Microsoft Entra ID SSO With SSOGEN

Microsoft Entra ID SSO works with SSOGEN over SAML or OpenID Connect. People keep their Entra password and Conditional Access rules, and SSOGEN accepts the signed answer.

Request a trial

Microsoft Entra ID SSO with SSOGEN keeps Entra as the place where employees authenticate. SSOGEN extends that sign-in to every application it protects, including Oracle E-Business Suite, PeopleSoft and JD Edwards behind the SSOGEN Web Agent.

Entra checks. Entra checks the password and any second step.
SSOGEN signs in. Once Entra vouches for the person, SSOGEN signs them in.
Two protocols. Connect Entra as a SAML provider or an OpenID Connect provider.

Both end the same way, with an account in SSOGEN and a session in My Apps.

Entra ID is the new name for Azure AD. The rename did not change the setup.

This page covers only the Entra parts: your choices, the values that cause most failures, and the errors you will see. The full wizard, field by field, is in the SAML guide and the OpenID Connect guide.

Choose SAML or OIDC for Entra

Without a strong reason either way, pick OpenID Connect.

OpenID Connect. It needs a client ID, a secret and one redirect address.
SAML. It swaps two addresses and a certificate, though Entra publishes the metadata for you.

	SAML	OpenID Connect
Where you create it in Entra	Enterprise applications, non-gallery application, Single sign-on	App registrations, new registration
What SSOGEN needs	The App Federation Metadata URL or the metadata XML file	The issuer, the client ID and a client secret
What expires	The signing certificate, which Entra rolls over	The client secret, at most 24 months
Who may sign in	Users and groups assigned to the enterprise application	Users assigned, when Assignment required is on
Email address	Sent by default as `emailaddress`	Sent only if the account has a mailbox or you add the `email` optional claim

SSOGEN’s Mapping step already uses the names Entra sends, so a standard setup needs no mapping changes. For more on the two protocols, read SAML vs OIDC.

What to set on the SAML side in Entra

Start the Add SAML Provider wizard in SSOGEN first. Once the connection ID is valid, SSOGEN shows the SP entity ID, the ACS URL and the SP metadata URL. Leave that tab open.

In the Entra admin center, create a non-gallery enterprise application and open Single sign-on, then SAML.
In Basic SAML Configuration, add SSOGEN’s SP entity ID as the Identifier and the ACS URL as the Reply URL. Leave Sign on URL, Relay State and Logout Url empty at first.
In Attributes & Claims, keep user.userprincipalname as the Name ID unless you have a better stable value. SSOGEN builds the username from the NameID, so it must not change for a person.
In SAML Certificates, keep Sign SAML assertion or Sign SAML response and assertion. SSOGEN always refuses an unsigned assertion; this check cannot be turned off.
Copy the App Federation Metadata Url and paste it into SSOGEN with Metadata URL and Fetch metadata.
Assign the people or groups who may sign in. Anyone unassigned hits an Entra error page before SSOGEN sees them.

Entra publishes its entity ID as https://sts.windows.net/<tenant-id>/. SSOGEN reads it from the metadata, so you do not type it.

What to set on the OIDC side in Entra

Under App registrations, register a new application. Pick the Web application type and paste SSOGEN’s redirect URI. Single tenant is the usual account type.
Copy the Application (client) ID and the Directory (tenant) ID.
Under Certificates & secrets, create a client secret and copy its Value right away. Do not copy the Secret ID.
Under Token configuration, add the optional claim email to the ID token.
In SSOGEN, the issuer is https://login.microsoftonline.com/<tenant-id>/v2.0.

SSOGEN keeps the client ID as a stored value.

Reference. You reference it as secret://stored/<id> from Settings > Secrets.
Rotation. You can rotate it without editing the provider.
Secret. The secret is encrypted when saved and never shown again.

Three Entra details that cause most failures

The issuer ends in /v2.0. The issuer in the discovery document must match what you type in SSOGEN, character for character. The tenant address without /v2.0 points to a different document with an issuer on a different host.

Sign-in is refused.

The secret has an end date. Entra issues and renews the secret, so create the new one in Entra before the old one expires.

Replace it in the provider’s Client credentials step, save a revision, then Validate, Test and Activate. People keep signing in on the old secret until you activate the revision.

The email claim is optional. An account without a mailbox signs in with no email address unless the email optional claim is on. In SAML, a person with no user.mail has no emailaddress either.

Pick a claim source that is filled in.

You can put a sign-in restriction on an Entra provider in SSOGEN.

The claim. Add the claim tid with your tenant ID as the only allowed value.
Other tenants. Anyone from another tenant who reaches the provider is turned away, and the audit log records why.
Account matching. A restriction on a required claim also lets you turn on account matching, which joins a sign-in to an existing account with the same verified email address.

Test it and read the errors

Select Validate, then Test, then Try signing in.
Sign in as a real person in the same browser.

The result page creates nothing. It shows the NameID, the attributes Entra sent and the ones SSOGEN would keep.

You see	Likely cause	Fix
`AADSTS50011`	The reply URL in the request does not match the one in Entra	Make the Reply URL equal SSOGEN’s ACS URL
`AADSTS700016`	Entra finds no application with that identifier	Make the Identifier equal SSOGEN’s SP entity ID
`AADSTS50105`	The person is not assigned to the application	Add them under Users and groups
The assertion’s signature did not verify	SSOGEN holds an old certificate	Fetch the metadata again and save a revision
The provider reports a different issuer	The issuer is missing `/v2.0`	Copy the issuer exactly as the discovery document shows it
People are created without an email address	The `email` claim is not sent	Add the optional claim, or map the right claim

Questions people ask

Is Microsoft Entra ID an identity provider?

Yes. It holds the accounts and checks the password. SSOGEN treats it like any other SAML or OpenID Connect identity provider. SSOGEN is also a full identity provider itself, if you prefer to keep all users in one place.

Does Entra ID support OpenID Connect?

Yes. Register an application, give it SSOGEN’s redirect URI and a client secret, and use the v2.0 issuer.

Can I require MFA for the applications SSOGEN protects?

Yes, in Entra. Conditional Access applies to the enterprise application or app registration. SSOGEN gets the answer only after Entra finishes, and the test result page shows how strong the sign-in was.

Where to go next

Every field. Read the SAML wizard guide or the OpenID Connect wizard guide.
Other providers. The identity provider hub compares the other providers.
Gallery. Microsoft lists SSOGEN in the Microsoft Entra gallery.
Oracle EBS. To protect Oracle E-Business Suite with Entra, see Oracle EBS Azure AD SSO.
Redirect errors. Paste the sign-in URL and the registered list into the AADSTS50011 redirect URI checker to see which part differs.