Skip to main content

Single Sign-On (SSO) with SAML via Microsoft Entra ID

Set up Single Sign-On (SSO) for revel8 using Microsoft Entra ID (formerly Azure AD)

👍 1: Enable single sign-on with SAML

  1. In Microsoft Entra ID, go to your Enterprise Application for Company Shield

  2. Click on Single sign-on → SAML

🧑‍🔧 2. Configure SAML URLs

  1. Click on Edit next to Basic SAML Configuration

  2. In a separate tab, open the revel8 dashboard and go to Settings → Integrations → Access Controls tab

  3. Copy and paste the following:

  • Entity ID → Paste in Microsoft Entra from revel8's Entity ID

  • Reply URL (ACS) → Paste in Microsoft Entra from revel8's ACS URL

4. Click Save in the Microsoft Entra portal

⚙️ 3: Install SAML Certificate

  1. In the SAML Certificates section of Microsoft Entra: Click Download next to Federation Metadata XML

  2. Go back to revel8 → Settings → Integrations → Access Controls tab: Upload the downloaded .xml file in the Metadata file section

📌 4: Attributes and Claims

In most cases, default settings work without changes. If needed, go to the Attributes and Claims section to adopt the standard setting.

❗ http://schemas.xmlsoap.org/ws/2005/05/identity/claims/emailaddress (required)

🔹 http://schemas.xmlsoap.org/ws/2005/05/identity/claims/givenname (optional)

🔹 http://schemas.xmlsoap.org/ws/2005/05/identity/claims/name (optional)

🔹 http://schemas.xmlsoap.org/ws/2005/05/identity/claims/surname (optional)

➕ 5: Assign Users and Groups

Go to Users and groups → click Add user/group, and select your users.

🔑 6: Group to Role Mappings (Optional)

Once SAML is active, you can automatically assign revel8 roles based on your Entra ID groups. This eliminates the need to manually assign roles to each user after login.

  1. In revel8, go to Settings → Integrations → Access Controls tab

  2. Scroll to the Group to Role Mappings section

  3. Click Add Mapping to add a new row

  4. Enter the IdP Group Name exactly as it appears in your Entra ID

  5. Select the corresponding revel8 role from the dropdown: EMPLOYEE, EDITOR, CISO, or DIRECTOR

  6. Repeat for each group you want to map, then click Save Mappings

💡 Tip

You can add multiple mappings. Users in a mapped group will automatically receive that role upon login. Users not matched to any mapping default to the EMPLOYEE role.

🛡️ 7: Disable Password Login (Optional)

Once SAML is active, you can optionally disable password-based login to enforce SSO as the only login method for your organization.

  1. In revel8, go to Settings → Integrations → Access Controls tab

  2. Under the SAML status section (visible once SAML is active), check the Password login disabled checkbox
    ​

⚠️ Important

Disabling password login means users can only log in via SAML SSO. Ensure your SAML configuration is fully tested before enabling this to avoid locking users out.

✅ Final Checklist

  • SAML URLs configured in Microsoft Entra

  • Metadata file downloaded from Entra and uploaded to revel8 via Settings → Integrations → Access Controls

  • Attributes and Claims checked

  • Users and Groups assigned in Entra

  • Group to Role Mappings configured (optional)

  • Password login disabled if enforcing SSO-only (optional)

  • Test login successful

Related Articles
Single Sign-On (SSO) with SAML via Google Workspace
Microsoft Entra ID Sync via SCIM
Microsoft Entra ID - Enterprise Application Scoping Filter
Did this answer your question?