Microsoft Azure Entra ID (formerly Azure AD) SSO Setup

The Single Sign-On feature is available in the Enterprise plan only.

This guide lists the steps to set up your Azure Entra ID SAML integration with RudderStack.

Overview

This integration supports the following features:

• SP-initiated SSO
• JIT(Just In Time) Provisioning
• Push groups (Public Beta)

Note that:

• RudderStack supports only the SAML 2.0 protocol for SSO.
• RudderStack does not support some SCIM features like importing users and groups, removing users, and syncing passwords. See Known issues before you set up SSO for your organization.

Step 1: Create new application

1. Sign in to Microsoft Entra ID Admin Center.
2. From the left sidebar, go to Entra ID > Enterprise apps.
3. Click All applications followed by New application.

4. In the Microsoft Entra App Gallery, click Create your own application.

5. In the expanded right sidebar, enter the name of your app.
6. Under What are you looking to do with your application?, select Integrate any other application you don’t find in the gallery (Non-gallery).

7. Click the Create button at the bottom and wait for a few seconds for Azure to provision the app. You will then be redirected to the admin view of the app.

Step 2: Set up SAML

1. In the left sidebar of the newly provisioned app, click Single sign-on. Then, click SAML.

2. Click the meatballs menu (...) to the right of Basic SAML Configuration. In the expanded right sidebar, fill in the following information:

3. Click the meatballs menu (...) to the right of Attributes & Claims and remove any Additional claims. Then, click Add new claim and enter the following information:

4. Copy the App Federation Metadata URL.

Before sharing the App Federation Metadata URL, verify that the IdP metadata declares both HTTP-Redirect and HTTP-POST SAML bindings.

RudderStack uses AWS Cognito, which sends the initial login request with HTTP-Redirect, so metadata that advertises only HTTP-POST will be rejected.

5. Share the App Federation Metadata URL with the RudderStack team.

When you contact the RudderStack team to enable SSO, also tell them how to add new users to your organization, and which workspace (if any) to set as the default workspace that new users land in:

Auto-add SSO users	Default workspace	New user signing in through SSO	User activated through SCIM (Okta and Azure Entra ID)
Off	Not applicable	Not added to your organization	Added to your organization with no workspace access
On	Not set	Added to your organization with no workspace access	Added to your organization with no workspace access
On	Set	Added to your organization with access to the default workspace	Added to your organization with access to the default workspace

Note that:

• For Okta and Azure Entra ID, SCIM activation always adds the user to your organization, even when auto-add is off.
• A user with no workspace access sees a message that access hasn’t been granted yet, until an admin gives them access to a workspace.
• You can also ask the team to create a personal organization for each new SSO user. This is off by default.

Step 3: Set up SCIM

This section lists the steps to set up SCIM provisioning in Azure Entra ID.

Prerequisites

Before setting up SCIM provisioning, make sure to generate an organization-level Service Access Token in the RudderStack workspace for which you want to enable SCIM.

Make sure to create an organization-level Service Access Token. Otherwise, your SCIM provisioning tasks will fail.

Token permissions for legacy RBAC system

If you are on the legacy Permissions Management (RBAC) system, generate an organization-level Service Access Token.

SCIM configuration

1. In the left sidebar of your app, go to Provisioning > Get started.

2. Under Provisioning Mode, choose Automatic and enter the following credentials:

3. Click Test Connection - it should be successful.

If you see a 403 - Forbidden error, contact the RudderStack team to enable SCIM for your organization.

Provision groups

SCIM group sync is in Public Beta and available in the Enterprise plan only. Contact the RudderStack team to enable it for your organization.

Provision your Azure Entra ID groups to RudderStack so that you can manage group membership from Azure.

Note that:

• Assigning groups to an enterprise application requires a Microsoft Entra ID P1 or P2 license.
• Azure Entra ID syncs only the direct members of an assigned group. It does not sync members of nested groups, so assign those groups directly.

1. In the Microsoft Entra ID Admin Center, go to Entra ID > Enterprise apps and select your app.
2. In the left sidebar of your app, click Provisioning and open Mappings.
3. Select Provision Microsoft Entra ID Groups, set Enabled to Yes, and click Save.
4. Under Settings, set Scope to Sync only assigned users and groups.
5. In the left sidebar, click Users and groups, then click Add user/group.
6. Select the groups you want to provision and click Assign.
7. Provision the groups using one of the following options from the left sidebar:
   • Provision on demand: Provisions one group and up to five of its members in a few seconds, which is useful for testing your setup. Click Provision on demand, search for the group, select the members, and click Provision. If Azure reports that the group is not assigned to the app, wait a few minutes and try again.
   • Provisioning: Provisions all assigned groups and their members, and keeps them in sync. Click Provisioning, then click Start provisioning. If provisioning is already running, Azure picks up the groups in its next cycle.
8. In RudderStack, map each group to one or more RudderStack groups.

Provision on demand is a one-time action. Later membership changes reach RudderStack only when provisioning is running: after the initial cycle, Azure Entra ID syncs changes about every 40 minutes.

Enable SSO login

RudderStack does not support IdP-initiated authentication. Make sure the users log in through https://app.rudderstack.com/sso.

Known issues

RudderStack does not support the following SCIM features currently:

• Import users
• Import groups
• Remove users
• Sync password
• Enhanced group push

RudderStack does not support removing users - this is because it uses SCIM with SAML, where removing a user from Azure Entra ID implies that they also lose the ability to authenticate to RudderStack completely (logins via passwords, Google, etc. are completely blocked).

Instead, RudderStack supports deactivating the user which means they only lose access to the organization.

Debugging

There are times when an SSO login might fail for some users due to some reason. In such cases, the RudderStack team requires a HAR (HTTP Archive) file to inspect the requests and identify any SSO-related issues.

A HAR file is a log of exported network requests from the user’s browser. See the HAR Analyzer guide for steps on generating this file depending on your browser.

Once you generate the HAR file, share it with the RudderStack team to troubleshoot the issue.

Note the following before capturing your HAR file:

• Start from https://app.rudderstack.com/sso with a clean session, preferably in incognito mode of your browser.
• Complete the SSO flow until the step where you face an error.
• Your HAR file might contain sensitive data - make sure to redact it using a text editor before sharing it with the team.

The following sections contain solutions for some common errors you might encounter while setting up SSO:

Invalid samlResponse or relayState from identity provider

The above error indicates you tried the IdP-initiated authentication flow. As stated above, this integration supports only Service Provider (SP)-initiated SSO flow.

RudderStack recommends initiating the SSO authentication by following all the above SSO configuration steps correctly and making sure the users log in through https://app.rudderstack.com/sso.

Required String parameter ‘RelayState’ is not present

The above error indicates that you did not set up your SSO app correctly. Make sure to:

• Set the Identifier (Entity ID) field to urn:amazon:cognito:sp:us-east-1_ABZiTjXia.
• Under Attributes & Claims, set the Email field to user.email.
• Configure the other SAML settings correctly.

FAQ

My organization’s email domain has changed from abc.com to xyz.com and now I am unable to log in. What should I do?

Contact RudderStack support to make the necessary changes to your SSO configuration.