Adding the SMA Application to Microsoft Entra ID (Azure AD)

After you configure Microsoft Entra ID as an SMA Authentication Server, you need to add the SMA application to the Microsoft Entra ID service.

To add the SMA application to the Microsoft Entra ID service, do the following

1. Login to Azure Portal.

2. Select Azure Active Directory > Enterprise applications.

3. Click New application> Create your own application.

4. Enter the name of the application, and select the Integrate any other application you don't find in the gallery (Non-gallery) option.

5. Click Create.

6. In the Manage > Single sign-on, and then select SAML.

7. Click upload metadata file and browse to upload the .xml file downloaded in Configuring Microsoft Entra ID (Azure AD) as an SMA Authentication Server.

8. Click Add to upload the xml file.

9. Review the Identifier (Entity ID) and Reply URL.

10. Click Save.

11. If needed, under Attributes and Claims, edit the required attributes. If you need to send group information to SMA (for example, if an on-premise AD is not available), refer to Sending User Groups to SMA.

12. Under SAMLCertificates, download the Federation Metadata XML.

    The .xml file is downloaded.

    For the most current information for configuring Azure, refer to

    https://learn.microsoft.com/en-us/entra/identity/enterprise-apps/add-application-portal-setup-sso.

13. Return to the SMA authentication server configuration page you started in Configuring Microsoft Entra ID (Azure AD) as an SMA Authentication Server, and continue with the following steps.

14. Under Identity Provider Configuration, click Choose File and select the metadata.xml file you downloaded from Microsoft Entra ID.

    

15. Click Import.

    1. All the IdP configuration fields are automatically populated with the values contained in the metadata, including the IdP signing certificate. The Server ID, Authentication Service URL, and Trust the Following Certificate fields are populated automatically based on the imported metadata, eliminating the need for manual entry.

       During metadata import, the IdP signing certificate is added to SSL Settings > CA Certificates as a trusted CA certificate with SAML Message Verification enabled. Any certificates imported for SAML verification are displayed in the CA Certificates list.

       The Logout Service URL controls Single Logout (SLO) behavior. If a Logout Service URL is configured, signing out of the application also terminates the user's session with the SAML Identity Provider. If this field is left blank, only the application session is terminated, while the user's IdP session remains active.

    2. SMA supports group-based authorization through SAML authentication, allowing administrators to manage user access based on group membership even when an on-premises Active Directory is not available. In the SAML Claim Containing User Groups field, specify the name of the SAML attribute or claim that contains the user's group membership information. For example: http://schemas.microsoft.com/ws/2008/06/identity/claims/groups

       SMA uses the values provided in this claim to determine the user's group memberships and apply the corresponding access controls.

       The SAML Claim Containing User Groups field must be configured with the name of the SAML attribute that carries group membership information. For more information, see Group Management with SAML IdP authentication server.

    3. Enable Force Users to Re-authenticate to require users to enter their credentials each time they sign in to SMA. When this option is enabled, SMA requests fresh authentication from the Identity Provider and does not rely on an existing IdP session.

16. Click Save.