Microsoft Entra ID
Create the Sentisec enterprise application in Entra ID over SAML 2.0 or OIDC, and map the claims Sentisec needs.
This is the Entra half of the hosted SSO setup. Start at Single Sign-On — you need our service-provider details first. Entra ID is the service formerly called Azure AD; the menu paths below are the current portal's.
SAML 2.0
Entra admin centre → Enterprise applications → New application → Create your own application. Name it Sentisec and choose Integrate any other application you don't find in the gallery.
Single sign-on → SAML → Basic SAML Configuration. Set Identifier (Entity ID) and Reply URL (ACS URL) to the values we sent you.
Attributes & Claims. The unique user identifier should be
user.mail. Then map three claims with exactly these names:
| Claim name | Source |
|---|---|
email | user.mail |
firstName | user.givenname |
lastName | user.surname |
Add a groups claim only if you plan to drive roles from Entra
security groups.
Users and groups. Assign the people who should have access. Entra issues no assertion for an unassigned user.
Send us the App Federation Metadata Url from the SAML signing certificate section. Sending the URL rather than the certificate means Entra's automatic certificate rollover does not break sign-in.
OIDC
App registrations → New registration. Supported account types: accounts in this organizational directory only, unless you deliberately want guests.
Redirect URI — Web platform, set to the redirect URI we sent you.
Certificates & secrets → New client secret. Note the expiry you choose; Entra client secrets are time-limited and sign-in stops when one lapses.
API permissions — openid, profile, email under Microsoft
Graph delegated permissions.
Send us the application (client) id, the client secret value —
not the secret id — and your tenant's issuer URL
(https://login.microsoftonline.com/<tenant-id>/v2.0).
Roles
Two roles exist: admin and member. Tell us which Entra group should map to admin; everything else resolves to member. A custom group name does not create a custom role — see Roles and permissions.
Verify
Open the My Apps portal as a test user and click Sentisec. They should land in the dashboard. The two failures worth checking first are an unassigned user and a claim name that does not match the table above — Entra's default claim names are URIs, so the short names have to be set explicitly.
Related
- Single Sign-On
- Okta — same pattern, different console
- SCIM provisioning