# Set up SSO with Microsoft Entra ID

Source: https://docs.qualflare.com/docs/administration/sso/entra-id · Last updated: 2026-11-02

Connect Microsoft Entra ID to a Qualflare Enterprise workspace over SAML 2.0: create the enterprise app, exchange metadata, set SHA-256 signing and test.

To set up single sign-on with Microsoft Entra ID for a Qualflare Enterprise workspace, create an enterprise application in Microsoft Entra ID, upload its metadata on the Qualflare **Single Sign-On** page, copy Qualflare's Entity ID and ACS URL into it, and run a test sign-in.

## Before you begin

Available on: Enterprise.

Requires the Owner role in the workspace.

* Admin access to Microsoft Entra ID.
* An email domain you can add a DNS TXT record to. See [Verified Domains](https://docs.qualflare.com/docs/administration/verified-domains).
* Saving any change asks **Confirm it’s you** when you last signed in or confirmed more than 5 minutes ago.

## Connect Microsoft Entra ID

### Step 1: Create the SAML app in Entra ID

Create an enterprise application for Qualflare and choose SAML single sign-on, as Microsoft's guide [Enable SAML single sign-on for an enterprise application](https://learn.microsoft.com/en-us/entra/identity/enterprise-apps/add-application-portal-setup-sso) describes. Qualflare shows the values the app needs only after step 3, so come back to this app in step 4.

### Step 2: Set SHA-256 signing

Qualflare accepts RSA-SHA256, RSA-SHA384 or RSA-SHA512 signatures over SHA-256, SHA-384 or SHA-512 digests, and refuses SHA-1.

In Entra ID, open **Enterprise apps** > the app > **Single sign-on** > **SAML Certificates** > **Edit**, and set **Signing Algorithm** to SHA-256, the default. It covers both the signature and the digest.

### Step 3: Upload the Entra ID metadata to Qualflare

Download the app's SAML metadata as an XML file. In Qualflare, open **Single Sign-On** in the workspace sidebar, under **Administration**, upload the file (`.xml`, up to 1 MB) and click **Save connection**. The connection starts disabled. See [Connect your identity provider](https://docs.qualflare.com/docs/administration/sso#connecting-an-identity-provider).

### Step 4: Copy Qualflare's values into Entra ID

Under **Service provider details**, copy **Entity ID (Audience URI)** and **ACS URL (Reply URL)** with their copy buttons. Paste them into the Entra ID app as the audience URI and the reply URL, unchanged: Qualflare refuses a sign-in posted to a changed ACS URL, even one with a trailing slash added.

### Step 5: Send the user's email

Have Entra ID send a persistent, email address or unspecified Name ID. Qualflare refuses a transient one.

Qualflare looks in the attribute you enter in **Email attribute** on the Single Sign-On page, then in an email-address Name ID, then in these claims, in order:

```text
http://schemas.xmlsoap.org/ws/2005/05/identity/claims/emailaddress
urn:oid:0.9.2342.19200300.100.1.3
email
mail
emailAddress
```

Entra ID sends the first claim, so you need no mapping.

### Step 6: Map groups to roles (optional)

Have Entra ID send the user's groups in a claim, and enter that claim's name in **Group attribute**. Add **Role rules**: the first matching rule wins, and anyone else gets the **Default role**. Click **Save mapping**. See [Map attributes and roles](https://docs.qualflare.com/docs/administration/sso#attributes-and-role-mapping).

### Step 7: Verify your domain and test

Verify your email domain on [Verified Domains](https://docs.qualflare.com/docs/administration/verified-domains). Turn on **Connection enabled** and click **Turn on connection**. Then run a test sign-in from a private browser window: enter an email address at the verified domain on the sign-in page and select **Continue**. **Require SSO** stays off until a test sign-in succeeds.

## Encrypted assertions (optional)

Qualflare accepts an encrypted assertion only with RSA-OAEP key transport and AES content encryption: AES-128, AES-192 or AES-256 in CBC mode, or AES-128-GCM.

Entra ID's **Token encryption** (**Enterprise apps** > the app) uses AES-256 and an undocumented key transport, with no algorithm setting. If sign-ins fail after you turn it on, turn it off: **Token encryption** > the certificate's **…** > **Deactivate token encryption**.

Turn on [Require encrypted assertions](https://docs.qualflare.com/docs/administration/sso#require-encrypted-assertions) in Qualflare only once Entra ID encrypts and sign-ins succeed, then click **Update connection**. Otherwise every sign-in fails.

## Provision users with SCIM

Once single sign-on works, Entra ID can add, update and remove workspace members over SCIM 2.0. Paste Qualflare's **SCIM base URL** as "Tenant URL" and the token as "Secret Token". See [SCIM Provisioning](https://docs.qualflare.com/docs/administration/scim).

## Verify

You should see the member signed in to the workspace after the test sign-in, and **Require SSO** can now be turned on.

## Troubleshoot

* `Single sign-on failed. Please try again, or contact your workspace owner if it keeps happening.`: Qualflare refused the sign-in. Check the signing setting in step 2 first, then token encryption if it's on.
* A 403 `origin not allowed` error after Entra ID signs you in: the reply URL in Entra ID isn't Qualflare's ACS URL exactly. Copy **ACS URL (Reply URL)** again and paste it unchanged.
* `Your email address's domain isn't verified for single sign-on with this workspace yet. Contact your workspace owner.`: verify that domain on [Verified Domains](https://docs.qualflare.com/docs/administration/verified-domains).
* **Logging out of Qualflare didn't sign me out of Entra ID**: **Log out** ends only the Qualflare session, so the next single sign-on can go straight through. Sign out of Entra ID too.

## Next steps

* [Require SSO](https://docs.qualflare.com/docs/administration/sso#enforcing-sso) for the members at your verified domains
* [Set the SSO session lifetime](https://docs.qualflare.com/docs/administration/sso#sso-session-lifetime)
* [SCIM Provisioning](https://docs.qualflare.com/docs/administration/scim)
* [Recover from a lockout](https://docs.qualflare.com/docs/administration/sso#recovering-from-a-lockout)