Microsoft Entra ID SAML SSO – Complete Configuration Guide
Why SAML SSO Still Matters in 2026
Despite the rise of OAuth/OIDC, SAML 2.0 remains the standard for enterprise SaaS integrations — Salesforce, Workday, ServiceNow, and hundreds of legacy systems rely on it. Microsoft Entra ID (formerly Azure AD) handles millions of SAML authentications daily.
This guide is written from real-world ticket resolutions. I've configured 200+ SAML apps and fixed 500+ SSO failures. These are the exact steps I use.
SAML SSO in 60 Seconds
SAML is XML-based. Your app (Service Provider) trusts Microsoft Entra ID (Identity Provider). When a user tries to log in:
1. App redirects to Entra ID login 2. User authenticates + MFA (if required) 3. Entra ID sends signed SAML response to App's ACS URL 4. App validates signature + maps user to access granted
What You Need Before Starting
- Microsoft Entra ID admin access
- Global Admin or App Admin role
- App vendor's Entity ID
- App vendor's ACS URL
- Test user account
- Break-glass account (don't test with your only admin)
Create the Enterprise Application
Two paths: gallery app (pre-integrated) or non-gallery (custom).
Microsoft Entra admin center → Applications → Enterprise applications → + New application → Create your own application → Name: "AppName-Environment" (e.g., "Salesforce-Prod") → Select: "Integrate any other application you don't find in the gallery"
Enable SAML SSO
From the app's left menu → Single sign-on → Select SAML.
You'll land on the SAML configuration dashboard. This is where we spend 80% of the time.
Basic SAML Configuration
This is the make-or-break step.
Identifier (Entity ID)
https://app.vendor.com/saml/metadata
Uniquely identifies the app. Must match exactly what the vendor provides. Case-sensitive, trailing slash matters.
Reply URL (ACS URL)
https://app.vendor.com/saml/acs
Where the SAML response is posted. HTTP/HTTPS, domain, path — exact match required.
Fix: Copy the exact ACS URL from the vendor. Watch for http vs https, trailing slashes, and www vs non-www. Add it to Reply URL field.
Attributes & Claims (NameID is King)
The app needs to identify the user. This is the NameID claim. 80% of apps want the user's email address.
NameID format: EmailAddress Source: user.mail (or user.userprincipalname if email not populated) Additional claims: - givenname → user.givenname - surname → user.surname - emailaddress → user.mail - department → user.department
user.userprincipalname
user.employeeid (must be populated in Entra ID)
Certificate & Metadata — Trust
The app must trust the SAML responses from Entra ID. You provide the certificate or metadata.
Best method — contains all URLs + certificate
RecommendedRaw cert + Login URL + Logout URL
Assign Users — The Forgotten Step
Perfect SAML config? Users still can't log in if they're not assigned. This catches 1 in 5 admins.
Enterprise app → Users and groups → + Add user/group
Test & Validate
Inside the SAML config → "Test this application"
Navigate to app login URL, attempt SAML flow
- User redirected to Entra ID login
- MFA applies (if configured)
- User lands in application successfully
- App receives correct NameID (check app logs)
7 Most Common SAML Errors (And Exact Fixes)
Fix: The app is sending an incorrect Entity ID. Verify the Identifier in Basic SAML Configuration matches what the app sends.
Fix: ACS URL is wrong. Check for http vs https, trailing slash, uppercase/lowercase. Add the exact URL the app is calling.
Fix: Enterprise app → Users and groups → Assign the user/group.
Fix: SAML Certificates section → Create new certificate → Activate it → Download and upload to app.
Fix: App expects email but you send UPN. Change NameID format to EmailAddress and source to user.mail.
Fix: For license assignment, the user must have usage location set. Update user profile in Entra ID.
Fix: Check sign-in logs. If CA policy is blocking, either adjust policy or exclude the test user.
Enforce MFA & Device Compliance with Conditional Access
SAML apps respect Conditional Access policies automatically. To require MFA for an app:
Entra admin center → Protection → Conditional Access → New policy → Assignments: Users & groups (select test group) → Target resources: Cloud apps → Include → Select app → Conditions: (optional) Device state, location, risk → Grant: Require multifactor authentication → Enable policy
Production-Ready Best Practices
- ✅ Groups for assignment: Never assign individual users. Use groups for lifecycle management.
- ✅ Certificate rotation: Set annual reminder. Always overlap old and new certs.
- ✅ Naming convention: [AppName]-[Environment] for 50+ apps.
- ✅ Test app instance: Keep a dev/test instance of the app before touching production config.
- ✅ Monitor sign-in logs: Regularly check Entra ID sign-in logs for SAML errors.