Microsoft Entra ID as identity provider for SSOGEN

OpenID Connect (app registration)

1. In SSOGEN, open SSO policies > Identity providers, Add identity provider, the Microsoft Entra ID card, choose OpenID Connect, type your Directory (tenant) ID and Continue. On Client credentials, copy the Redirect URI, for example https://acme.ssogen.ai/oidc/rp/entra/callback.
2. In the Microsoft Entra admin center, open Entra ID > App registrations > New registration. Name it SSOGEN, choose the single-tenant account type (accounts in this organizational directory only) and select Register.
3. On Overview, copy the Application (client) ID.
4. Open Authentication, Add Redirect URI, choose Web, paste the redirect URI and select Configure. Do not tick the implicit grant boxes.
5. Open Certificates & secrets > Client secrets > New client secret, choose an expiry and select Add. Copy the Value at once; it is not shown again.
6. To limit who may sign in, open the matching entry under Entra ID > Enterprise apps, set Assignment required to Yes under Properties, and add people or groups under Users and groups.

SAML (enterprise application)

1. In SSOGEN, choose the Microsoft Entra ID card, then SAML, and copy the SP entity ID and ACS URL (Add a SAML identity provider in SSOGEN, section 1).
2. In the Entra admin center, open Entra ID > Enterprise apps > New application. SSOGEN is in the gallery: search for SSOGEN, select it and Create. To set it up by hand instead, choose Create your own application, name it, choose Integrate any other application you don’t find in the gallery (Non-gallery) and Create.
3. Open Single sign-on and choose SAML. In Basic SAML Configuration select Edit:

4. In Attributes & Claims, keep the defaults: Entra sends emailaddress and name under the names SSOGEN expects. The Unique User Identifier (Name ID) defaults to the user principal name, a good stable choice.
5. In SAML Certificates, keep Signing Option at Sign SAML assertion (or Sign SAML response and assertion) and copy the App Federation Metadata Url.
6. Under Users and groups, assign the people or groups who may use SSOGEN.

• OpenID Connect from the template: the provider admits Anyone this provider vouches for, with the required claim tid equal to your tenant ID. A sign-in issued by any other tenant is refused. Guests invited into your tenant sign in through your tenant, so control them with Assignment required in Entra. Each person gets an SSOGEN account at first sign-in, named after preferred_username, which for Entra is the user principal name, for example john.doe@acme.example.
• SAML: a new SAML provider admits nobody until you choose. On Configuration > Sign-in restriction, choose Anyone this provider vouches for and add the required claim http://schemas.microsoft.com/identity/claims/tenantid with your tenant ID. The SSOGEN username comes from the NameID, for example entra_john.doe_acme.example.
• People who already have an SSOGEN account: a Super admin turns on account matching by email address. Entra sends a verified-email claim only for some account types, so read section 6 of the OpenID Connect or SAML page before you rely on it.