa access.

Retrieve the Microsoft Entra ID metadata URL⁠

  1. Open Single Sign-on for the enterprise application.

  2. Under SAML Certificates, locate App Federation Metadata Url.

  3. Copy the URL.

    • You'll use this URL to connect Microsoft Entra ID to CloudConnexa.

Step 4: Connect Microsoft Entra ID to CloudConnexa⁠

Now provide the Microsoft Entra ID SAML configuration to CloudConnexa.

  1. Return to the SAML Setup Wizard in CloudConnexa.

  2. Select Next Step.

    • Provide Microsoft Entra ID Details is displayed.

  3. Paste the App Federation Metadata Url copied from Microsoft Entra ID into IdP Federation Metadata URL.

  4. Wait for CloudConnexa to retrieve the metadata.

  5. Verify that the wizard displays Metadata retrieved, along with the issuer and signing certificate expiration date.

  6. Leave Advanced Settings at their defaults.

  7. Select Next Step.

Step 5: Map user attributes⁠

CloudConnexa uses SAML claims to identify users and retrieve their information from Microsoft Entra ID.

The Map User Attributes step displays after you select Next Step. The wizard provides default Microsoft Entra ID mappings.

Unlike the short attribute names commonly used in Okta and JumpCloud, Microsoft Entra ID uses URI-based claim names.

  1. Enable Allow user attributes mapping (Optional).

  2. Review the default mappings for JumpCloud.

    CloudConnexa field

    Microsoft Entra ID SAML claim

    Email Address

    http://schemas.xmlsoap.org/ws/2005/05/identity/claims/emailaddressemail

    Username

    http://schemas.xmlsoap.org/ws/2005/05/identity/claims/name

    Group

    http://schemas.microsoft.com/ws/2008/06/identity/claims/groups

    First Name

    http://schemas.xmlsoap.org/ws/2005/05/identity/claims/givenname

    Last Name

    http://schemas.xmlsoap.org/ws/2005/05/identity/claims/surname

  3. Compare the mappings with the claim names configured under Attributes & Claims in Microsoft Entra ID.

  4. If the default values match, leave them unchanged.

  5. If your application sends different claim names, update the corresponding fields. Ensure each mapping matches the complete claim URI, including capitalization.

  6. Select Next Step.

Step 6: Test SAML authentication⁠

Test the connection before completing the configuration to confirm that CloudConnexa can authenticate users through Microsoft Entra ID.

  1. In the wizard, the Test Microsoft Entra ID Connection step displays.

  2. Select Sign in With SAML SSO.

  3. Authenticate using a Microsoft Entra ID account assigned to the enterprise application.

  4. Review the test results. CloudConnexa checks the SAML response for:

    • A response received at the ACS endpoint.

    • A valid signature.

    • An issuer that matches the configuration.

    • An audience that matches the SP Entity ID.

    • An assertion timestamp within the allowed clock skew.

  5. The wizard shows whether each check passed or failed.

Verify the user attributes⁠

  1. The test also displays the user information received from Microsoft Entra ID:

    • Email

    • First Name

    • Last Name

    • IdP Group

    • Username

  2. If a field displays -, CloudConnexa didn't receive a value under the expected claim name. Compare the claims in Microsoft Entra ID with the mappings from Step 5.

If the test fails⁠

  1. Review the check.

  2. Correct the configuration.

  3. Select Run Test Again.

    • Although the wizard allows you to continue after a failed test, we recommend resolving the errors before completing setup. Otherwise, users may be unable to authenticate.

Step 7: Review and complete the configuration⁠

The Configuration Details step summarizes the SAML settings you've configured.

  1. Review the following information:

    Setting

    What to verify

    Metadata Source

    How CloudConnexa retrieves the Microsoft Entra ID configuration

    Attributes Mapped

    The number of configured attribute mappings

    Issuer

    The issuer value received from Microsoft Entra ID

    Signing Certificate

    Certificate validity and expiration date

  2. You can also review the advanced settings, including Data Binding, Authentication Lifetime, Reconnecting, Authentication Context, and Logout URL.

    • The wizard may display additional setup options for user group mapping and SCIM provisioning.

  3. When you're satisfied with the configuration, select Complete.

    • Your SAML configuration is now available for users who have access to the custom SAML app in Microsoft Entra ID.

Optional: Configure user group mapping⁠

If you want CloudConnexa to assign users to user groups based on their IdP group membership, configure SAML user group mapping.

  1. In the CloudConnexa Administration portal, navigate to Settings → User Authentication → SAML Single Sign-On → Configuration → User Group Mapping.

