circle-info
Read on newly released AI assisted Insights
flxbl docsarrow-up-right
search
Ctrlk
Learn CD Concepts using LabsslackGitHub

Microsoft Entra ID

Configure Microsoft Entra ID (formerly Azure AD) as a SAML identity provider for sfp.

Use the URL that matches your deployment mode. Self-hosted: replace <your-domain> with your sfp server domain. Cloud: use auth.flxbl.io. See URL convention.

hashtag
1. Create the application

  1. Sign in to the Azure Portalarrow-up-right.

  2. Go to Microsoft Entra ID → Enterprise applications → New application.

  3. Choose Create your own application.

  4. Select Integrate any other application you don't find in the gallery (Non-gallery).

  5. Name it (e.g. "sfp SSO") and click Create.

hashtag
2. Configure SAML

In the new application, go to Single sign-on → SAML and click Edit on Basic SAML Configuration.

Field
Value

Identifier (Entity ID)

https://<your-domain>/auth/v1/sso/saml/metadata

Reply URL (ACS URL)

https://<your-domain>/auth/v1/sso/saml/acs

Sign on URL

leave blank

Relay State

leave blank

Logout URL

leave blank

Click Save.

hashtag
3. Configure attributes and claims

Entra ships only emailaddress by default. displayname, givenname, and surname are NOT in the default claim set — you must add them explicitly below, or sfp users will end up with empty first/last names.

Click Edit on Attributes & Claims and ensure these are set:

Claim name
Source attribute

Unique User Identifier (Name ID)

user.mail (Format: Email address)

http://schemas.xmlsoap.org/ws/2005/05/identity/claims/emailaddress

user.mail

http://schemas.xmlsoap.org/ws/2005/05/identity/claims/givenname

user.givenname

http://schemas.xmlsoap.org/ws/2005/05/identity/claims/surname

user.surname

http://schemas.microsoft.com/identity/claims/displayname

user.displayname

The Name ID format must be Email address — sfp matches users by email.

hashtag
4. Copy the federation metadata URL

In the SAML Certificates section, copy App Federation Metadata URL. It looks like:

This is the only thing you need to hand to sfp.

hashtag
5. Assign users

  1. In the application, go to Users and groups → Add user/group.

  2. Pick the users (or groups) who should have sfp access.

  3. Click Assign.

Users not assigned here will be rejected at the IdP before they ever reach sfp.

hashtag
Next step

Continue with Self-Hosted Setup or Cloud Setup to register the IdP with sfp.

Last updated

Was this helpful?