> For the complete documentation index, see [llms.txt](https://docs.forestall.io/fsprotect/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://docs.forestall.io/fsprotect/configuration-center/sso/azure-configuration.md). # Azure Configuration Forestall ISPM can be integrated with the Azure SSO to simplify authentication. The following configurations must be completed for integration: ### 1. Create an Enterprise Application * Go to [**https://portal.azure.com**](https://portal.azure.com/) and log in.

In Menu Select Microsoft Entra ID

* Navigate to **Microsoft Entra ID** > **Enterprise applications**.

In Menu Select Enterprise Applications

* Click on **"New application"**.

Click "New Application"

* Select **"Create your own application"**.

Click "Create your own application" button

* Provide a **name** for your app (e.g., `forestall-SSO`). * Choose the option: **"Integrate any other application you don’t find in the gallery (Non-gallery)"** * Click **Create**.

Create your new application menu

{% hint style="info" %} At this point, your custom application will be created and added under Enterprise Applications. {% endhint %} ### 2. Set Up Single Sign-On (SAML) * In the left menu of the application page, select **Single sign-on** or select **Set up single sign-on** after creating app.

Set up single sign on

* Choose **SAML** as the single sign-on method.

Select "SAML" from menu

* You will now see multiple sections, including: * Basic SAML Configuration * Attributes & Claims * SAML Signing Certificate * Set up \[App Name] ### 3. Configure Attributes & Claims * In the **Attributes & Claims** section, click **Edit**.

Click "Edit" Button

* Review the default claims (such as `email`, `givenname`, `surname`, etc.). * To add a custom claim: * Click **Add new claim** * Enter a **Name** (e.g., `username`) * Choose the appropriate **Source** (e.g., user attribute or transformation) * For user attributes, select from available directory attributes like `user.mailnickname` etc. * Click **Save**

Click "Add new claim" button

Fill claim informations for username

* Do the same things for the `role`: * Enter a **Name** (e.g., `username`) * Choose the appropriate **Source** (e.g., user attribute or transformation) * For user attributes, select from available directory attributes like `user.assignedroles` etc.

Fill claim informations for username for role

### 4. Configure Basic SAML Settings * Click **Edit** in the **Basic SAML Configuration** section.

Basic SAML Configuration

* Fill in the required fields on the Basic SAML Configuration based on the `Settings` > `SSO` > `SSO Details` in Forestall.

ACS Url and Audience (Entity ID) from SSO page

Basic SAML Configuration sidebar

| Field | Description | Example | | -------------------------- | ------------------------------------------------------ | -------------------------------------------------------- | | **Identifier (Entity ID)** | Unique URI identifying your SP | `http://{baseURL}/api/v1/sso/{ssoProviderName}/metadata` | | **Reply URL (ACS URL)** | Endpoint where SAML assertions are sent (POST binding) | `http://{baseURL}/api/v1/sso/{ssoProviderName}/acs` | ### 5. Download SAML Metadata XML * Scroll to the **SAML Signing Certificate** section. * Locate the **Federation Metadata XML** link. * Click **Download**.

SAML Certificates

{% hint style="info" %} Save this XML file securely. It will be used to configure the SSO of your SAML integration. {% endhint %}