TR: Implementing Microsoft Entra SAML SSO - Web

This article outlines the process of configuring SAML-based Single Sign-On (SSO) for a web application using Microsoft Entra ID. It is intended for IT administrators integrating third-party web apps with Microsoft Entra.

⚠️ Note: Separate configurations are required for Web and Mobile apps. They cannot be combined into a single Enterprise Application.

 

🔹Access Microsoft Entra Admin Portal

• Go to 
• Navigate to Microsoft Entra ID from the left-hand menu

 

🔹Create a New Enterprise Application

1. Click Enterprise Applications
2. Select + New Application
3. Choose Create your own application
4. Enter a name for your application (e.g., “Transcendent Web SSO”)
5. Click Create

 

🔹Configure Single Sign-On

1. In the newly created application, go to Single Sign-On
2. Choose SAML as the sign-on method
3. Fill in the Basic SAML Configuration:
   • Identifier (Entity ID): web.spprod.transcendent.actabl.com
   • Reply URL (ACS): https://login.transcendent.ai/trweb/samlsso.aspx?cid=YOUR_CUSTOMER_ID
   • Sign-on URL (optional): URL for SP-initiated login
   • Relay State and Logout URL (optional)
4. Click Save

 

🔹Define Attributes & Claims

1. Go to Attributes & Claims
2. Ensure the following claims are configured:
   • Name ID: user.onpremisesamaccountname (Persistent format)
   • emailaddress: user.mail
   • givenname: user.givenname
   • surname: user.surname
   • userprincipalname: user.userprincipalname
3. Save changes

 

🔹 Step 5: Download SAML Certificate

1. Go to SAML Certificates
2. Download the following:
   • Certificate (Base64)
   • Federation Metadata XML
3. Copy the Microsoft Entra Identifier and Login URL
4. Share these with the third-party application provider (e.g., Transcendent)

 

🔹Assign Users and Groups

1. Navigate to Users and Groups
2. Click + Add Assignment
3. Select users or groups to assign
   • Ensure groups contain only users (no nested groups)
4. Assign appropriate roles

 

🔹Finalize Application Properties

1. Go to Properties
2. Confirm:
   • Enabled for users to sign-in: Yes
   • User access URL: Copy this for use in launching SSO
3. Share the User access URL with the third-party provider

 

✅ Final Notes

• Ensure usernames in the third-party app match Microsoft Entra usernames
• The “User access URL” is required to configure the site correctly
• Test the SSO integration thoroughly before deployment