> ## Documentation Index > Fetch the complete documentation index at: https://docs.plerion.com/llms.txt > Use this file to discover all available pages before exploring further. # Azure single sign-on > Set up Microsoft Entra ID single sign-on (SSO) with Plerion using SAML and role-based access control (RBAC). With the **Azure single sign-on (SSO)** integration, you can enable secure authentication to Plerion through Microsoft Entra ID. This setup uses SAML and role-based access control (RBAC) to map Azure users and roles to Plerion roles. ## Steps to configure Azure SSO Sign in to your Azure account with the required roles and permissions. * Go to `Enterprise applications` and click `New application`. * Select `Create your own application`, enter a name, and choose `Non-gallery`. Microsoft Entra ID Enterprise Applications showing option to create your own non-gallery application * In the application, go to `Single sign-on` and select `SAML`. * In Plerion, go to `Admin` > `Single sign-on` and copy the **SSO URL**. * In Azure, under `Basic SAML Configuration`, paste the URL as both **Entity ID** and **Reply URL (Assertion Consumer Service URL)**. * Save the configuration. Microsoft Entra ID SAML configuration screen with Entity ID and Reply URL fields * Go to `App registrations`, find the application, and open it. * Under `App roles`, create two new roles: * **Org.Admin** * **Tenant1.Read** Microsoft Entra ID app roles configuration with Org.Admin and Tenant1.Read * Go back to `Enterprise applications`, open the application, and go to `Users and groups`. * Click `+ Add user/group` and add two test users. Assign **Tenant1.Read** to one and **Org.Admin** to the other. Microsoft Entra ID user and group assignment page with role selection In the application’s `Single sign-on` page, download the **Certificate (Base64)** and copy the values for **Login URL** and **Microsoft Entra Identifier**. Microsoft Entra ID SSO configuration showing certificate and identifiers In Plerion, go to `Admin` > `Single sign-on` > `Edit` > `Trust`. * Paste **Login URL** into **Single Sign-On URL** * Paste **Microsoft Entra Identifier** into **Identity Provider Entity ID** * Paste the contents of the **Certificate (Base64)** file into **x.509 Certificate**\ Click `Configure` to save. Configure trust in Plerion for SSO In `Attribute mapping`: * For **Email**, select **Use SAML Name ID**. * For **Display name**, leave unchecked to let users choose their own, or map the Azure display name if required. * For **Roles**, set the SAML attribute to\ `http://schemas.microsoft.com/ws/2008/06/identity/claims/role`\ Map **Org.Admin** and **Tenant1.Read** to the corresponding Plerion roles. Microsoft Entra ID role attribute mapping screen * Open a new browser session and go to [My Apps](https://myapps.microsoft.com/). * Sign in as one of the users you added and verify that you can log in to Plerion using Azure SSO. ## Create users at first sign-in `Create users at first sign-in` controls just-in-time provisioning. When it is on, a person who signs in through Microsoft Entra ID and has no Plerion user gets one created for them, with the display name and roles your attribute mappings produce. Find it in Plerion under `Admin` > `Security` > `Single sign-on`. It is **on by default**, and it is the only thing that decides whether sign-in may create a user. Turn it off when something else already provisions them, such as [SCIM](/guides/administration/scim/overview) or your own calls to the organization API. Leaving it on alongside either one lets a successful sign-in create a user your directory never meant to give access to. With it off, someone who signs in but has no Plerion user is stopped with this message: > Your account has not been set up in Plerion. Ask your administrator to create it. This documentation is built and hosted on [Mintlify](https://mintlify.com), a developer documentation platform.