> For the complete documentation index, see [llms.txt](https://docs.docontrol.io/docontrol-user-guide/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://docs.docontrol.io/docontrol-user-guide/system-management/settings/single-sign-on-sso/entra-id-sso.md). # Entra ID SSO Microsoft Entra ID (previously Azure AD) is a Microsoft identity solution that’s used to secure and manage millions of apps with single sign-on (SSO). Using Entra ID as an SSO significantly reduces the risk of access credentials being lost or stolen, ensuring optimal security when logging into DoControl. To integrate DoControl with Microsoft Entra ID, you need to: * [Create an Entra ID connection](#create-entra-id-connection) * [Configure SAML connection](#configure-saml-connection) * [Add a generic SAML connection](#add-generic-saml-connection) {% hint style="info" %} After you configure Microsoft Entra ID, you can use your Entra ID credentials to login via DoControl. Note that DoControl supports only service provider initiated SSO via DoControl's login page. {% endhint %} ## Create Entra ID connection 1. Login to your Microsoft Entra admin center - 2. Navigate to **Entra services >** [**Enterprise applications**](https://entra.microsoft.com/#view/Microsoft_AAD_IAM/StartboardApplicationsMenuBlade/~/AppAppsPreview).

3. Click **New application**.

4. Click **Create your own application**.

5. Enter a name for your new app.\ Make sure you select **Integrate any other application you don’t find in the gallery (Non-gallery)**. 6. Click **Create**.\ When the application Overview page displays, the application is created.

7. Click **Assign users and groups**.

8. Click **+Add user/group >** **Users and groups (None selected)**. 9. Assign and add the relevant people or groups to connect DoControl with Microsoft Entra ID. Make sure that all listed people and groups exist in DoControl as team members. Indicate that user names are case-sensitive.

## Configure SAML connection Follow these procedures to set up your SAML connection in Microsoft Entra ID: * [Basic SAML configuration](#basic-saml-configuration) * [Attributes and claims](#attributes-and-claims) * [SAML certificates](#saml-certificates) * [Entra ID user properties](#entra-id-user-properties) ### Basic SAML configuration 1. In the left menu, click **Single sign-on** and select the **SAML** tile. 2. Go to **Set up Single Sign-On with SAML > section 1 - Basic SAML Configuration.**

3. Enter the values listed below:

Parameter	Value
Identifier (entity ID)	`urn:amazon:cognito:sp:us-east-1_Tx9u9xQ4d`
Reply URL (Assertion Consumer Service URL)	`https://docontrol-main.auth.us-east-1.amazoncognito.com/saml2/idpresponse`
Sign on URL (optional)	`https://app.docontrol.io/login`

### Attributes and claims 1. Go to **section 2 - Attributes & Claims.** 2. Make sure the Unique User Identifier (name ID) is: `user.userprincipalname`.

3. Under Additional claims, click **Edit** next to each claim.

4. Verify that the values for each additional claim are displayed as below:

Name	Namespace	Source attribute
emailaddress	http://schemas.xmlsoap.org/ws/2005/05/identity/claims	user.userprincipalname
emailaddress	http://schemas.xmlsoap.org/ws/2005/05/identity/claims/emailaddress	user.mail
givenname	http://schemas.xmlsoap.org/ws/2005/05/identity/claims	user.givenname
surname	http://schemas.xmlsoap.org/ws/2005/05/identity/claims	user.surname

### SAML certificates 1. In **section 3 - SAML Certificates**, copy the `App Federation Metadata URL`. 2. Keep this for later when you add a new generic SAML connection in DoControl.

### Entra ID user properties Verify that your Microsoft Entra ID user properties are populated:

1. In Microsoft Entra ID, go to **User > Overview > Properties**. 2. Enter your first name and last name. 3. For the User principal name, enter your organization email. This email must be the same as the email you use to login to DoControl. ## Add generic SAML connection SAML (Security Assertion Markup Language) 2.0 is an open standard that allows DoControl to connect to your organization's IdP, such as Entra ID. SAML makes single sign-on (SSO) possible by authenticating a user once and then communicating that authentication to DoControl. {% hint style="success" %} To enable users to login to DoControl with their Entra ID credentials, follow the instructions to configure a [generic SAML](/docontrol-user-guide/system-management/settings/single-sign-on-sso/generic-saml.md). {% endhint %} --- # Agent Instructions This documentation is published with GitBook. GitBook is the documentation platform designed so that both humans and AI agents can read, navigate, and reason over technical content effectively. Learn more at gitbook.com. ## Querying This Documentation If you need additional information that is not directly available in this page, you can query the documentation by asking a question. Perform an HTTP GET request on the following URL with the `ask` and `goal` query parameters: ``` GET https://docs.docontrol.io/docontrol-user-guide/system-management/settings/single-sign-on-sso/entra-id-sso.md?ask=&goal= ``` `ask` is the immediate question: it should be specific, self-contained, and written in natural language. `goal` is what the user is ultimately trying to achieve, the reason they need the answer. Sharing it helps GitBook give you a better, more relevant answer. A goal is most helpful when it describes the outcome the user wants rather than restating the question. For example, with `ask=how do I create an API token`, a goal like `automate deployments from our CI pipeline` lets GitBook tailor the answer to that use case. The response will contain a direct answer to the question and relevant excerpts and sources from the documentation. Use this mechanism when the answer is not explicitly present in the current page, you need clarification or additional context, or you want to retrieve related documentation sections.