> ## Documentation Index
> Fetch the complete documentation index at: https://docs.plerion.com/llms.txt
> Use this file to discover all available pages before exploring further.

# Azure single sign-on

> Set up Microsoft Entra ID single sign-on (SSO) with Plerion using SAML and role-based access control (RBAC).

With the **Azure single sign-on (SSO)** integration, you can enable secure authentication to Plerion through Microsoft Entra ID. This setup uses SAML and role-based access control (RBAC) to map Azure users and roles to Plerion roles.

## Steps to configure Azure SSO

<Steps>
  <Step title="Log in to Microsoft Entra ID">
    Sign in to your Azure account with the required roles and permissions.
  </Step>

  <Step title="Create a new enterprise application">
    * Go to `Enterprise applications` and click `New application`.
    * Select `Create your own application`, enter a name, and choose `Non-gallery`.

    <Frame>
      <img src="https://mintcdn.com/pleriondocs/vz5poGv_rKHfKnR0/images/onboarding/sso/azure-sso/azure-sso-non-gallery-option.png?fit=max&auto=format&n=vz5poGv_rKHfKnR0&q=85&s=8c185b3acdd3fcf905315e9e8455c6e0" alt="Microsoft Entra ID Enterprise Applications showing option to create your own non-gallery application" width="2878" height="1026" data-path="images/onboarding/sso/azure-sso/azure-sso-non-gallery-option.png" />
    </Frame>
  </Step>

  <Step title="Set up single sign-on">
    * In the application, go to `Single sign-on` and select `SAML`.
    * In Plerion, go to `Admin` > `Single sign-on` and copy the **SSO URL**.
    * In Azure, under `Basic SAML Configuration`, paste the URL as both **Entity ID** and **Reply URL (Assertion Consumer Service URL)**.
    * Save the configuration.

    <Frame>
      <img src="https://mintcdn.com/pleriondocs/vz5poGv_rKHfKnR0/images/onboarding/sso/azure-sso/azure-sso-saml-configuration.png?fit=max&auto=format&n=vz5poGv_rKHfKnR0&q=85&s=5acccbf2069400431c237937dd1d59b5" alt="Microsoft Entra ID SAML configuration screen with Entity ID and Reply URL fields" width="2352" height="870" data-path="images/onboarding/sso/azure-sso/azure-sso-saml-configuration.png" />
    </Frame>
  </Step>

  <Step title="Register app roles">
    * Go to `App registrations`, find the application, and open it.
    * Under `App roles`, create two new roles:
      * **Org.Admin**
      * **Tenant1.Read**

    <Frame>
      <img src="https://mintcdn.com/pleriondocs/vz5poGv_rKHfKnR0/images/onboarding/sso/azure-sso/azure-sso-app-roles.png?fit=max&auto=format&n=vz5poGv_rKHfKnR0&q=85&s=53ca547958b392872fbe580d29274ead" alt="Microsoft Entra ID app roles configuration with Org.Admin and Tenant1.Read" width="2120" height="660" data-path="images/onboarding/sso/azure-sso/azure-sso-app-roles.png" />
    </Frame>
  </Step>

  <Step title="Assign users and groups">
    * Go back to `Enterprise applications`, open the application, and go to `Users and groups`.
    * Click `+ Add user/group` and add two test users. Assign **Tenant1.Read** to one and **Org.Admin** to the other.

    <Frame>
      <img src="https://mintcdn.com/pleriondocs/vz5poGv_rKHfKnR0/images/onboarding/sso/azure-sso/azure-sso-add-user-group.png?fit=max&auto=format&n=vz5poGv_rKHfKnR0&q=85&s=afb260fc41b77e058f1cdc2ad4be21bf" alt="Microsoft Entra ID user and group assignment page with role selection" width="1508" height="748" data-path="images/onboarding/sso/azure-sso/azure-sso-add-user-group.png" />
    </Frame>
  </Step>

  <Step title="Download SAML certificate and identifiers">
    In the application’s `Single sign-on` page, download the **Certificate (Base64)** and copy the values for **Login URL** and **Microsoft Entra Identifier**.

    <Frame>
      <img src="https://mintcdn.com/pleriondocs/vz5poGv_rKHfKnR0/images/onboarding/sso/azure-sso/azure-sso-details.png?fit=max&auto=format&n=vz5poGv_rKHfKnR0&q=85&s=dea4262f3ae3ea01f062b6a5476c8fcc" alt="Microsoft Entra ID SSO configuration showing certificate and identifiers" width="2054" height="796" data-path="images/onboarding/sso/azure-sso/azure-sso-details.png" />
    </Frame>
  </Step>

  <Step title="Configure trust in Plerion">
    In Plerion, go to `Admin` > `Single sign-on` > `Edit` > `Trust`.

    * Paste **Login URL** into **Single Sign-On URL**
    * Paste **Microsoft Entra Identifier** into **Identity Provider Entity ID**
    * Paste the contents of the **Certificate (Base64)** file into **x.509 Certificate**\
      Click `Configure` to save.

    <Frame>
      <img src="https://mintcdn.com/pleriondocs/LLvs80U9ReK_NaMH/images/onboarding/sso/azure-sso/configure-sso-trust-on-plerion.png?fit=max&auto=format&n=LLvs80U9ReK_NaMH&q=85&s=6ced5d5542bd8b069b515aac8730353a" alt="Configure trust in Plerion for SSO" width="1935" height="1181" data-path="images/onboarding/sso/azure-sso/configure-sso-trust-on-plerion.png" />
    </Frame>
  </Step>

  <Step title="Map attributes and roles">
    In `Attribute mapping`:

    * For **Email**, select **Use SAML Name ID**.
    * For **Display name**, leave unchecked to let users choose their own, or map the Azure display name if required.
    * For **Roles**, set the SAML attribute to\
      `http://schemas.microsoft.com/ws/2008/06/identity/claims/role`\
      Map **Org.Admin** and **Tenant1.Read** to the corresponding Plerion roles.

    <Frame>
      <img src="https://mintcdn.com/pleriondocs/vz5poGv_rKHfKnR0/images/onboarding/sso/azure-sso/azure-sso-attribute-mapping.png?fit=max&auto=format&n=vz5poGv_rKHfKnR0&q=85&s=ba05876f26f5b42ca826945665ab1294" alt="Microsoft Entra ID role attribute mapping screen" width="2088" height="922" data-path="images/onboarding/sso/azure-sso/azure-sso-attribute-mapping.png" />
    </Frame>
  </Step>

  <Step title="Test your Azure SSO connection">
    * Open a new browser session and go to [My Apps](https://myapps.microsoft.com/).
    * Sign in as one of the users you added and verify that you can log in to Plerion using Azure SSO.
  </Step>
</Steps>