Use Microsoft Entra ID for SSO authentication

Learn how to integrate Kobiton Single Sign-On (SSO) with Microsoft Entra ID. After completing the configuration, you can:

  • Control in Microsoft Entra ID who has access to Kobiton Single Sign-On.

  • Enable users to sign in to Kobiton automatically using their Microsoft Entra accounts.

  • Manage your accounts in one central location.

Prerequisites

The scenario outlined in this article assumes you have the following:

Get Kobiton parameters

First, you’ll need to save a copy of your Kobiton SSO attributes so you can easily add them to your IdP later.

Select your profile name or picture, then choose Settings.

Select your profile name and select Settings

Choose SSO Settings.

SSO settings page

From Basic configuration, copy the following values and save them to a note:

  • Entity ID (or Audience URL)

  • Reply (or SSO, or ACS) URL

Basic configuration step in SSO settings

From User attributes (or parameters), copy the following values and save them to a note:

  • email

  • firstName

  • lastName

  • phoneNumber

  • memberOf

User attributes or parameters step in SSO settings

Later you’ll finish configuring your Kobiton SSO settings so keep this browser window open.

If your IdP sends these attributes under different names, you can map them instead of changing your IdP. See Configure custom SAML attribute mappings.

Create IdP application

Sign in to the Microsoft Entra admin center as a user with at least the Cloud Application Administrator role.

Browse to Entra ID > Enterprise apps > New application.

Choose Create your own application.

Enter a name for the application, then choose the option Integrate any other application you don’t find in the gallery (Non-gallery)

Select Create.

In the application Overview page, select Assign users and groups and add or assign users for your application.

Assign users and group option in Getting Started

You’ll set up single sign on in the next section.

Map parameters

Now that you’ve created the application, configure the Microsoft Entra ID settings required for Kobiton and download the Base64 certificate. To get started, select Set up single sign-on.

Select Setup Single Sign On option in Getting Started

Choose SAML as the single sign-on method.

In step 1, Basic SAML Configuration, use your Kobiton SSO parameters from earlier to fill out the following fields:

  • Identifier (Entity ID)

  • Reply URL (Assertion Consumer Service URL)

  • Relay State

Fill out Identifier, Reply URL, Relay State from Kobiton SSO parameters

In step 2, User Attributes & Claims, remove all the default claims except Unique User Identifier, then create the following claims:

Parameter 1

  • Name: email

  • Namespace: Leave blank

  • Name format: Default

  • Value: user.mail

Parameter 2

  • Name: firstName

  • Namespace: Leave blank

  • Name format: Basic

  • Value: user.givenname

Parameter 3

  • Name: lastName

  • Namespace: Leave blank

  • Name format: Basic

  • Value: user.surname

Parameter 4

  • Name: phone

  • Namespace: Leave blank

  • Name format: Basic

  • Value: user.telephonenumber

Fill out Attributes & Claim

Download certificate and get IdP parameters

In step 3, SAML Signing Certificate, download Certificate (Base64).

Download Certificate (Base64)

Rename the extension of the downloaded certificate from .cer to .pem

In step 4, Set up Kobiton Azure Local, copy the following values and save them to a note:

  • Login URL

  • Microsoft Entra Identifier

  • Logout URL

Add IdP parameters and certificate to Kobiton

Now, you’ll need to add your IdP parameters and certificate to your Kobiton organization. In your SSO Settings, scroll down to Set up at Kobiton side.

Scroll down to step Set up at Kobiton side

Add your IdP parameters and certificate to the following:

  • Identity provider issuer

  • Identity issuer URL

  • Identity provider sign in URL

  • Identity provider sign out URL (optional)

  • Identity provider certificate

    The Identity provider certificate must be a .pem file. If the certificate downloaded from the IdP has a different file extension (such as .cert), rename it to .pem before uploading.

See the below mapping table for which value to use for each parameter above.

Field name Value mapping

Identity provider issuer

Azure (former name of Entra)

Identity issuer URL

Microsoft Entra Identifier

Identity provider sign in URL

Login URL

Identity provider sign out URL (optional)

Logout URL

Verify and save configuration

Make sure you have created an account with the same email as the currently logged in Kobiton account and assign the new SAML application to that user on the IdP side before continuing.

Select Verify to test your SSO configuration.

The Verify button under Verify Configuration

The system will open a new browser tab to the SSO login page. In this new tab, log in using the account that has the same email as the current Kobiton account.

If logged in successfully, go back to the previous browser tab with the SSO Settings opened.

Wait for a while for the SSO Settings page to automatically reload (do not force reload the page) and a success message displays like the below:

The success message under Verify Configuration

After receiving the success response, select Save to complete your SSO configuration.

After verifying and saving the configuration, you can turn on Enforce users to login to Kobiton only through SSO to force the users to log in only via SSO (optional).

When SSO login enforcement is turned on:

  • You can add existing users to be exempted from the SSO login enforcement by adding the username into the Choose users who are allowed to login without SSO field.

    The list of users that are exempted from the enforcement list when SSO enforcement is enabled

  • You also gain access to Specify Organization Access Restrictions with the ability to enable Pass role/team assignments to users in the SAML validations. Choose the method that’s best for your organization.

    The Specify Organization Access Restrictions step in SSO settings