Set up single sign-on with Microsoft Entra ID
Connect Praisidio to Microsoft Entra ID (formerly Azure Active Directory) with SAML 2.0 so your team signs in with their existing Microsoft credentials - no separate Praisidio passwords to manage.
Quick answer
- Which protocol?
- SAML 2.0, set up as a non-gallery enterprise application in Microsoft Entra ID.
- How long does it take?
- About 15 minutes of admin work on the Entra side. Praisidio enables the connection on our side once you send the metadata.
- What do we send Praisidio?
- The Federation Metadata XML file - or the Login URL, Microsoft Entra Identifier, and Base64 certificate.
- Do users need a Praisidio password?
- No. Assigned users authenticate with their Microsoft credentials through Entra ID.
Before you start
- ✓A Microsoft Entra ID admin account with the Application Administrator, Cloud Application Administrator, or Global Administrator role.
- ✓SSO enabled on your Praisidio plan. If you are not sure, contact us and we will confirm.
- ✓The connection values Praisidio provides for your organization: the Identifier (Entity ID) and the Reply URL (Assertion Consumer Service URL).
This guide follows Microsoft's own SSO setup flow. You can cross-reference each step with Microsoft's official SAML SSO documentation.
Setup steps
Create the enterprise application
Sign in to the Microsoft Entra admin center and go to Identity → Applications → Enterprise applications. Choose + New application, then + Create your own application. Name it Praisidio, select "Integrate any other application you don't find in the gallery (Non-gallery)", and click Create.
Start SAML single sign-on
In the new Praisidio application, open Manage → Single sign-on and select SAML as the single sign-on method.
Enter the Basic SAML Configuration
Click Edit in the Basic SAML Configuration panel and enter the values exactly as provided by Praisidio:
| Entra ID field | Value |
|---|---|
| Identifier (Entity ID) | Provided by Praisidio |
| Reply URL (Assertion Consumer Service URL) | Provided by Praisidio |
| Sign-on URL (optional) | Your Praisidio login page - enables IdP-initiated sign-in from My Apps |
Click Save. These values are unique per organization, so copy them rather than typing from memory.
Review attributes and claims
In the Attributes & Claims panel, confirm the required claim:
- Unique User Identifier (Name ID):
user.userprincipalname - Keep the default claims
emailaddress,givenname, andsurName.
Make sure every user who will sign in has a populated UPN and email address in Entra ID - a blank value is the most common cause of first sign-in failures.
Download the certificate and endpoints
In the SAML Certificates panel, download the Federation Metadata XML. That single file contains everything Praisidio needs. If you prefer to copy values manually, note the Login URL, Microsoft Entra Identifier, Logout URL, and download the Certificate (Base64).
Send the configuration to Praisidio
Email the metadata file to security@praisidio.com or share it in your onboarding channel. We enable the connection on our side and confirm when it is live - usually within one business day.
Assign users and groups
Under Manage → Users and groups, choose + Add user/group and assign the people or groups who should have access to Praisidio. Assignment is required by default - a user who is not assigned sees an error at sign-in even if SSO is configured correctly.
Test sign-in
Use the Test button at the bottom of the Entra SSO panel to sign in as yourself. Then confirm both flows:
- IdP-initiated: open myapplications.microsoft.com and launch Praisidio from the app tile.
- SP-initiated: start from the Praisidio login page and complete the Microsoft sign-in prompt.
After go-live
Add teammates by assignment, not invitations. Once SSO is live, giving someone access is just adding them to the assigned group in Entra ID - and removing access is removing them from it. Joiner, mover, and leaver handling all live in one place.
Set a certificate renewal reminder. Entra signing certificates are commonly issued for three years. Sign-ins begin to fail the day the certificate expires, so set a reminder a few weeks ahead and share the renewed certificate with Praisidio before switching over.
Automatic provisioning. Assignment controls who can sign in. If you want accounts created and deactivated automatically as people join and leave groups, ask your Praisidio contact about provisioning options on your plan.
Troubleshooting
| Symptom | Most likely cause and fix |
|---|---|
AADSTS70011 - reply URL mismatch | The Reply URL in Entra does not match the value Praisidio provided. Re-paste it exactly, with no trailing spaces. |
AADSTS50105 - user is not assigned | Add the user (or their group) under Users and groups. Assignment is required by default. |
| Sign-in loops or lands on an error page | The Name ID is blank or not an email. Check the user's UPN and that the claim maps to user.userprincipalname. |
| SSO worked before, now everyone fails | The signing certificate expired. Download the new Federation Metadata XML and send it to Praisidio. |
| Works for the admin, not for users | Only the admin was assigned during testing. Assign the intended group before rolling out. |
Frequently asked questions
Which protocol does Praisidio use for SSO?
SAML 2.0, configured as a non-gallery enterprise application in Microsoft Entra ID. Users you assign in Entra sign in to Praisidio with their existing Microsoft credentials.
Do users still need a Praisidio password?
No. Once SSO is enabled, assigned users authenticate through Microsoft Entra ID and never set a Praisidio-specific password.
What do we need to send to Praisidio?
The Federation Metadata XML file is the simplest option. Alternatively, send the Login URL, the Microsoft Entra Identifier, and the SAML signing certificate (Base64).
Who can complete the setup?
A Microsoft Entra ID administrator with the Application Administrator, Cloud Application Administrator, or Global Administrator role. The Entra side takes about 15 minutes.
What happens when the signing certificate expires?
Sign-ins start failing, so renew before expiry. Entra certificates are commonly issued for three years - set a renewal reminder and share the new certificate with Praisidio before switching over.
Can we automate user provisioning?
User assignment in Entra ID controls who can sign in. For automatic account provisioning and deprovisioning, ask your Praisidio contact about the options available on your plan.