SAML with Microsoft Entra ID

This guide walks through configuring Microsoft Entra ID (formerly Azure Active Directory) as the identity provider for a Kindo SAML connection. It assumes you have a SAML connection set up in SSOReady — typically through the self-serve setup link described in Single Sign-On (SSO) Setup — and shows where each value in Entra comes from and where it goes.

Create an application in Entra

Entra associates a SAML connection with an Application, so the first step is to create one.

1. From any page in Entra, navigate to Applications > Enterprise applications in the left navigation bar.

   

2. On the Enterprise applications page, press the New application button under the header.

   

3. On the Browse Microsoft Entra Gallery page, ignore the gallery and the cloud-provider cards — this configuration does not use them. Click Create your own application, which opens a slideover on the right.

   

4. Give the application a display name. Kindo, or your own name for the Kindo deployment, works well here.

   Note

   As you type a display name, Entra suggests matching apps from the Entra Gallery as alternatives. Ignore these suggestions.

   

5. Under the display name, select the last of the three radio button options: Integrate any other application you don’t find in the gallery (Non-gallery).

   

6. Hit Create in the lower left of the slideover.

   

7. Entra may take a few seconds to create the application. Once it finishes, you land on a page detailing the application.

   

You can skip assigning users to the application for now, but an Entra admin needs to assign them before long.

Caution

Users cannot sign in until an Entra admin assigns them to the application.

Enter SSOReady details in Entra

With an application created, configure it to talk to SSOReady. Both required values come from the SSOReady page for your SAML connection.

1. On the application page, select the Set up single sign on card.

   

2. Select the SAML card marked with a puzzle piece icon.

   

3. Entra routes you to its SAML-based Sign-on configuration page. On the Basic SAML Configuration card, click the Edit button in the top right corner to open a slideover.

   

4. In the slideover, fill in the two required values:

   • Identifier (Entity ID) — SSOReady calls this the SP Entity ID. Copy it from your SAML connection in SSOReady and paste it here.
   • Reply URL (Assertion Consumer Service URL) — SSOReady calls this the Assertion Consumer Service (ACS) URL. It looks just like the SP Entity ID, only it ends with /acs. Copy it from SSOReady and paste it here.

   

5. Hit Save toward the top of the page.

   

6. Close the slideover to return to the SAML configuration page.

   

Configure attribute claims

Entra’s default SAML claims use URL-namespaced names such as http://schemas.xmlsoap.org/ws/2005/05/identity/claims/emailaddress, which do not match the attribute names Kindo expects. SSOReady does not rewrite incorrect incoming SAML attributes on your behalf; without a correctly mapped email claim, login and JIT (Just-In-Time) provisioning fail.

On the Attributes & Claims card — the second card of the SAML configuration page — click Edit and add claims with these exact names, leaving the namespace blank:

Claim name	Source attribute
email	user.mail
firstName	user.givenname
lastName	user.surname

email is required for sign-in; firstName and lastName make user names appear in the Kindo app.

Enter Entra details in SSOReady

SSOReady needs three pieces of information from the Entra application: a Certificate, an IDP Entity ID, and a Redirect URL.

1. Start with the certificate. On the third card of the SAML configuration page, next to the Certificate (Base64) heading, click the blue download link. The downloaded file is named after your application — an application named new_application yields a new_application.cer file. Upload this file to SSOReady on the page for your SAML connection.

   

2. Scroll down to the fourth card. Copy the Microsoft Entra Identifier field from Entra into SSOReady’s IDP Entity ID field, and the Login URL field from Entra into SSOReady’s Redirect URL field.

   

Once you’ve entered that data in SSOReady, the Entra configuration is complete. Confirm the connection appears in SSOReady’s connection list as described in Single Sign-On (SSO) Setup.