  2. Configure mapping rules for the group information the IdP sends.

For detailed instructions, refer to Set SAML User Group Mapping Rules.

Group mapping is evaluated when users authenticate. If you change a user's group membership in the IdP, the updated mapping takes effect the next time they authenticate to CloudConnexa.

Optional: Configure SCIM provisioning⁠

SAML authenticates users when they access CloudConnexa. You can also configure System for Cross-domain Identity Management (SCIM) 2.0 to automate user provisioning.

With SCIM provisioning, the IdP can create, update, and deactivate users in CloudConnexa without waiting for authentication.

  1. To configure SCIM, navigate to Settings → User Authentication → SAML Single Sign-On → Configuration → SCIM 2.0.

Manage your SAML configuration⁠

After completing the wizard, you can review or change your configuration under Settings → User Authentication → SAML Single Sign-On → Configuration.

Configuration

What you can manage

IdP Configuration

Microsoft Entra ID metadata, SSO endpoint, issuer, and signing certificate

Attribute Mapping

How Microsoft Entra ID claims map to CloudConnexa user fields

User Group Mapping

Rules for assigning CloudConnexa user groups

SCIM 2.0

Automatic user provisioning

Troubleshooting⁠

Use these checks if authentication fails or CloudConnexa doesn't receive the expected user information.

Issue

Likely cause

What to check

The test reports that it didn't receive a response at the ACS endpoint.

Microsoft Entra ID sent the response to a different URL or didn't use HTTP POST.

Verify that Reply URL (Assertion Consumer Service URL) matches the Single Sign-On URL (ACS) from Step 2.

The test reports a signature failure.

The signing certificate configured in CloudConnexa doesn't match the certificate Microsoft Entra ID is using.

Refresh the identity provider metadata under IdP Configuration.

The test reports an issuer mismatch.

The issuer configured in CloudConnexa doesn't match the issuer Microsoft Entra ID sends.

Compare the issuer shown in Step 7 with the value in the Microsoft Entra admin center.

The test reports an audience mismatch.

Microsoft Entra ID has an incorrect Identifier (Entity ID).

Verify that Identifier (Entity ID) matches the Issuer Name from Step 2.

The test reports a timestamp failure.

The assertion has expired or its validity period doesn't match the allowed clock skew.

Retry the test. If it continues to fail, investigate the assertion timestamps and clock synchronization.

The user authenticates but has no name or email.

The SAML attributes are missing or use different names from the CloudConnexa mappings.

Compare the Service Provider Attribute Names in JumpCloud with the mappings in Step 5.

The user isn't assigned to the expected CloudConnexa user group.

The group claim isn't included in the assertion or no matching mapping rule exists.

Verify the group claim, its Source attribute, and the CloudConnexa user group mapping rules.

Authentication worked previously but now fails.

The Microsoft Entra ID signing certificate expired or changed.

Check the certificate expiration date and refresh the metadata under IdP Configuration.

The user can't access the enterprise application.

The user isn't assigned to the application in Microsoft Entra ID.

Open Users and groups and assign the user or an appropriate group.

Group mapping doesn't work for cloud-only groups.

The group claim uses an on-premises group attribute instead of a group object ID.

Set Source attribute to Group ID and configure CloudConnexa mapping rules using the group object IDs.

The group claim is missing for users with many memberships.

The user exceeds the SAML group limit of 150, so Microsoft Entra ID omits the normal group claim.

Consider limiting the group claim to groups assigned to the application.

SCIM provisioning enters quarantine.

Provisioning credentials are invalid or repeated provisioning failures have occurred.

Review Provisioning logs in Microsoft Entra ID, correct the underlying issue, and restart provisioning when appropriate.

Testing from Microsoft Entra ID fails, but testing from CloudConnexa works.

The Microsoft Entra ID test initiates authentication from the identity provider and might require Relay State.

Test from the CloudConnexa SAML Setup Wizard. Review Relay State requirements if users need to initiate authentication from Microsoft Entra ID.

Microsoft Entra ID returns AADSTS75011 during the SAML authentication test.

The authentication method used in Microsoft Entra ID doesn't match the password-based authentication context requested by CloudConnexa.

In the CloudConnexa SAML Setup Wizard, expand Advanced Settings. Under Authentication context, select Allow passwordless or certificate-based IdP authentication method. Run the authentication test again.

© 2026 OpenVPN Inc. | OpenVPN is a registered trademark of OpenVPN, Inc. | CloudConnexa is a registered trademark of OpenVPN, Inc.

Service StatusPrivacy PolicyLegal