Microsoft Entra identity provider
3 minute read
Before you begin
- Complete Set up SSO and SAML and Configure the identity provider.
- Capture the IdP XML metadata.
- Create the branded portal for this SSO provider.
Configure Microsoft Entra as the IdP
-
Log in to the Azure portal.
-
Go to Enterprise Applications.
-
Select + New Application, then search for and select Microsoft Entra SAML Toolkit.
(opens full-size image in a new tab)The create dialog appears.
-
Enter a name for the CMP application and select Create. The application is added to your enterprise applications.
-
Select Microsoft Entra SAML Toolkit, then select Set up single sign-on to start configuring it for CMP.
-
On the single sign-on page, select SAML.
-
In the Basic SAML Configuration section, set Identifier (Entity ID), Reply URL (Assertion Consumer Service URL), and Logout URL to point to your CMP instance.
-
Alternatively, select Upload metadata file and upload the metadata file you downloaded in step 6 of Set up SSO and SAML. The Basic SAML settings are then configured automatically from your metadata XML.
-
Ensure the Sign on URL is set.
-
Select Save.
-
When prompted to test the connection, select No, I’ll test later.
-
Under SAML Certificates, select Download for Federation Metadata XML.
-
Save the metadata XML. You need it in Set up SSO and SAML.
-
Select Edit on the SAML settings section and ensure the Signing Algorithm matches the one you set in the SAML settings in Set up SSO and SAML.
Add users and groups
-
On the Azure portal, go to Users and groups under Microsoft Entra SAML Toolkit.
-
Select Add user/group.
-
Select users and add assignments as required.
Copy the claim names
User attributes and claims are standard in Microsoft Entra. You can change the defaults or add more if required.
- In User Attributes & Claims, select Edit.
- In the Additional claims > Claim name column, copy the claim names. You will use them during CMP configuration.
Set up signing and notifications
- In this example, Sign SAML Assertion and SHA-256 are set, along with an email address for notifications.
- Copy the App Federation Metadata URL. You need it for CMP configuration.
Step 5 in Azure’s SAML setup is a test step and is not available until SSO is configured in CMP.
Make sure you have added the users and groups that need access to this enterprise application.
Set up Microsoft Entra SSO in CMP
- Follow the steps in Set up SSO and SAML.
- On the SSO provider’s SAML settings, complete the fields with information from your Azure tenant.
- In the Attribute Name fields, paste the claim names from Copy the claim names, step 2.
- Select Create.
Upload the Microsoft Entra metadata
- On the Overview tab, select Upload IdP XML.
- Choose a source for the metadata. In this example, Metadata URL is used.
- Paste the App Federation Metadata URL you copied in Set up signing and notifications, step 2.
- Select Save.
Log in with SSO
Log out of CMP and log back in. You should see a Log In with SSO provider name button. If you are logged in with a valid user, you are redirected and logged in automatically.