Skip to main content

Microsoft Entra ID (Azure AD) SSO

Use this guide to connect Cloudaware to Microsoft Entra ID with SAML single sign-on. It walks through the Entra enterprise application setup, required SAML values, user attribute claims, optional group claims, and the Cloudaware settings needed to enable Entra ID as an authentication service.

info
  • Audience: Cloudaware administrators, IAM teams
  • Outcome: Microsoft Entra ID is enabled as a Cloudaware authentication service, and users can sign in with Entra-managed identities and optional group-based RBAC mapping

Prerequisites​

Before you begin, make sure you have:

  • Access to a Cloudaware account.
  • Your Cloudaware domain, e.g., your_cloudaware_domain.my.salesforce.com
  • A Cloudaware Administrator user (access to the Salesforce Setup)
  • Entra role that can create/configure enterprise applications (for example, Global Administrator, Cloud Application Administrator, Application Administrator, or a custom role with app permissions)
  • Agreed identity attributes:
    • Unique user identifier (email/username)
    • Username format for Salesforce (must be globally unique)
    • Group claim source (Entra groups/roles), if you plan to map groups → permission sets

High-Level Setup Flow​

  1. Set up the SAML enterprise app in Entra ID.
  2. Configure Basic SAML Configuration and claims (+ optional JIT provisioning claims).
  3. Assign users/groups and download the Federation Metadata XML.
  4. Create the SSO setting in Cloudaware (in the Setup menu).
  5. Enable the SSO method under My Domain authentication configuration.

Setup In Microsoft Entra ID​

Create The Enterprise Application​

  1. Sign in to the Azure portal.
  2. Navigate to Enterprise applications → + New application.
  3. Search the Microsoft Entra gallery for Salesforce.
  4. Enter a name for the app (for example, Cloudaware), then select Create.

Enable SAML SSO​

  1. In the app’s Overview, select Set up single sign-on and click Get started.
  2. Choose SAML as the single sign-on method.

Configure Basic SAML Configuration​

In Basic SAML Configuration, set the following values (replace <your_cloudaware_domain>):

  • Identifier (Entity ID): https://<your_cloudaware_domain>.my.salesforce.com
  • Reply URL (Assertion Consumer Service URL): https://<your_cloudaware_domain>.my.salesforce.com
  • Sign-on URL (recommended):
    • https://<your_cloudaware_domain>.lightning.force.com/CA10UI/lca.app (lands users on the CMDB main page)

Click Save.

Configure Attributes & Claims​

  • Unique User Identifier (Name ID)
    • By default, Name ID is often set to user.userprincipalname.
    • Adjust if needed to match your Cloudaware/Salesforce user identifier (commonly email).

Add Claims For Just-In-Time (JIT) Provisioning​

If you want Just-In-Time (JIT) user provisioning, create Additional claims for the Salesforce JIT fields.

Recommended mappings:

  • User.Username
    • Salesforce usernames must be globally unique.
    • Use a transformation to ensure uniqueness. Example: prefix + email (for example, cloudaware-<email>).
  • User.FirstName: user.givenname
  • User.LastName: user.surname
  • User.Email: user.email
  • User.ProfileId
    • Use a value that matches your Cloudaware profile strategy.
    • If you need different profiles for different groups, use claim conditions based on group membership.
  • User.IsActive (optional): true
    • If you have automation that deactivates users after inactivity, this helps ensure deactivated users can be reactivated on login.

Add Group Claims (For RBAC Mapping)​

If you map Entra groups to Cloudaware permission sets/profiles, configure a groups claim so group membership is available at login time.

  • Include only Cloudaware-relevant groups where possible (to avoid overage/size limits).

Assign Users/Groups And Download Metadata XML​

  1. Assign users or groups to the app.
    • When assigning an individual user, you may be prompted to select a role; the selection does not affect Cloudaware access.
  2. In the app’s Single sign-on section, download the Federation Metadata XML and save it.

Setup In Cloudaware (Salesforce Setup)​

Enable SAML​

  1. Log in to Cloudaware and open Setup.
  2. In Quick Find, type Single.
  3. Under Identity, open Single Sign-On Settings.
  4. Ensure SAML Enabled is checked.
    • If not, click Edit, enable it, and Save.
  5. (Optional) Federation ID case-sensitivity:
    • By default, Federation IDs are case-sensitive.
    • If required, enable Make Federation ID case-insensitive.

Create The SSO Setting From Metadata XML​

  1. In Single Sign-On Settings, click New from Metadata File.
  2. Upload the Federation Metadata XML file downloaded from Entra ID.
  3. Click Create.

Configure SAML Single Sign-On Settings​

On the newly created SSO setting, configure:

  • Name: a descriptive name (for example, entra)
  • SAML Identity Type:
    • If JIT is required, select Assertion contains the Federation ID from the User object
  • Just-in-time User Provisioning:
    • If JIT is required, check User Provisioning Enabled
    • Set User Provisioning Type to Standard

Click Save.

Enable Entra As An Authentication Service (My Domain)​

  1. In Quick Find, type My Domain.
  2. Open My Domain.
  3. In Authentication Configuration, click Edit.
  4. Enable the checkbox next to the new SSO configuration (for example, entra).
  5. Click Save.

Troubleshooting​