Skip to main content
With the Azure single sign-on (SSO) integration, you can enable secure authentication to Plerion through Microsoft Entra ID. This setup uses SAML and role-based access control (RBAC) to map Azure users and roles to Plerion roles.

​
Steps to configure Azure SSO

1

Log in to Microsoft Entra ID

Sign in to your Azure account with the required roles and permissions.
2

Create a new enterprise application

  • Go to Enterprise applications and click New application.
  • Select Create your own application, enter a name, and choose Non-gallery.
Microsoft Entra ID Enterprise Applications showing option to create your own non-gallery application
3

Set up single sign-on

  • In the application, go to Single sign-on and select SAML.
  • In Plerion, go to Admin > Single sign-on and copy the SSO URL.
  • In Azure, under Basic SAML Configuration, paste the URL as both Entity ID and Reply URL (Assertion Consumer Service URL).
  • Save the configuration.
Microsoft Entra ID SAML configuration screen with Entity ID and Reply URL fields
4

Register app roles

  • Go to App registrations, find the application, and open it.
  • Under App roles, create two new roles:
    • Org.Admin
    • Tenant1.Read
Microsoft Entra ID app roles configuration with Org.Admin and Tenant1.Read
5

Assign users and groups

  • Go back to Enterprise applications, open the application, and go to Users and groups.
  • Click + Add user/group and add two test users. Assign Tenant1.Read to one and Org.Admin to the other.
Microsoft Entra ID user and group assignment page with role selection
6

Download SAML certificate and identifiers

In the application’s Single sign-on page, download the Certificate (Base64) and copy the values for Login URL and Microsoft Entra Identifier.
Microsoft Entra ID SSO configuration showing certificate and identifiers
7

Configure trust in Plerion

In Plerion, go to Admin > Single sign-on > Edit > Trust.
  • Paste Login URL into Single Sign-On URL
  • Paste Microsoft Entra Identifier into Identity Provider Entity ID
  • Paste the contents of the Certificate (Base64) file into x.509 Certificate
    Click Configure to save.
Configure trust in Plerion for SSO
8

Map attributes and roles

In Attribute mapping:
  • For Email, select Use SAML Name ID.
  • For Display name, leave unchecked to let users choose their own, or map the Azure display name if required.
  • For Roles, set the SAML attribute to
    http://schemas.microsoft.com/ws/2008/06/identity/claims/role
    Map Org.Admin and Tenant1.Read to the corresponding Plerion roles.
Microsoft Entra ID role attribute mapping screen
9

Test your Azure SSO connection

  • Open a new browser session and go to My Apps.
  • Sign in as one of the users you added and verify that you can log in to Plerion using Azure SSO.

​
Create users at first sign-in

Create users at first sign-in controls just-in-time provisioning. When it is on, a person who signs in through Microsoft Entra ID and has no Plerion user gets one created for them, with the display name and roles your attribute mappings produce. Find it in Plerion under Admin > Security > Single sign-on. It is on by default, and it is the only thing that decides whether sign-in may create a user. Turn it off when something else already provisions them, such as SCIM or your own calls to the organization API. Leaving it on alongside either one lets a successful sign-in create a user your directory never meant to give access to. With it off, someone who signs in but has no Plerion user is stopped with this message:
Your account has not been set up in Plerion. Ask your administrator to create it.