Set up SSO with Microsoft Entra ID
Connect Microsoft Entra ID to a Qualflare Enterprise workspace over SAML 2.0: create the enterprise app, exchange metadata, set SHA-256 signing and test.
Last updated
To set up single sign-on with Microsoft Entra ID for a Qualflare Enterprise workspace, create an enterprise application in Microsoft Entra ID, upload its metadata on the Qualflare Single Sign-On page, copy Qualflare's Entity ID and ACS URL into it, and run a test sign-in.
Before you begin
Enterprise (available on Enterprise) Owner · workspace (requires the Owner role in the workspace)- Admin access to Microsoft Entra ID.
- An email domain you can add a DNS TXT record to. See Verified Domains.
- Saving any change asks Confirm it’s you when you last signed in or confirmed more than 5 minutes ago.
Connect Microsoft Entra ID
Create the SAML app in Entra ID
Create an enterprise application for Qualflare and choose SAML single sign-on, as Microsoft's guide Enable SAML single sign-on for an enterprise application describes. Qualflare shows the values the app needs only after step 3, so come back to this app in step 4.
Set SHA-256 signing
Qualflare accepts RSA-SHA256, RSA-SHA384 or RSA-SHA512 signatures over SHA-256, SHA-384 or SHA-512 digests, and refuses SHA-1.
In Entra ID, open Enterprise apps > the app > Single sign-on > SAML Certificates > Edit, and set Signing Algorithm to SHA-256, the default. It covers both the signature and the digest.
Upload the Entra ID metadata to Qualflare
Download the app's SAML metadata as an XML file. In Qualflare, open Single Sign-On in the workspace sidebar, under Administration, upload the file (.xml, up to 1 MB) and click Save connection. The connection starts disabled. See Connect your identity provider.
Copy Qualflare's values into Entra ID
Under Service provider details, copy Entity ID (Audience URI) and ACS URL (Reply URL) with their copy buttons. Paste them into the Entra ID app as the audience URI and the reply URL, unchanged: Qualflare refuses a sign-in posted to a changed ACS URL, even one with a trailing slash added.
Send the user's email
Have Entra ID send a persistent, email address or unspecified Name ID. Qualflare refuses a transient one.
Qualflare looks in the attribute you enter in Email attribute on the Single Sign-On page, then in an email-address Name ID, then in these claims, in order:
http://schemas.xmlsoap.org/ws/2005/05/identity/claims/emailaddress
urn:oid:0.9.2342.19200300.100.1.3
email
mail
emailAddressEntra ID sends the first claim, so you need no mapping.
Map groups to roles (optional)
Have Entra ID send the user's groups in a claim, and enter that claim's name in Group attribute. Add Role rules: the first matching rule wins, and anyone else gets the Default role. Click Save mapping. See Map attributes and roles.
Verify your domain and test
Verify your email domain on Verified Domains. Turn on Connection enabled and click Turn on connection. Then run a test sign-in from a private browser window: enter an email address at the verified domain on the sign-in page and select Continue. Require SSO stays off until a test sign-in succeeds.
Encrypted assertions (optional)
Qualflare accepts an encrypted assertion only with RSA-OAEP key transport and AES content encryption: AES-128, AES-192 or AES-256 in CBC mode, or AES-128-GCM.
Entra ID's Token encryption (Enterprise apps > the app) uses AES-256 and an undocumented key transport, with no algorithm setting. If sign-ins fail after you turn it on, turn it off: Token encryption > the certificate's … > Deactivate token encryption.
Turn on Require encrypted assertions in Qualflare only once Entra ID encrypts and sign-ins succeed, then click Update connection. Otherwise every sign-in fails.
Provision users with SCIM
Once single sign-on works, Entra ID can add, update and remove workspace members over SCIM 2.0. Paste Qualflare's SCIM base URL as "Tenant URL" and the token as "Secret Token". See SCIM Provisioning.
Verify
You should see the member signed in to the workspace after the test sign-in, and Require SSO can now be turned on.
Troubleshoot
Single sign-on failed. Please try again, or contact your workspace owner if it keeps happening.: Qualflare refused the sign-in. Check the signing setting in step 2 first, then token encryption if it's on.- A 403
origin not allowederror after Entra ID signs you in: the reply URL in Entra ID isn't Qualflare's ACS URL exactly. Copy ACS URL (Reply URL) again and paste it unchanged. Your email address's domain isn't verified for single sign-on with this workspace yet. Contact your workspace owner.: verify that domain on Verified Domains.- Logging out of Qualflare didn't sign me out of Entra ID: Log out ends only the Qualflare session, so the next single sign-on can go straight through. Sign out of Entra ID too.
Next steps
- Require SSO for the members at your verified domains
- Set the SSO session lifetime
- SCIM Provisioning
- Recover from a lockout
Set up SSO with Okta
Connect Okta to a Qualflare Enterprise workspace over SAML 2.0: create the app, exchange metadata, set SHA-256 signing, map groups to roles and test sign-in.
Set up SSO with Google Workspace
Connect Google Workspace to a Qualflare Enterprise workspace with a custom SAML app: exchange metadata, send the email, map groups to roles and test sign-in.