To add Microsoft Entra (Azure AD) as a SAML 2.0 external integration, you must first register an app in Microsoft Entra (Azure AD) to enable trust with the service provider (Conga Auth Service). After creating an app, you need the Tenant ID, Metadata Location URL, and Organization ID Claim Type details.

Step 1: Register an app in Microsoft Entra (Azure AD)

  1. Log in to portal.azure.com.
  2. Select Microsoft Entra ID and go to Enterprise Applications.
  3. Click New Application, then click the Create your own application option.
  4. Enter the app name.
  5. Select the Integrate any other application you don't find in the gallery (Non-gallery) option.
  6. Click Create.
  7. Select the registered app.
  8. Go to Single Sign-on and select SAML.
  9. Click Upload metadata file and select the service provider metadata file. You can download the service provider metadata file either using the following URL per your environment or from the Add New External Integration screen > Download SP Metdata File button (refer to Step 3):
  10. After uploading the metadata file, you can see the Basic SAML Configuration screen, where all metadata settings get auto-filled.
  11. Click Save.
  12. Click Done.

Step 2: Get the Tenant ID, Metadata Location URL, and Organization ID Claim Type details

  1. Go to Enterprise Applications and select the registered app.
  2. Go to Single Sign-on and select SAML 2.0.
  3. Metadata Location URL: Under the SAML Certificate option, copy the App Federation Metadata Url which is the metadata location URL.
  4. Open the App Federation Metadata Url in any of the web browsers.
    • External ID: Get the value of the entityId attribute from the root node of the XML. Copy the last ID (tenant ID) value which is the external ID. 
      For example, if the entityId value is https://sts.windows.net/8831e6d9-dc6c-4cd1-9cc6-1dc2d4133195/, the tenant ID is 8831e6d9-dc6c-4cd1-9cc6-1dc2d4133195.

    • Organization ID Claim Type: Search for the tenantid claim; if it is available, use the URI attribute in the XML tag as the organization ID claim type. For example, http://schemas.microsoft.com/identity/claims/tenantid.

      If you don't see the TenantId, leave the Organization ID Claim Type field blank.

Step 3: Add Microsoft Entra (Azure AD) as an external integration

  1. Log in to the Conga Platform as an admin user.
  2. Click the App Launcher () icon from the top-left corner > Admin Console > Organization.
  3. Go to the External Integrations tab.
  4. Click Add New.
    The Add New External Integration screen appears.

  5. Choose SAML 2.0 from the drop-down list.

  6. Enter values in the following fields as per your SAML 2.0 external integration:

    Field

    Description

    Choose IDP Metadata Setup

    You can either enter the metadata location URL or upload the XML file.

    • URL Input: Select this option and enter the App Federation Metadata Url that you copied in Step 2.
    • XML File Upload: Select this option and upload your metadata XML file.
    External ID

    Enter the External ID that you copied in Step 2.

    Type

    Enter the type of this integration. It is a free-form text field. You can add types such as Dev, QA, UAT, Prod, etc.

    Organization ID Claim Type

    Enter the organization ID claim type that you copied in Step 2.

    DescriptionAdd the description.
    Default IDP

    Enable the toggle to make it a Default External Integration IDP.

    A user will be created for the external integration set as the Default IdP for the organization. For example, if you have set Microsoft Entra (Azure AD), a SAML Identity Provider, as the Default IdP, all the new users will be created with Microsoft Entra (Azure AD).

  7. Click Save.

Review step 4 if you want to configure the Single Sign-On (IdP-initiated flow).

Step 4: Configure Single Sign-On (IdP-initiated flow)

  1. Go to Enterprise Applications.
  2. Select the registered app and navigate to Single Sign-on.
  3. Go to the Attributes and Claims section and add the following attribute as per your environment:
    AttributeDetails
    redirect_uri

    Enter the Conga RLS App Url where the user should be redirected after authentication. Use the following URL per your environment:

    client_id

    The SPA Client ID for logging in. Use the following client ID per your environment:

    • Preview Environment:
      NA: rls-preview-spa
      EU: rls-previeweu-spa
      AU: rls-previewau-spa
    • Production Environment:
      NA: rls-prod-spa
      EU: rls-prodeu-spa
      AU: rls-prodau-spa
  4. Click Save.