TR: 📱 Implementing Microsoft Entra SAML SSO for Mobile (MAUI)

This article outlines the configuration of SAML-based Single Sign-On (SSO) for a mobile application built with MAUI, using Microsoft Entra ID. It is intended for IT administrators integrating mobile apps with Microsoft Entra.

⚠️ Note: Web and Mobile configurations require separate Enterprise Applications. They cannot be merged.

 

🔹 Step 1: Access Microsoft Entra Admin Portal

• Visit 
• Navigate to Microsoft Entra ID

 

🔹 Step 2: Create a New Enterprise Application

1. Go to Enterprise Applications
2. Click + New Application
3. Select Create your own application
4. Name the app (e.g., “Transcendent Mobile SSO” — include “Mobile” to distinguish it)
5. Click Create

 

🔹 Step 3: Configure Single Sign-On

1. In the app overview, select Single Sign-On
2. Choose SAML as the sign-on method
3. Fill in the Basic SAML Configuration:
   • Identifier (Entity ID): maui.mobile.spprod.transcendent.actabl.com
   • Reply URL (ACS): https://login.transcendent.ai/trweb/samlsso.aspx?cid=YOUR_CUSTOMER_ID
   • Relay State: transcendent.maui://callback
   • Sign-on URL and Logout URL (optional)
4. Click Save

 

🔹 Step 4: Define Attributes & Claims

1. Go to Attributes & Claims
2. Ensure the following claims are configured:
   • Name ID: user.onpremisesamaccountname (Persistent format)
   • emailaddress: user.mail
   • givenname: user.givenname
   • surname: user.surname
   • userprincipalname: user.userprincipalname
3. Save changes

 

🔹 Step 5: Download SAML Certificate

1. Go to SAML Certificates
2. Download:
   • Certificate (Base64)
   • Federation Metadata XML
3. Copy the following and share with your mobile app provider:
   • Microsoft Entra Identifier
   • Login URL
   • Logout URL

 

🔹 Step 6: Assign Users and Groups

1. Navigate to Users and Groups
2. Click + Add Assignment
3. Select users or groups to assign
   • Ensure groups contain only users (no nested groups)
4. Assign appropriate roles

 

🔹 Step 7: Finalize Application Properties

1. Go to Properties
2. Confirm:
   • Enabled for users to sign-in: Yes
   • User access URL: Copy this for launching SSO
3. Share the User access URL with the mobile app provider

 

✅ Final Notes

• Ensure usernames in the mobile app match Microsoft Entra usernames
• The “User access URL” is essential for proper SSO configuration
• Test the integration thoroughly across mobile platforms