Azure Configuration

FSProtect can be integrated with the Azure SSO to simplify authentication. The following configurations must be completed for integration:

1. Create an Enterprise Application

• Go to https://portal.azure.com and log in.

In Menu Select Microsoft Entra ID

• Navigate to Microsoft Entra ID > Enterprise applications.

In Menu Select Enterprise Applications

• Click on "New application".

Click "New Application"

• Select "Create your own application".

Click "Create your own application" button

• Provide a name for your app (e.g., fsprotect-SSO).

• Choose the option: "Integrate any other application you don’t find in the gallery (Non-gallery)"

• Click Create.

Create your new application menu

At this point, your custom application will be created and added under Enterprise Applications.

2. Set Up Single Sign-On (SAML)

• In the left menu of the application page, select Single sign-on or select Set up single sign-on after creating app.

Set up single sign on

• Choose SAML as the single sign-on method.

Select "SAML" from menu

• You will now see multiple sections, including:

  • Basic SAML Configuration

  • Attributes & Claims

  • SAML Signing Certificate

  • Set up [App Name]

3. Configure Attributes & Claims

• In the Attributes & Claims section, click Edit.

Click "Edit" Button

• Review the default claims (such as email, givenname, surname, etc.).

• To add a custom claim:

  • Click Add new claim

  • Enter a Name (e.g., username)

  • Choose the appropriate Source (e.g., user attribute or transformation)

  • For user attributes, select from available directory attributes like user.mailnickname etc.

  • Click Save

Click "Add new claim" button

Fill claim informations for username

• Do the same things for the role:

  • Enter a Name (e.g., username)

  • Choose the appropriate Source (e.g., user attribute or transformation)

  • For user attributes, select from available directory attributes like user.assignedroles etc.

Fill claim informations for username for role

4. Configure Basic SAML Settings

• Click Edit in the Basic SAML Configuration section.

Basic SAML Configuration

• Fill in the required fields on the Basic SAML Configuration based on the Settings > SSO > SSO Details on the FSProtect.

ACS Url and Audience (Entity ID) from SSO page

Basic SAML Configuration sidebar

Field	Description	Example
Identifier (Entity ID)	Unique URI identifying your SP	http://{baseURL}/api/v1/sso/{ssoProviderName}/metadata
Reply URL (ACS URL)	Endpoint where SAML assertions are sent (POST binding)	http://{baseURL}/api/v1/sso/{ssoProviderName}/acs

5. Download SAML Metadata XML

• Scroll to the SAML Signing Certificate section.

• Locate the Federation Metadata XML link.

• Click Download.

SAML Certificates

Save this XML file securely. It will be used to configure the SSO of your SAML integration.