Microsoft Entra ID: The Complete SAML SSO Implementation Guide

Learn how to configure, integrate, and troubleshoot SAML-based Single Sign-On (SSO) with Microsoft Entra ID (formerly Azure Active Directory). This guide walks through the complete implementation process, from creating an enterprise application to validating authentication and resolving common errors.

Introduction

Single Sign-On (SSO) has become a fundamental requirement for modern enterprise applications. Instead of maintaining multiple usernames and passwords, users authenticate once through a trusted Identity Provider (IdP) and gain secure access to multiple applications.

Microsoft Entra ID provides enterprise-grade identity and access management, and SAML 2.0 remains one of the most widely adopted authentication protocols for integrating web applications.

Whether you’re an Identity Engineer, Cloud Administrator, DevOps Engineer, or Software Developer, understanding the SAML implementation process will save hours of troubleshooting and ensure secure authentication.

In this guide, we’ll walk through the complete implementation workflow.

What You’ll Need Before You Start?

Before configuring SAML SSO, ensure you have the following:

Administrative Permissions

You’ll need one of these Microsoft Entra roles:

• Global Administrator
• Cloud Application Administrator
• Application Administrator

Without these permissions, you won’t be able to configure enterprise applications or SAML settings.

Service Provider (SP) Metadata

Obtain the following details from the application you’re integrating:

• Entity ID (Identifier)
• Assertion Consumer Service (ACS) URL / Reply URL
• Optional Logout URL
• Required user attributes
• Signing certificate requirements

Having accurate metadata is critical because SAML is extremely sensitive to formatting, even an extra slash can cause authentication failures.

Step 1: Create an Enterprise Application

Navigate to:

Microsoft Entra Admin Center → Enterprise Applications → New Application

If your application isn’t available in the gallery:

Choose:

Create your own application

Then select:

Integrate any other application you don’t find in the gallery

This creates a custom Enterprise Application that supports SAML authentication.

Step 2: Choose SAML as the Sign-In Method

Inside your application:

1. Open Single Sign-On
2. Select SAML

Microsoft Entra automatically generates the SAML configuration page containing:

• Identifier
• Reply URL
• Sign-on URL
• Logout URL
• User Attributes
• Signing Certificate
• Federation Metadata

This becomes your primary configuration workspace.

Step 3: Configure Basic SAML Settings

The most important configuration values are:

Identifier (Entity ID)

Uniquely identifies your application.

Example:

https://mycompany.com

Reply URL (ACS URL)

Where Microsoft Entra sends the SAML assertion after successful authentication.

Example:

https://mycompany.com/saml/acs

Sign-on URL (Optional)

The URL users visit to begin authentication.

Important Tip

SAML performs exact string matching.

This means the following differences matter:

• Uppercase vs lowercase
• Trailing slashes
• HTTP vs HTTPS
• Port numbers
• Extra path segments

One incorrect character can prevent authentication.

Step 4: Configure User Attributes and Claims

Microsoft Entra sends user information through claims.

Common claims include:

NameID: Primary user identifier

Email: User email address

Given Name: First name

Surname: Last name

Object ID: Azure unique ID

Most applications use:

NameID = user.mail

OR

NameID = user.userprincipalname

Depending on the application’s requirements.

You can also configure:

• Custom claims
• Group claims
• Role claims

These are useful for:

• Authorization
• Role mapping
• Just-In-Time (JIT) provisioning

Step 5: Configure Certificates

Microsoft Entra digitally signs every SAML response.

Download the:

Federation Metadata XML

This file contains:

• Signing certificate
• SAML endpoints
• Entity ID

Import it into your Service Provider.

Get Sithum Wijedasa’s stories in your inbox

Join Medium for free to get updates from this writer.

Remember me for faster sign in

Ensure the signing algorithm matches your application’s expectations.

The recommended algorithm is:

SHA-256

Step 6: Assign Users and Groups

Even if SAML is configured correctly, users cannot authenticate unless they are assigned to the application.

Navigate to:

Users and Groups

Assign:

• Individual users
• Security groups

If:

Assignment Required = Yes

Only assigned users will be allowed to sign in.

Integrate with Your Service Provider

Now configure your application.

Most SAML-enabled applications require either:

Option 1

Upload the Federation Metadata XML.

or

Option 2

Provide the Metadata URL.

This automatically imports:

• Certificates
• Login URL
• Logout URL
• Entity ID

This approach reduces manual configuration errors.

Test the Integration

Microsoft Entra provides a built-in testing tool.

Navigate to:

Single Sign-On → Test

Successful validation should produce:

• Successful login
• Valid SAML Response
• Correct NameID
• Expected claims
• Successful application redirect

If anything fails, inspect the SAML response using browser developer tools or a SAML tracing extension.

Common Microsoft Entra SAML Errors

AADSTS50011 — Reply URL Mismatch

Cause

The ACS URL received from the application does not exactly match the Reply URL configured in Microsoft Entra.

Solution

Verify:

• HTTPS vs HTTP
• Trailing slashes
• Case sensitivity
• Domain name
• Port number

This is one of the most common SAML configuration mistakes.

AADSTS50105 — User Not Assigned

Cause

The authenticated user has not been assigned to the Enterprise Application.

Solution

Navigate to:

Users and Groups

Assign the user or the appropriate security group.

AADSTS650058 — Misconfigured Application

Cause

The application’s signing certificate is outdated or invalid.

Solution

• Download the latest Federation Metadata XML.
• Update the certificate on the Service Provider.
• Verify certificate expiration dates.

Remember that Microsoft Entra periodically rotates certificates.

AADSTS800581 — POST vs GET Binding

Cause

The Service Provider expects one SAML binding while Microsoft Entra uses another.

Solution

Verify the Service Provider supports the configured SAML binding, typically HTTP-POST for SAML responses.

Best Practices

To build a secure and reliable SAML integration:

• Always use HTTPS.
• Prefer SHA-256 over SHA-1.
• Keep certificates up to date.
• Use security groups instead of assigning individual users.
• Regularly test SSO after configuration changes.
• Monitor sign-in logs for authentication failures.
• Enable Conditional Access where appropriate.
• Document your Entity IDs, Reply URLs, and metadata locations.

Final Thoughts

Implementing SAML SSO with Microsoft Entra ID can seem complex at first, but following a structured workflow makes the process much more manageable.

The key steps are:

1. Create the Enterprise Application.
2. Enable SAML.
3. Configure Entity ID and Reply URL.
4. Set user claims.
5. Import certificates.
6. Assign users.
7. Configure the Service Provider.
8. Test thoroughly.

Most authentication issues stem from a handful of common causes — mismatched Reply URLs, missing user assignments, outdated certificates, or incorrect SAML bindings. Knowing where to look can dramatically reduce troubleshooting time.

If you’re responsible for enterprise identity, cloud infrastructure, or application security, mastering Microsoft Entra ID SAML SSO is an essential skill that will help you deploy secure, scalable authentication across your organization.

Did you find this guide helpful? Share your experiences with Microsoft Entra ID SAML integrations in the comments. What was the trickiest issue you encountered, and how did you solve it?