How to Configure SAML SSO for MS Entra ID (Azure AD)

In this article, we will walk through the required steps to integrate your MS Entra ID (Azure AD) with Chili Piper.

Table of Contents

• Things to Know
• How to Configure SAML SSO for MS Entra ID

Things to Know

• You must be a Chili Piper admin to enable Single Sign-On (SSO).
• You must use the same email address for both Chili Piper and your IdP.
• Chili Piper supports any enterprise identity provider (IdP) using the SAML 2.0 protocol.

How to Configure SAML SSO for MS Entra ID

In the Command Center, access SAML Configuration by clicking Integrations in the left-side menu and clicking the Single Sign-On tab. Then click Connect on the Single Sign-On card.

Before you can begin Step 1 to configure SAML for MS Entra ID, please ensure the following:

• If you have not already, you must create Chili Piper as a new Enterprise Application in MS Entra ID.
• If your MS Entra ID application has restrictions for users, assign users or groups to the Chili Piper application you have created so they can use Chili Piper.
  
  

Step 1

In MS Entra ID (Azure AD), go to the Single sign-on settings of your newly created application.

Copy and Paste the fields from Chili Piper into Azure. These URLS cannot be edited in any way or they will not work.

Please note that each Reply URL (Assertion Consumer Service URL) field must be completed:

• The one marked as Default must contain the /clients/common suffix and
• The other one must not contain the suffix

Setting Up Attributes & Claims in MS Entra ID

In Attributes & Claims, click edit. Make sure the following Claims are created:

Add a New Claim and use the table above to create each claim:

You MUST CLICK SAVE after creating claims

Once all Claims have been created, they will appear in section 2 of the SAML setup in MS Entra

Recommended: Send a Stable, Immutable NameID

In the same Attributes & Claims screen (Entra admin center > Enterprise apps > All applications > [your app] > Single sign-on > Attributes & Claims > Edit), the NameID row is labeled Unique User Identifier (Name ID):

• Set the Source attribute to user.objectid (all lowercase, with the user. prefix — not user.objectId). Microsoft describes objectid as "an immutable, globally unique, and reuse-safe identifier." pairwiseid ("the persistent form of user identifier") is an alternative.
• Set Name identifier format to Persistent (or Default) rather than Email address. The available options are Default, Persistent, Email address, Unspecified, and Windows domain qualified name.
• Keep email as its own claim (user.mail or user.userprincipalname) — these are the mutable values you are steering away from for the NameID.

For more information, see Microsoft's SAML token claims customization documentation.

Step 2

Copy the App Federation Metadata URL from MS Entra ID

Paste to Metadata URL field in Chili Piper in the Step 2 section of the IdP setup:

In Chili Piper, click Test Connection, and you will be directed to your IdP login screen. You must log into your IdP using the same credentials that you are logged into Chili Piper.

If the Connection is successful, you will be redirected back to Chili Piper to enforce SSO for all users.

If you want to enforce your users only logging in via your IdP, you can opt to do this now. This option will only be available if testing the connection in Step 2 is successful.

Reference file: how-to-configure-saml-sso-for-ms-entra-id-azure-ad.md (https://help.chilipiper.com/hc/article_attachments/53436207772563)