Connect Microsoft Entra ID with SAML

Before you start, open Settings → Organization here in another tab, choose SAML under Single sign-on, and save the connection — that reveals the SP entity ID and ACS URL you'll paste into Entra.

1. In Microsoft Entra, create an enterprise application and choose Set up single sign-on with SAML.
2. In the Basic SAML Configuration, paste our SP entity ID into "Identifier (Entity ID)" and our ACS URL into "Reply URL (Assertion Consumer Service URL)".
3. Copy Entra's Microsoft Entra Identifier into our IdP entity ID field and its Login URL into our IdP single sign-on URL field.
4. Under SAML Certificates, download the Certificate (Base64) and paste the file's contents into our certificate field.
5. Assign users or groups to the application, save the connection here, run the test, and enable it.

Entra sends the user's principal name as the identifier by default, which is normally their email address; if your tenant separates the two, adjust the claim so the Name ID is the user's email, since email is how we match people to accounts.

Once connected, staff sign in from the My Apps portal or from our SSO page with their work email. First-time users are added to your organization automatically, seats permitting. To have Entra manage the roster too — provisioning on hire, deprovisioning on departure — continue with SCIM for Entra.