> For the complete documentation index, see [llms.txt](https://docs.flosum.com/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://docs.flosum.com/global-settings/security/identity-providers-sso/saml-identity-providers/microsoft-entra-id-saml-configuration.md).

# Microsoft Entra ID - SAML - Configuration

{% hint style="success" %}

#### Required User Credentials

\[**Flosum User**] - **SystemAdministrator** Role
{% endhint %}

{% hint style="success" %}

#### Important Note

The instructions in this article cover a third-party app and may not reflect the latest version. Please use these instructions as a guide to complete the task, but be aware that some screens, field names, and steps may have changed.
{% endhint %}

## ![](https://579543750-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FsEk2hU5IMh3HEY5dJZjR%2Fuploads%2FSxcnKlaJKPzDqONWoDNv%2FSummary2-Small-Icon.svg?alt=media\&token=5e3253d0-a069-4ba5-9c06-83c70bd0b21d) Overview

This article explains how to integrate Microsoft Entra ID with Flosum Cloud Apps using SAML authentication to enable Single Sign-On (SSO), allowing users to access the platform seamlessly with their existing credentials. If you prefer to integrate Entra ID via OIDC, refer to the following article.

* [Microsoft Entra ID - OIDC - Configuration](/global-settings/security/identity-providers-sso/oidc-identity-providers/microsoft-entra-id-oidc-configuration.md)

{% hint style="info" %}
For more general instructions about adding an Identity Provider, see the following article.

* [Adding an Identity Provider (SSO)](/global-settings/security/identity-providers-sso/adding-an-identity-provider-sso.md)
  {% endhint %}

{% hint style="warning" %}

#### Customer-Hosted

Customers who host Flosum Apps on their own infrastructure will have a custom URL for logging into their apps. When using this documentation, replace any **Flosum Hosted URLs** with your own URLs.
{% endhint %}

## Configure Entra ID

{% stepper %}
{% step %}

### Create Application

1. Log in to your **Entra Admin Center** account.
2. Select **Enterprise applications**.
3. Click **New application**.
4. Select **Create your own application**.
5. Enter **Application name**.
6. Select **Integrate any other application you don't find in the gallery (Non-gallery)**.
7. Click **Create**.
   {% endstep %}

{% step %}

### Configure Single Sign On

1. Click **Single sign-on** under the **Manage** section in the left sidebar menu.
2. Click **SAML**.

#### Basic SAML Configuration

1. Click **Edit** for **Basic SAML Configuration**.
2. Click **Add identifier** and enter a unique identity for this SSO. This can be any unique string value.
3. Click **Add reply URL** and enter the SAML URL for your region from the table below.

<table><thead><tr><th width="159.6666259765625">Region</th><th>SAML URL</th></tr></thead><tbody><tr><td>United States</td><td>https://global-us.flosum.app/api/v1/saml/acs</td></tr><tr><td>Germany</td><td>https://global-de.flosum.app/api/v1/saml/acs</td></tr><tr><td>Japan</td><td>https://global-jp.flosum.app/api/v1/saml/acs</td></tr><tr><td>Australia</td><td>https://global-au.flosum.app/api/v1/saml/acs</td></tr></tbody></table>

4. Click **Save**.

#### Attributes & Claims

1. Click **Edit** for **Attributes & Claims**.
2. Click **Add new claim** to add each of the following claims.

| Name         | Source attribute       |
| ------------ | ---------------------- |
| firstName    | user.givenname         |
| lastName     | user.surname           |
| email        | user.mail              |
| uniqueUserId | user.userprincipalname |

{% hint style="info" %}
The **uniqueUserId** claim can be mapped to any user attribute that is both unique and constant.
{% endhint %}

#### SAML Certificates

**Token signing certificate**

1. Don't edit the **Token signing certificate**.

{% hint style="info" %}
A custom signing certificate can be used for the **Token signing certificate** if required by security or compliance policies.
{% endhint %}

**Verification certificates (optional)**

(Optional) Verification certificates aren't required to work with Flosum SSO. Configure this setting only if required by your security or compliance policies.

If you enable **Require verification certificates:**

1. Generate a private/public key pair.
2. Upload the Service Provider's public certificate using the **Upload certificate** button.
3. Click **Save**.
   {% endstep %}

{% step %}

### Create Identity Provider in Global Settings

Follow the general instructions in the article below to get started creating a SAML Identity Provider.

1. [Adding an Identity Provider (SSO)](/global-settings/security/identity-providers-sso/adding-an-identity-provider-sso.md)
2. Complete the **Basic information** section.
   1. Select **SAML** for the identity provider **Type**.
3. Complete the **Button information** section.
4. (Optional) Complete the **Group information** section.

#### **Complete SAML 2.0 Information Fields**

Copy the information from your Entra ID application into the SAML 2.0 Information section. The first screenshot below shows which Entra ID application fields to copy. The table explains where to enter this information. The final screenshot shows a completed identity provider for an Entra ID SAML application.

