Microsoft Entra (Azure AD) as a SAML Identity Provider
To add Microsoft Entra (Azure AD) as a SAML 2.0 external integration, you must first register an app in Microsoft Entra (Azure AD) to enable trust with the service provider (Conga Auth Service). After creating an app, you need the Tenant ID, Metadata Location URL, and Organization ID Claim Type details.
Step 1: Register an app in Microsoft Entra (Azure AD)
- Log in to portal.azure.com.
- Select Microsoft Entra ID and go to Enterprise Applications.
- Click New Application, then click the Create your own application option.
- Enter the app name.
- Select the Integrate any other application you don't find in the gallery (Non-gallery) option.
- Click Create.
- Select the registered app.
- Go to Single Sign-on and select SAML.
- Click Upload metadata file and select the service provider metadata file. You can download the service provider metadata file either using the following URL per your environment or from the Add New External Integration screen > Download SP Metadata File button (refer to Step 3):
-
Preview Environment:
NA: https://login-rlspreview.congacloud.com/api/v1/auth/Saml2
-
Production Environment:
NA: https://login-rls.congacloud.com/api/v1/auth/Saml2
-
Preview Environment:
- After uploading the metadata file, you can see the Basic SAML Configuration screen, where all metadata settings get auto-filled.
- Click Save.
- Click Done.
Step 2: Get the Tenant ID, Metadata Location URL, and Organization ID Claim Type details
- Go to Enterprise Applications and select the registered app.
- Go to Single Sign-on and select SAML 2.0.
- Metadata Location URL: Under the SAML Certificate option, copy the App Federation Metadata Url which is the metadata location URL.
- Open the App Federation Metadata Url in any of the web browsers.
-
External ID: Get the value of the entityId attribute from the root node of the XML. Copy the last ID (tenant ID) value which is the external organization ID.
For example, if the entityId value is https://sts.windows.net/8831e6d9-dc6c-4cd1-9cc6-1dc2d4133195/, the tenant ID is 8831e6d9-dc6c-4cd1-9cc6-1dc2d4133195.
-
Organization ID Claim Type: Search for the tenantid claim; if it is available, use the URI attribute in the XML tag as the organization ID claim type. For example, http://schemas.microsoft.com/identity/claims/tenantid.Note:
If you don't see the TenantId, leave the Organization ID Claim Type field blank.
-
External ID: Get the value of the entityId attribute from the root node of the XML. Copy the last ID (tenant ID) value which is the external organization ID.
Step 3: Add Microsoft Entra (Azure AD) as an external integration
- Log in to the Conga Advantage Platform as an admin user.
- Click the App Launcher (
) icon from the top-left corner > Admin Console > Organization.
- Go to the External Integrations tab.
- Click Add New and choose the SAML 2.0 from the list.The Add New External Integration screen appears.
- Enter values in the following fields as per your SAML 2.0 external integration:
Field
Description
Download SP Metadata File
Click this button to download the SP metadata file that can be utilized in Step 1.
Choose IDP Metadata Setup
You can either enter the metadata location URL or upload the XML file.
- URL Input: Select this option and enter the App Federation Metadata Url that you copied in Step 2.
- XML File Upload: Select this option and upload your metadata XML file.
External Organization ID
Enter the external organization ID that you copied in Step 2.
Type
Enter the type of this integration. It is a free-form text field. You can add types such as Dev, QA, UAT, Prod, etc.
Organization ID Claim Type
Enter the organization ID claim type that you copied in Step 2.
Description
Add the description.
Email Domain
Enter the email domain you want to associate with designated IdP. It can be added for administrative purposes.
Display Name
Enter the display name for the identity provider.
Default IDP
Enable the toggle to make it a Default External Integration IDP.
A user will be created for the external integration set as the Default IdP for the organization. For example, if you have set Microsoft Entra (Azure AD), a SAML Identity Provider, as the Default IdP, all the new users will be created with Microsoft Entra (Azure AD).
- Click Save.
Review the step 4 if you want to configure the Single Sign-On (IdP-initiated flow).
-
Click the More (
) icon and select Edit.
-
Update the Choose IDP Metadata Setup, External Organization ID, Type, Organization ID Claim Type, Description, Email Domain, Display Name, and Default IDP fields per your business needs.
Note: You should change the External Organization ID if the Single Sign-On (SSO) external ID changes.
Step 4: Configure Single Sign-On (IdP-initiated flow)
- Go to Enterprise Applications.
- Select the registered app and navigate to Single Sign-on.
- Go to the Attributes and Claims section and add the following attribute as per your environment:
Attribute
Details
redirect_uri
Enter the Conga Advantage Platform App Url where the user should be redirected after authentication. Use the following URL per your environment:- Preview Environment:
NA: https://preview-rls09.congacloud.com
- Production Environment:
client_id
The SPA Client ID for logging in. Use the following client ID per your environment:
- Preview Environment:
NA: rls-preview-spa
EU: rls-previeweu-spa
AU: rls-previewau-spa
- Production Environment:
NA: rls-prod-spa
EU: rls-prodeu-spa
AU: rls-prodau-spa
- Preview Environment:
- Click Save.