Configuring Microsoft Entra ID with SAML 2.0

You can configure user authentication with Microsoft Entra ID as your IdP using SAML 2.0.

info

The users defined in Entra ID are automatically added to the AtScale Identity Broker when they log in for the first time. All users are added to the everyone group, which includes the query_user role. If you need to add users to other groups or assign them additional roles, you must do so from within the Identity Broker. For more information, see Managing Users with the Identity Broker.

Prerequisites

This procedure assumes that you have an enterprise application set up for AtScale in Entra ID, and that it is configured with SAML 2.0. For more information, refer to the Microsoft Entra ID documentation.

Additionally, you must be logged in as an admin user.

Procedure

To configure user authentication using Microsoft Entra ID and SAML:

1. In AtScale, open the main menu and select Security. The Identity Broker opens.

2. Log in using your AtScale admin username and password.

3. Select the atscale realm if it is not already selected.

4. In the left-hand navigation, select Identity providers, then click SAML v2.0.

5. On the Add SAML provider page, complete the following fields:

   • Redirect URI
   • Alias
   • Display name
   • Service provider entity ID

6. Disable the Use entity descriptor setting.

7. In a new browser tab, log in to the Microsoft Entra admin center and download the appropriate Federation Metadata XML certificate.

8. In the Identity Broker, next to Import config from file, click Browse and select the certificate you just downloaded.

9. Click Add.

10. Click on the newly added IdP.

11. Enable the Store tokens and Stored tokens readable settings.

12. Click Save.

13. Test your configuration:

    1. Open a new browser window and navigate to your AtScale instance.
    2. Click Sign In in the top right corner. The Sign in to your account window appears.
    3. Click the option to log in with Entra ID and enter your credentials.