<div align="left"><figure><img src="https://579543750-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FsEk2hU5IMh3HEY5dJZjR%2Fuploads%2FFVORKklF8j3k3WkdkKEv%2FMsEntraId-Saml-Config-EntraIdApp-01.png?alt=media&amp;token=74ead72f-f919-4c86-8076-33e7e1349c91" alt="" width="563"><figcaption></figcaption></figure></div>

<table><thead><tr><th width="179.6666259765625">Flosum Field</th><th>Entra ID Field</th><th>Instructions</th></tr></thead><tbody><tr><td><strong>Issuer</strong></td><td>Basic SAML Configuration → <strong>Identifier (Entity ID)</strong></td><td></td></tr><tr><td><strong>Entity ID</strong></td><td>Set up {application name} → <strong>Microsoft Entra Identifier</strong></td><td>Click the <strong>Copy</strong> icon to copy this link.</td></tr><tr><td><strong>Identity Provider Sign Certificate</strong></td><td>SAML Certificates → Token signing certificate → <strong>Certificate (Base64)</strong></td><td>Click <strong>Download</strong> to download the certificate. Once downloaded, click <strong>Identity Provider Sign Certificate</strong> and upload it.</td></tr><tr><td><strong>Name ID format</strong></td><td></td><td>Leave blank</td></tr><tr><td><strong>Identity Provider Login URL</strong></td><td>Set up {application name} → <strong>Login URL</strong></td><td>Click the <strong>Copy</strong> icon to copy this link.</td></tr></tbody></table>

<div align="left"><figure><img src="https://579543750-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FsEk2hU5IMh3HEY5dJZjR%2Fuploads%2F694JLGosuv0mFqqv1w7p%2FMsEntraId-Saml-Config-IdentityProvider-01.png?alt=media&amp;token=afd9221a-0a03-4518-a88a-71b4116fb43f" alt="" width="563"><figcaption></figcaption></figure></div>

#### SAML Signed Request Enabled

If SAML Certificates → Verification certificates (optional) → **Required** is **Yes:**

1. Check the **SAML Signed Request Enabled** checkbox.
2. Complete the fields in the table below.

<table><thead><tr><th width="180.33331298828125">Flosum Field</th><th>Value</th></tr></thead><tbody><tr><td><strong>Auth Sign Certificate</strong></td><td>Click to upload the public certificate that corresponds to the verification certificate.</td></tr><tr><td><strong>Auth Private Key</strong></td><td>Click to upload the private key that matches the public certificate.</td></tr><tr><td><strong>Auth Private Key Password</strong></td><td>Enter the passphrase for the private key if encrypted.</td></tr><tr><td><strong>Auth Sign Algorithm</strong></td><td>Leave blank (or specify if required).</td></tr></tbody></table>

#### Assertion Encryption Enabled

If Assertion Encryption is enabled in Entra ID:

1. Check the **Assertion Encryption Enabled** checkbox.
2. Complete the fields in the table below.

<table><thead><tr><th width="180.33331298828125">Field</th><th>Description</th></tr></thead><tbody><tr><td><strong>Encryption Certificate</strong></td><td>Click to upload the public certificate that is used for assertion encryption.</td></tr><tr><td><strong>Encryption Private Key</strong></td><td>Click to upload the private key that pairs with the public certificate.</td></tr><tr><td><strong>Encryption Private Key Password</strong></td><td>Enter the passphrase for the private key if encrypted.</td></tr></tbody></table>
{% endstep %}

{% step %}

### Save and Test

{% hint style="info" %}
For instructions on logging in with SSO, see the following article.

* [Logging In With SSO](/global-settings/security/identity-providers-sso/logging-in-with-sso.md)
  {% endhint %}

1. Click **Save** to save the identity provider.
2. To test, open an incognito window.
3. Start logging in to Global Settings with your tenant name.
4. If the identity provider was configured successfully, you should see the SSO button you created.&#x20;

<div align="left"><figure><img src="https://579543750-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FsEk2hU5IMh3HEY5dJZjR%2Fuploads%2FyjADhD5WtXcsx5Z2ipai%2FMsEntraId-Saml-Config-Login-01.png?alt=media&amp;token=7a7861dc-2779-420d-88cc-0335a56b1002" alt="" width="375"><figcaption></figcaption></figure></div>
{% endstep %}
{% endstepper %}


---

# Agent Instructions
This documentation is published with GitBook. GitBook is the documentation platform designed so that both humans and AI agents can read, navigate, and reason over technical content effectively. Learn more at gitbook.com.

## Querying This Documentation
If you need additional information that is not directly available in this page, you can query the documentation by asking a question.

Perform an HTTP GET request on the following URL with the `ask` and `goal` query parameters:

```
GET https://docs.flosum.com/global-settings/security/identity-providers-sso/saml-identity-providers/microsoft-entra-id-saml-configuration.md?ask=<question>&goal=<user_goal>
```

`ask` is the immediate question: it should be specific, self-contained, and written in natural language.
`goal` is what the user is ultimately trying to achieve, the reason they need the answer. Sharing it helps GitBook give you a better, more relevant answer. A goal is most helpful when it describes the outcome the user wants rather than restating the question. For example, with `ask=how do I create an API token`, a goal like `automate deployments from our CI pipeline` lets GitBook tailor the answer to that use case.

The response will contain a direct answer to the question and relevant excerpts and sources from the documentation.

Use this mechanism when the answer is not explicitly present in the current page, you need clarification or additional context, or you want to retrieve related documentation sections.