SSO
      Back to home
      1. Fluint Help Center
      2. Admin Setup for Team Licenses
      3. SSO

      Configuring SSO with Microsoft Entra ID (Azure AD)

      This guide covers setting up SSO with Microsoft Entra ID using either SAML or OIDC protocols.

      Prerequisites

      • Global Administrator or Application Administrator role in Azure AD
      • Completed Step 1 from the main SSO setup guide
      • Your Fluint callback URL: https://app.fluint.io/auth/sso-callback

      Option 1: SAML Configuration (Recommended)

      Step 1: Create Enterprise Application

      1. Sign in to the Azure Portal
      2. Navigate to Azure Active Directory > Enterprise applications
      3. Click New application
      4. Click Create your own application
      5. Enter name: Fluint
      6. Select Integrate any other application you don't find in the gallery
      7. Click Create

      Step 2: Configure Single Sign-On

      1. In your new Fluint application, go to Single sign-on
      2. Select SAML
      3. Click Edit on Basic SAML Configuration

      Step 3: Basic SAML Configuration

      Identifier (Entity ID): https://app.fluint.io

      Reply URL (Assertion Consumer Service URL): https://app.fluint.io/auth/sso-callback

      Sign on URL: https://app.fluint.io/login (optional)

      Relay State: Leave blank

      Logout URL: https://app.fluint.io/logout (optional)

      Click Save

      Step 4: Configure User Attributes & Claims

      Edit the User Attributes & Claims section:

      Required claim:

      • Name: http://schemas.xmlsoap.org/ws/2005/05/identity/claims/emailaddress
      • Source: Attribute
      • Source attribute: user.mail

      Additional claims (optional):

      • Name: http://schemas.xmlsoap.org/ws/2005/05/identity/claims/givenname
      • Source attribute: user.givenname
      • Name: http://schemas.xmlsoap.org/ws/2005/05/identity/claims/surname
      • Source attribute: user.surname

      Step 5: Get Configuration Details

      From the SAML Signing Certificate section:

      1. Download the Federation Metadata XML
      2. Or copy these individual values:
        • Login URL
        • Azure AD Identifier
        • Certificate (Base64)

      Step 6: Assign Users

      1. Go to Users and groups
      2. Click Add user/group
      3. Select users or groups who should access Fluint
      4. Click Assign

      Option 2: OIDC Configuration

      Step 1: Register Application

      1. In Azure Portal, go to Azure Active Directory > App registrations
      2. Click New registration
      3. Configure:
        • Name: Fluint
        • Supported account types: Accounts in this organizational directory only
        • Redirect URI: Web - https://app.fluint.io/auth/sso-callback

      Step 2: Configure Authentication

      1. Go to Authentication
      2. Under Redirect URIs, ensure https://app.fluint.io/auth/sso-callback is listed
      3. Under Implicit grant and hybrid flows, check ID tokens
      4. Click Save

      Step 3: Create Client Secret

      1. Go to Certificates & secrets
      2. Click New client secret
      3. Add description: Fluint SSO
      4. Choose expiration period
      5. Click Add
      6. Important: Copy the secret value immediately (it won't be shown again)

      Step 4: Configure API Permissions

      1. Go to API permissions
      2. Ensure these Microsoft Graph permissions are granted:
        • openid (delegated)
        • profile (delegated)
        • email (delegated)
        • User.Read (delegated)

      Step 5: Get Configuration Details

      From the Overview page, note:

      • Application (client) ID
      • Directory (tenant) ID
      • Client secret (from Step 3)

      Complete Setup in Fluint

      For SAML:

      • IdP SSO URL: Login URL from Azure AD
      • IdP Entity ID: Azure AD Identifier
      • X.509 Certificate: Certificate from Azure AD (Base64 format)

      For OIDC:

      • Client ID: Application (client) ID
      • Client Secret: The secret you created
      • Issuer URL: https://login.microsoftonline.com/{tenant-id}/v2.0
      • Authorization URL: https://login.microsoftonline.com/{tenant-id}/oauth2/v2.0/authorize
      • Token URL: https://login.microsoftonline.com/{tenant-id}/oauth2/v2.0/token
      • UserInfo URL: https://graph.microsoft.com/oidc/userinfo

      Replace {tenant-id} with your Directory (tenant) ID

      Testing Your Configuration

      1. Follow the testing steps from the main guide
      2. Verify users are redirected to Microsoft login page
      3. Confirm successful authentication returns them to Fluint

      Troubleshooting Azure AD

      Common issues:

      • Conditional Access policies may block access - Check your CA policies
      • User not assigned - Ensure users are assigned to the Fluint application
      • Wrong tenant - Verify you're configuring in the correct Azure AD tenant

      Next Steps