# Microsoft Entra ID SSO Configuration Guide (/docs/security/sso/azure-ad-sso-guide)

## Prerequisites [#prerequisites]

Ensure you have read the [SSO Setup Overview article](./setting-up-sso.mdx) to ensure you have configured the baseline and prepared for your IDP SSO connection.

## Configuration Steps [#configuration-steps]

### Create a new application in Microsoft Entra ID [#create-a-new-application-in-microsoft-entra-id]

- Navigate to Microsoft Entra ID (formerly Azure Active Directory) and select _Enterprise Applications_ from the menu.
- Select the option to _Add a New Application_

![Add a new Entra ID application](/images/2022-10-03_AzureAD_New_SAML_App.png)

- Choose _Create your own application_.

![Select option to create new app](/images/2022-10-03_AzureAD_create_own_app.png)

- Add a name to help you remember the application (ex: `transcend-sso`).
- Select _Set up Single sign-on_ and choose `SAML` as the SSO mode.

![Set up SSO settings for Entra ID App](/images/2022-10-03_AzureAD_SSO_config_app.png)

- In the _Basic SAML Configuration Settings_, enter the following information:
  - Identifier (Entity ID): `transcend`. Note - this must be an exact match, Transcend is looking for this string.
  - Reply URL (Assertion Consumer Service URL): `https://api.transcend.io/saml` for the EU backend, or `https://api.us.transcend.io/saml` for the US backend
  - Sign on URL : `https://app.transcend.io/login`
  - Relay State (Optional): _leave empty_
  - Logout URL (Optional): _leave empty_

![Entra ID App SAML config example](/images/10-03-2022_AzureAD_SAML_app_config.png)

- In the _Attributes & Claims_, create the following claims:
  - firstName: `user.givenname`
  - lastName: `user.surname`
  - title `(optional):` For job-title–based team mapping, add a claim whose outgoing name is `title` with source `user.jobtitle`. Microsoft’s default `jobtitle` attribute name alone does not populate Transcend’s title field unless the SAML attribute name is exactly `title`. Similarly use `department` with source `user.department` if you map by department.

![Entra ID SSO Claims](/images/2025-04-18-azure-sso-claims.png)

_Transcend uses these claims to set names for users. Without them, users will be created with blank names._

### Obtain the Credentials & Certificate for the Application [#obtain-the-credentials--certificate-for-the-application]

Once the Transcend application is set up in Entra ID, obtain the credentials and certificate to enter in the Transcend Admin Dashboard SSO settings.

1. In Transcend SSO Settings, enter `transcend` for _Identity Provider Issuer_. The value entered here must match `transcend` exactly.
2. Under the _SAML Certificates_ section, download the X.509 Certificate by selecting the download option for _Certificate (Base64)_. Copy this value to Transcend.
3. Copy the login URL from Entra ID into Transcend. It should look similar to `https://login.microsoftonline.com/{{uuid}}/saml2`.

### Configure Groups & Users in Entra ID [#configure-groups--users-in-entra-id]

Configure the groups and users who should have access to Transcend in Entra ID by navigating to the newly created Transcend app and selecting _Users & Groups_. Note that it may be worth creating a new group of users who should have access to Transcend. To configure SSO-based team assignment using groups, titles, or departments, see [Adding, Revoking, & Auto-Provisioning Access](../access-control/adding-revoking-and-auto-provisioning-access.mdx).

<Callout type="info" title="Why the value looks like a GUID">
  Customers often expect to type the Entra ID group’s friendly display name into Transcend. With Source attribute set to Group ID, Microsoft sends each group’s immutable object ID in the SAML assertion. Paste that object ID into Transcend Group names so the strings match exactly. Assigning groups to the enterprise application for the “groups assigned to the application” scope requires Microsoft Entra ID P1 or P2; other scopes (such as security groups) work on lower SKUs but can produce larger tokens—use a dedicated test group or filters when possible.
</Callout>

When Microsoft rotates the SAML _token signing certificate_ in Entra ID, download the new _Certificate (Base64)_ and update the IdP certificate in Transcend SSO settings; an expired or mismatched certificate surfaces as a generic error at the SAML callback.

- `groups` (optional): For Entra ID _Group claims_, add a group claim. Choose which groups to include (for example _Security groups_). Set _Source attribute_ to `Group ID` so each membership is emitted as that group's Microsoft Entra ID object ID (a GUID). Turn on _Customize the name of the group claim_ and set the claim _Name_ to `groups` (namespace empty unless your tenant requires it). In Transcend, open _Administration → Teams_ and set _Group names_ to that same GUID (copy it from Entra ID → Groups → your group → _Object ID_). It will not match the group's display name in the Entra ID portal unless you choose a different source format and align the string exactly.