# Microsoft Entra identity provider

> Set up single sign-on (SSO) for Cloud Management Platform (CMP) using Microsoft Entra (formerly Azure AD)

---

Site [llms.txt](/llms.txt)

---

## Before you begin

- Complete [Set up SSO and SAML](/docs/cmp/configure/access-and-security/users/sso-saml/set-up/) and [Configure the identity provider](/docs/cmp/configure/access-and-security/users/sso-saml/configure-identity-provider/).
- Capture the [IdP XML metadata](/docs/cmp/configure/access-and-security/users/sso-saml/configure-identity-provider/#upload-and-download-metadata).
- Create the [branded portal](/docs/cmp/configure/administration/system/branded-portals/) for this SSO provider.

## Configure Microsoft Entra as the IdP

1. Log in to the [Azure portal](https://portal.azure.com/).
1. Go to **Enterprise Applications**.

   ![Screenshot: go to Enterprise Applications](/img/cmp/configure/access-and-security/users/sso-saml/microsoft-entra/Azure1.png)
1. Select **+ New Application**, then search for and select **Microsoft Entra SAML Toolkit**.

   ![Screenshot of Enterprise applications, with Microsoft Entra SAML Toolkit highlighted.](/img/cmp/configure/access-and-security/users/sso-saml/microsoft-entra/Azure_SAML_1.PNG)

   The create dialog appears.

   ![Screenshot of the Microsoft Entra SAML Toolkit create dialog.](/img/cmp/configure/access-and-security/users/sso-saml/microsoft-entra/saml_11.PNG)
1. Enter a name for the CMP application and select **Create**. The application is added to your enterprise applications.
1. Select **Microsoft Entra SAML Toolkit**, then select **Set up single sign-on** to start configuring it for CMP.

   ![Screenshot: select Microsoft Entra SAML Toolkit, then select Set up single sign-on to start configuring it for CMP](/img/cmp/configure/access-and-security/users/sso-saml/microsoft-entra/Azure_SAML_2.PNG)
1. On the single sign-on page, select **SAML**.

   ![Screenshot: on the single sign-on page, select SAML](/img/cmp/configure/access-and-security/users/sso-saml/microsoft-entra/Azure_SAML_3.PNG)
1. In the **Basic SAML Configuration** section, set **Identifier (Entity ID)**, **Reply URL (Assertion Consumer Service URL)**, and **Logout URL** to point to your CMP instance.

   ![Screenshot: in the Basic SAML Configuration section, set Identifier (Entity ID), Reply URL (Assertion Consumer Service URL), and Logout URL to point to your CMP instance](/img/cmp/configure/access-and-security/users/sso-saml/microsoft-entra/Azure_SAML_4.PNG)
1. Alternatively, select **Upload metadata file** and upload the metadata file you downloaded in step 6 of [Set up SSO and SAML](/docs/cmp/configure/access-and-security/users/sso-saml/set-up/). The Basic SAML settings are then configured automatically from your metadata XML.

   ![Screenshot: alternatively, select Upload metadata file and upload the metadata file you downloaded in step 6 of Set up SSO and SAML](/img/cmp/configure/access-and-security/users/sso-saml/microsoft-entra/Azure_SAML_5.PNG)
1. Ensure the **Sign on URL** is set.
1. Select **Save**.
1. When prompted to test the connection, select **No, I'll test later**.
1. Under **SAML Certificates**, select **Download** for **Federation Metadata XML**.

   ![Screenshot: under SAML Certificates, select Download for Federation Metadata XML](/img/cmp/configure/access-and-security/users/sso-saml/microsoft-entra/Azure_SAML_6.PNG)
1. Save the metadata XML. You need it in [Set up SSO and SAML](/docs/cmp/configure/access-and-security/users/sso-saml/set-up/).
1. Select **Edit** on the SAML settings section and ensure the **Signing Algorithm** matches the one you set in the SAML settings in [Set up SSO and SAML](/docs/cmp/configure/access-and-security/users/sso-saml/set-up/).

   ![Screenshot: select Edit on the SAML settings section and ensure the Signing Algorithm matches the one you set in the SAML settings in Set up SSO and SAML](/img/cmp/configure/access-and-security/users/sso-saml/microsoft-entra/SAML.PNG)

### Add users and groups

1. On the Azure portal, go to **Users and groups** under Microsoft Entra SAML Toolkit.

   ![Screenshot: on the Azure portal, go to Users and groups under Microsoft Entra SAML Toolkit](/img/cmp/configure/access-and-security/users/sso-saml/microsoft-entra/saml_2.PNG)
1. Select **Add user/group**.

   ![Screenshot: select Add user/group](/img/cmp/configure/access-and-security/users/sso-saml/microsoft-entra/CB_SSO3.png)
1. Select users and add assignments as required.

   ![Screenshot: select users and add assignments as required](/img/cmp/configure/access-and-security/users/sso-saml/microsoft-entra/CB_SSO4.png)

### Copy the claim names

User attributes and claims are standard in Microsoft Entra. You can change the defaults or add more if required.

1. In **User Attributes & Claims**, select **Edit**.
1. In the **Additional claims** > **Claim name** column, copy the claim names. You will use them during CMP configuration.

### Set up signing and notifications

1. In this example, **Sign SAML Assertion** and **SHA-256** are set, along with an email address for notifications.
1. Copy the **App Federation Metadata URL**. You need it for CMP configuration.

Step 5 in Azure's SAML setup is a test step and is not available until SSO is configured in CMP.

<div class="alert alert-info" role="alert">


Make sure you have added the users and groups that need access to this enterprise application.
</div>


## Set up Microsoft Entra SSO in CMP

1. Follow the steps in [Set up SSO and SAML](/docs/cmp/configure/access-and-security/users/sso-saml/set-up/).
1. On the SSO provider's [SAML settings](/docs/cmp/configure/access-and-security/users/sso-saml/set-up/#saml-settings), complete the fields with information from your Azure tenant.
1. In the **Attribute Name** fields, paste the claim names from [Copy the claim names](#copy-the-claim-names), step 2.
1. Select **Create**.

### Upload the Microsoft Entra metadata

1. On the **Overview** tab, select **Upload IdP XML**.
1. Choose a source for the metadata. In this example, **Metadata URL** is used.
1. Paste the App Federation Metadata URL you copied in [Set up signing and notifications](#set-up-signing-and-notifications), step 2.
1. Select **Save**.

### Log in with SSO

Log out of CMP and log back in. You should see a **Log In with *SSO provider name*** button. If you are logged in with a valid user, you are redirected and logged in automatically.