Skip to main content

Configure SSO for Microsoft Entra ID

Walks through configuring SSO with Microsoft Entra ID via OIDC or SAML. Covers Azure app registration, API permissions, claims, and testing.

F5 SurePath AI supports both SAML and OIDC for Single Sign-On with most vendors. OIDC is the recommended protocol for organizations with no requirement for SAML. For a general guide applicable to all OIDC/SAML providers, see Configure SSO for all providers.

OIDC Configuration

Prerequisites

Output Checklist

Save the following values for the SurePath AI client setup.

  • Directory (tenant) ID

  • Issuer (URL) - admins create this.

    • This is a combination of Microsoft info and the Directory (tenant) ID.

    • Example:

      https://login.microsoftonline.com/{insert tenant ID}/v2.0

  • Client Secret

Procedure

Note: Use the search bar if an icon or name is not visible.

  • Log in to the Microsoft Azure Portal

  • Select Microsoft Entra ID

  • Select App registrations

  • Select New registration

  • Enter SurePath AI SSO Integration (or another suitable name)

  • Select Default Directory only - Single tenant or the option appropriate for the organization.

Note: The following information is available in the SurePath AI admin interface under Configure > Organization > Identity > Single Sign-On

  • Set the Redirect URI platform to Web

  • Set the URI to the value from the Authorization Callback URLs field

  • Click Register

  • Copy the Directory (tenant) ID

    • Save this for use in the SurePath AI setup

  • Manage - Certificates & Secrets

    • New client secret

      • Client Secrets tab

      • Enter a description

      • Enter the expiration date

        1. Set a calendar reminder for 2 weeks before this date to renew it

      • Add

    • Copy the Value of the new secret created

      • Save this for use in the SurePath AI setup

      • This is a communication secret/password; treat it appropriately and keep it secure.

  • Token Configuration

    • Add optional claim

    • Token type -> ID

    • Select email

    • Click Add

    • Check Turn on the Microsoft Graph email permissions (required for claims to appear in token).

    • Click Add

    • Add optional claim (for display name)

    • Token type -> ID

    • Select name (this provides the DisplayName claim)

    • Click Add

    • If name is not available, configure both given_name and family_name claims instead:

      • Add optional claim

      • Token type -> ID

      • Select given_name

      • Click Add

      • Add optional claim

      • Token type -> ID

      • Select family_name

Configure SurePath AI provider for OIDC

  • Log in to the SurePath AI admin interface

  • Navigate to Organization -> Identity -> Add Provider

  • Enter a provider name.

    • Including the company name and "SSO" in the name field helps end users recognize it as a company resource.

  • Select OIDC from the Provider Type

  • Enable the new provider with the toggle switch

  • Enter the Azure Directory (tenant) ID in the SurePath AI Client Id field

  • Enter the value of the Secret in the SurePath AI Client Secret field.

  • Enter the Issuer (URL). Admins create this value.

    • This is a combination of Microsoft info and the Directory (tenant) ID.

    • Example:

      https://login.microsoftonline.com/{insert tenant ID}/v2.0

  • SAVE the entry

SAML Configuration

IMPORTANT: Do not enable the SSO provider in SurePath AI until the identity provider configuration is complete. This ensures accurate metadata and prevents authentication issues. Complete all IdP configuration steps first, then return to SurePath AI to enable the provider.

Prerequisites

The following values are needed to complete this configuration. Instructions for retrieving them are included below.

Setup Azure Application

Note: In the Azure portal, use the search bar if an icon or name is not visible on the screen. Some menu items may need to be expanded.

  • Log in to the Microsoft Azure Portal

  • Select Microsoft Entra ID

  • Select Enterprise applications

  • Select New Application

  • Select Create your own application

  • Enter SurePath AI SSO Integration (or another suitable name)

  • Ensure the last radio button is checked: Integrate any other application…

  • Select Set up single sign on (may need to select it)

  • Select SAML

  • Scroll down to see the App Federation Metadata Url

  • Copy this value for use in the SurePath AI admin interface.

Configure SurePath AI provider for SAML

  • Log in to the SurePath AI admin interface

  • Navigate to Organization -> Identity -> Add Provider

  • Enter a provider name. Including the company name and "SSO" in the name field helps end users recognize it as a company resource.

  • Select SAML - Metadata URL from the Provider Type Dropdown box

  • Paste the App Federation Metadata Url from Azure into the Metadata URL field.

  • Click SAVE CHANGES

  • The Metadata URL is validated over the next few seconds and returns an error if anything is wrong.

  • The screen then displays the values needed to finish the SSO configuration.

    • Identifier (Entity ID) = Service Provider Entity ID

    • Reply URL (Assertion Consumer Service URL) = Authorization Callback URLs

Finish Azure Configuration

  • Select Basic SAML Configuration > Edit

  • Select Add identifier and enter the value from the Service Provider Entity ID field

  • Select Add reply URL and enter the value from the Authorization Callback URLs field

  • Click Save

  • Close the window

Configure SAML attributes and claims

SurePath AI requires specific user attributes in the SAML assertion. Admins must configure these attributes in Azure Entra so users can authenticate successfully.

  • Navigate to the Attributes & Claims section in the Azure Enterprise Application

  • Click Edit

  • Verify that the email claim is configured (typically included by default as user.mail or user.userprincipalname)

  • Add a display name claim using one of the following options:

    • Option 1 (recommended): Add a claim named displayname or name mapped to user.displayname

      • Click Add new claim

      • Name: displayname (or name)

      • Source attribute: user.displayname

      • Click Save

    • Option 2 (alternative): Add separate claims for first and last name (SurePath AI combines these into a display name)

      • Click Add new claim

      • Name: givenname

      • Source attribute: user.givenname

      • Click Save

      • Click Add new claim

      • Name: surname

      • Source attribute: user.surname

      • Click Save

Enable the SSO provider

After completing all Azure configuration steps, return to SurePath AI to enable the provider.

  • Log in to the SurePath AI admin interface

  • Navigate to Organization -> Identity

  • Locate the SSO provider configured above

  • Toggle the Enabled switch to the enabled position

  • Click SAVE to activate the provider

Testing the configuration

SurePath AI does not support IDP-Initiated authentication flows. To test the SSO configuration, visit https://auth.surepath.ai. If a username is displayed, click LOGOUT, then log in again to verify the configuration.

Related Articles
Did this answer your question?