About Microsoft Entra ID SAML Integration
Microsoft Entra ID SAML integration in Iru Endpoint lets you set up SAML-based SSO integration with Microsoft Entra ID for users accessing Iru Endpoint through their Microsoft Entra ID credentials.How It Works
When users attempt to access Iru Endpoint, they’re redirected to Microsoft Entra ID for authentication. After successful authentication, Microsoft Entra ID sends a SAML assertion back to Iru Endpoint, which validates the user’s identity and grants access. SSO can be used for Iru Endpoint Web App sign-in and for Require Authentication with Automated Device Enrollment.Note: Microsoft Entra ID is the new name for Azure AD (Azure Active Directory)
- Iru Web App Configuration
- Microsoft Entra ID Configuration
Setting Up the SAML Connection
You’ll need to complete the initial setup in Iru Endpoint first to get the configuration information required for Microsoft Entra ID. After copying the Entity ID and ACS URL, switch to the Microsoft Entra ID Configuration tab and continue with Configuring Microsoft Entra ID Application.
1
Navigate to the Account Menu Button
In Iru Endpoint, in the sidebar, click the Account Menu Button.
2
Access Authentication Settings
Click the Access option in the menu.
3
Select Admin and Authentication
Select the Admin and authentication tab (selected by default) and scroll down to Authentication methods.
4
Add Authentication Method
Click + Authentication method.
5
Enter Display Name
Enter a display name for the SSO Connection.
6
Select Authentication Method
Select SAML for the Authentication method.
7
Create Connection
Click Create.
8
Configuration Information
Click Configuration information if that section is not already expanded.
9
Copy Service Provider Entity ID
Copy the Service provider entity ID into a text document for later use. You’ll need this for the Entra ID configuration.
10
Copy ACS URL
Copy the Assertion consumer service (ACS) URL into a text document for later use. You’ll need this for the Entra ID configuration.
11
Keep Tab Open
Keep the Iru Endpoint configuration modal open, then switch to the Microsoft Entra ID Configuration tab to continue with Configuring Microsoft Entra ID Application.
Configuring Iru Endpoint SAML Connection
After completing the Microsoft Entra ID configuration, return here to finish Configuring Iru Endpoint SAML Connection in Iru Endpoint. You’ll need the Single Sign-on URL, IdP Entity ID, and certificate from Microsoft Entra ID.
1
Return to Iru Endpoint
Go back to the Custom SAML modal in Iru Endpoint.
2
Configure IdP Attribute
Set IdP attribute to Subject.
3
Configure Attribute Name
Leave Attribute name blank.
4
Configure User Attribute
Set User attribute to User Principal Name (UPN).
5
Add IdP Entity ID
Paste the Microsoft Entra Identifier you copied earlier into the IdP Entity ID field.
6
Add Sign In URL
Paste in the Sign In URL you copied from Entra ID.
7
Upload Certificate
Upload the certificate you downloaded from Entra ID.
8
Set Protocol Binding
Set the Protocol Binding to HTTP-POST.
9
Set Request Algorithm
Ensure that the Request Algorithm is set to RSA-SHA256.
10
Set Digest Algorithm
Ensure that Sign Request Algorithm Digest is set to SHA256.
11
Enable Sign Request
Ensure that Sign Request is enabled.
12
Set Response Signature Verification
Set the Response Signature Verification to Assertion.
13
Set Destination
Leave the Destination field blank.
14
Set Allowed Signature Algorithm
Set Allowed Signature Algorithm to RSA-SHA256.
15
Set Allowed Digest Algorithm
Set Allowed Digest Algorithm to SHA256.
16
Save Configuration
Click Save.
Allow for Tenant Authentication
Once you have configured the SAML connection in Iru Endpoint and your identity provider, you can allow its use for tenant authentication. For step-by-step instructions, please refer to the Allowing Tenant Authentication and Managing Connections section in our Single Sign-on support article.Limit Authentication to Domain
When configuring the SAML connection, you can optionally limit authentication to one or more domains. This can be useful when the SSO connection could authenticate to multiple domains. You can limit the authentication to your Iru tenant to a subset of the available domains.Enforcing Single Sign-On
Once you have configured at least one Single Sign-on connection, you can disable Passkey, Google Social, and Microsoft Social connections. Disabling these connections will disable the ability for Iru Endpoint administrators in your tenant to authenticate via those methods. Please refer to our Single Sign-on support article for step-by-step instructions.Considerations
Security: Ensure that your Microsoft Entra ID tenant has appropriate security policies configured for SSO authentication.User Management: Users must exist in both Microsoft Entra ID and Iru Endpoint to successfully authenticate via SSO.Testing: Always test the SSO integration with a small group of users before rolling out to your entire organization.Testing the Integration
1
Add User to Admin Team
Add a user to the Admin Team in Iru Endpoint by clicking New User.
2
Fill User Information
Fill in all of the corresponding user information. This user must exist in Microsoft Entra ID and must be assigned to the Iru Endpoint SSO app in your Microsoft Entra ID tenant.
3
Submit User
Click Submit.
4
Close Invite Window
Once the invite is submitted, close the Invite User window.
5
Refresh Access Page
Refresh the Access page in Iru Endpoint. You should see the user you just added.
6
Test SSO Login
Check the user’s email to accept the invitation and log into Iru Endpoint with the new SAML SSO connection.
