Skip to main content
General

Set Up SSO (Single Sign On) with Microsoft through Saml

  1. Go to portal.azure.com and click on View for Manage Microsoft Entra ID

  2. Navigate to Enterprise applications

    azure_enterprise_applications.png

  3. Create a new enterprise application “Create your own application”


    Call it amberSSO, choose the third entry “Non-gallery” and click Create at the bottom.

IMPORTANT NOTE

This Enterprise Application must be a separate object from the app registration configured in https://helpcenter.amber.de/en/help/articles/8640472969501-set-up-azure-ad-application

  1. Set up Single Sign On. Go to the Single sign-on and then select Saml

    azure_single_sign_on_initial_step.png

  2. Input Identifier (Entity ID) and Reply URL (Assertion Consumer Service URL). These values are provided separately by the amber Team.

  3. Depending on the existing attributes/claims new claims might be needed after consultation with the amberSearch Team. In case of a hybrid setup, where local Active Directory is synchronized with Entra ID add the following claims.

    1. Edit the Attributes & Claims area

    2. Add new claims

      1. Name: http://schemas.xmlsoap.org/ws/2005/05/identity/claims/distinguishedname and Source attribute user.onpremisesdistinguishedname

      2. Name: http://schemas.xmlsoap.org/ws/2005/05/identity/claims/sid and Source attribute user.onpremisesecurityidentifier

    3. Save

  4. Go to Properties und set Assignment required to No

  • Navigate to Properties and look for Assignment required.

    • Setting this to No allows all users that have been added to this Enterprise Application to access amber. However, as amber uses a licensing model, this approach is generally not recommended.

  • Instead, keep Assignment required set on Yes and create a dedicated group in Entra, preferably with a name that clearly identifies it as related to amber.

  • Add all users who should have access to amber to this group.

  • Go to the amber enterprise application and assign the group under Users and groups.

  • Alternative: If your Entra license does not support group assignment to enterprise applications, you can manually assign individual users under Users and groups.

  1. Create an account for testing purposes, e.g amber@customername.com It will be used for verifying the correctness and maintaining the SSO flow. The credentials of this account should be provided to amber Team.

 

If you need assistance please reach out to us via IT@amber.de

Was this helpful?