# Azure Configuration

FSProtect can be integrated with the Azure SSO to simplify authentication. The following configurations must be completed for integration:

### 1. Create an Enterprise Application

* Go to [**https://portal.azure.com**](https://portal.azure.com/) and log in.

<figure><img src="/files/qEQuQeYYmEFICxmIWsTO" alt=""><figcaption><p>In Menu Select Microsoft Entra ID</p></figcaption></figure>

* Navigate to **Microsoft Entra ID** > **Enterprise applications**.

<figure><img src="/files/tYciqZJ6tH4tUyMwjNMh" alt=""><figcaption><p>In Menu Select Enterprise Applications</p></figcaption></figure>

* Click on **"New application"**.

<figure><img src="/files/LgAL5i2V2gsRktsw0Iou" alt=""><figcaption><p>Click "New Application"</p></figcaption></figure>

* Select **"Create your own application"**.

<figure><img src="/files/ahMq3pqDDCYnNEoZYOBn" alt=""><figcaption><p>Click "Create your own application" button</p></figcaption></figure>

* Provide a **name** for your app (e.g., `fsprotect-SSO`).
* Choose the option: **"Integrate any other application you don’t find in the gallery (Non-gallery)"**
* Click **Create**.

<figure><img src="/files/j01SUqmyfhHeObQQGgF1" alt=""><figcaption><p>Create your new application menu</p></figcaption></figure>

{% hint style="info" %}
At this point, your custom application will be created and added under Enterprise Applications.
{% endhint %}

### 2. Set Up Single Sign-On (SAML)

* In the left menu of the application page, select **Single sign-on** or select **Set up single sign-on** after creating app.

<figure><img src="/files/MHnP3tEUUFu0egpEd5Gv" alt=""><figcaption><p>Set up single sign on</p></figcaption></figure>

* Choose **SAML** as the single sign-on method.

<figure><img src="/files/YLIxR3xY5dD2jcKN77fg" alt=""><figcaption><p>Select "SAML" from menu</p></figcaption></figure>

* You will now see multiple sections, including:
  * Basic SAML Configuration
  * Attributes & Claims
  * SAML Signing Certificate
  * Set up \[App Name]

### 3. Configure Attributes & Claims

* In the **Attributes & Claims** section, click **Edit**.

<figure><img src="/files/ozD3D27wryWGT0liMFzy" alt=""><figcaption><p>Click "Edit" Button</p></figcaption></figure>

* Review the default claims (such as `email`, `givenname`, `surname`, etc.).
* To add a custom claim:
  * Click **Add new claim**
  * Enter a **Name** (e.g., `username`)
  * Choose the appropriate **Source** (e.g., user attribute or transformation)
  * For user attributes, select from available directory attributes like `user.mailnickname` etc.
  * Click **Save**

<figure><img src="/files/IjDfQai0a26yjPnJvTme" alt=""><figcaption><p>Click "Add new claim" button</p></figcaption></figure>

<figure><img src="/files/YEXLPWsYZ1J0YQBXeAsv" alt=""><figcaption><p>Fill claim informations for username</p></figcaption></figure>

* Do the same things for the `role`:
  * Enter a **Name** (e.g., `username`)
  * Choose the appropriate **Source** (e.g., user attribute or transformation)
  * For user attributes, select from available directory attributes like `user.assignedroles` etc.

<figure><img src="/files/kvTBi0dG7Miu0D473EyD" alt=""><figcaption><p>Fill claim informations for username for role</p></figcaption></figure>

### 4. Configure Basic SAML Settings

* Click **Edit** in the **Basic SAML Configuration** section.

<figure><img src="/files/fMHpppJWo1W3jOZNaYCe" alt=""><figcaption><p>Basic SAML Configuration</p></figcaption></figure>

* Fill in the required fields on the Basic SAML Configuration based on the `Settings` > `SSO` > `SSO Details` on the FSProtect.

<figure><img src="/files/zHQcwhOyJfx8UPjmTC1D" alt=""><figcaption><p>ACS Url and Audience (Entity ID) from SSO page</p></figcaption></figure>

<figure><img src="/files/xuG0mMqDPbNkbHHVqEoi" alt=""><figcaption><p>Basic SAML Configuration sidebar</p></figcaption></figure>

| Field                      | Description                                            | Example                                                  |
| -------------------------- | ------------------------------------------------------ | -------------------------------------------------------- |
| **Identifier (Entity ID)** | Unique URI identifying your SP                         | `http://{baseURL}/api/v1/sso/{ssoProviderName}/metadata` |
| **Reply URL (ACS URL)**    | Endpoint where SAML assertions are sent (POST binding) | `http://{baseURL}/api/v1/sso/{ssoProviderName}/acs`      |

### 5. Download SAML Metadata XML

* Scroll to the **SAML Signing Certificate** section.
* Locate the **Federation Metadata XML** link.
* Click **Download**.

<figure><img src="/files/xDAQS0zoPWIQ6yy9FG9Q" alt=""><figcaption><p>SAML Certificates</p></figcaption></figure>

{% hint style="info" %}
Save this XML file securely. It will be used to configure the SSO of your SAML integration.
{% endhint %}


---

# Agent Instructions: Querying This Documentation

If you need additional information that is not directly available in this page, you can query the documentation dynamically by asking a question.

Perform an HTTP GET request on the current page URL with the `ask` query parameter:

```
GET https://docs.forestall.io/fsprotect/settings/sso/azure-configuration.md?ask=<question>
```

The question should be specific, self-contained, and written in natural language.
The response will contain a direct answer to the question and relevant excerpts and sources from the documentation.

Use this mechanism when the answer is not explicitly present in the current page, you need clarification or additional context, or you want to retrieve related documentation sections.