Tutorial: How to Configure SAML with Entra ID
A step-by-step guide for configuring SAML authentication on Access Server with Microsoft Entra ID (formerly Azure AD).
Overview
Access Server 2.11 and newer supports authentication using SAML with Microsoft Entra ID as the identity provider. You can configure this in Entra ID with Access Server as your service provider.
The following steps walk you through enabling SAML authentication for users and groups from Entra ID to Access Server.
You need the following to get started:
An Entra ID tenant.
A deployed Access Server.
Important
We recommend using all lowercase usernames when signing in with SAML.
With Entra ID, you must create a custom SAML application for SSO.
Now that you have your SP information, you can create a new Entra ID SAML app and enter that information during app creation:
Sign in to your Azure portal as a global administrator.
Click to manage Microsoft Entra ID.
Click Enterprise Applications from the menu.
Click +New application.
You can browse or search the Microsoft Entra Gallery.
Click Create your own application.
Enter a name for application.
Select Integrate any other application you don't find in the gallery and click Create.
After the application is created, click Set up Single Sign-On.
Click Edit for Basic SAML Configuration.
Use the SP information from Access Server to enter the following into the Entra ID SAML app configuration:
Identifier (Entity ID): Enter the Access Server SP Identity.
Reply URL (Assertion Consumer Service URL): Enter the Access Server SP ACS.
Relay State (Optional): Enter 'cws' for the Client Web UI or 'profile' to provide users with a downloadable profile. (See "How to set IdP-initiated flow" for details.)
Click Save.
Next, you provide the Entra ID SAML app data to Access Server. The simplest way is to provide metadata through a URL (first option) or downloaded file (second option).
Option 1: Copy the Entra ID metadata URL
Ensure you’re still in the Single sign-on section of your SAML app.
Under SAML Certificates, copy the App Federation Metadata Url.
Option 2: Download the Entra ID metadata file
Ensure you’re still in the Single sign-on section of your SAML app.
Under SAML Certificates, locate the Federation Metadata XML and click Download.
Now that you have the Entra ID metadata, you can provide it to Access Server, which can automatically populate information for the identity provider.
If you copied the URL, follow the steps below to paste it into the SAML page for Access Server. If you downloaded the XML file, follow the steps below to upload it to the SAML page for Access Server.
Option 1: Paste the Entra ID metadata URL in the Admin Web UI
Sign in to the Admin Web UI.
Click Authentication > SAML.
Click Configure Identity Provider (IdP) Automatically via Metadata to expand the section.
In the field, IdP Metadata URL, paste the URL you copied from Entra ID and click Get and Update Running Server.
The IdP fields are now populated under Configure Identity Provider (IdP) Manually.
Option 2: Upload the Entra ID metadata file in the Admin Web UI
Sign in to the Admin Web UI.
Click Authentication > SAML.
Click Configure Identity Provider (IdP) Automatically via Metadata to expand the section.
In the field, Select IdP Metadata, click Choose File to upload the XML file you downloaded from Entra ID, then click Upload and Update Running Server.
The IdP fields are now populated under Configure Identity Provider (IdP) Manually.
After saving, you should see the following data populated automatically by either the URL or the XML file:
IdP EntityId.
Sign On Endpoint.
Certificate (PEM format).
You can configure an IdP-initiated flow for signing into Access Server from their Azure My Apps portal with the following steps:
Sign in to the Azure portal.
Browse to Identity > Applications > Enterprise applications.
Select your SAML application.
Once the application loads, select Single sign-on from the left-hand menu.
Edit the Basic SAML Configuration.
Enter one of the following under Relay State (Optional):
cws: This directs your users to the Client Web UI after sign-in.
profile: This directs your users to a profile download after sign-in.
Save changes.
Test that the option displays for your user (for example, using the 'cws' relay state):
Sign in to your Azure My Apps as a SAML user.
Find the SAML application linked with Access Server and click on it.
You should be directed to the Access Server Client Web UI without additional authentication requirements.