---
title: "Single Sign-On with Microsoft Entra ID (SAML)"
slug: "single-sign-on-with-microsoft-entra-id-saml"
updated: 2025-06-10T14:07:46Z
published: 2025-06-10T14:07:46Z
canonical: "support.kandji.io/single-sign-on-with-microsoft-entra-id-saml"
---

> ## Documentation Index
> Fetch the complete documentation index at: https://support.kandji.io/kb/llms.txt
> Use this file to discover all available pages before exploring further.

# Single Sign-On with Microsoft Entra ID (SAML)

> [!NOTE]
> Note: Microsoft Entra ID [is the new name](https://learn.microsoft.com/en-us/azure/active-directory/fundamentals/new-name) for Azure AD (Azure Active Directory)

### Create a SAML Connection

1. In Kandji, navigate to the **Settings** page.
2. Click the **Access** tab.
3. Find the **Authentication** section and click the **Add** button at the bottom left of the authentication section. ![](https://cdn.document360.io/0844b095-d720-4a7b-bb17-ec97d9bc6e41/Images/Documentation/Kandji-Support-KB-0804AM@2x(1).png)
4. In the Add SSO Connection pane, select the **Custom SAML** option.
5. Click **Next**.![](https://cdn.document360.io/0844b095-d720-4a7b-bb17-ec97d9bc6e41/Images/Documentation/Kandji-Support-KB-0806AM@2x.png)
6. Select **Show Advanced Details**.
7. Copy the **Assertion Consumer Service URL** and save it in a text document for later use.
8. Copy the **Entity ID** and save it, too. ![](https://cdn.document360.io/0844b095-d720-4a7b-bb17-ec97d9bc6e41/Images/Documentation/0mjc6wwscroir5kev07erpdgwauq_wzgoa.png)
9. Leave this browser tab open as you proceed with the instructions below.

### Add the Kandji Application to Microsoft Entra ID

1. Sign in to the [Microsoft Entra admin center](http://entra.microsoft.com).
2. Open the portal menu and then select **Identity**.
3. On the **Identity** menu, under **Applications**, select **Enterprise Applications**.
4. In the **Manage** section, select **All applications**.
5. Select **New Application**.![](https://cdn.document360.io/0844b095-d720-4a7b-bb17-ec97d9bc6e41/Images/Documentation/hudsctaabadtbnou36wdkobaiislcypscw.png)
6. Select **Create your own application**.
7. Give the application a **name**.
8. Select **Integrate any other application you don't find in the gallery (Non-gallery)**.
9. Click **Create**. ![](https://cdn.document360.io/0844b095-d720-4a7b-bb17-ec97d9bc6e41/Images/Documentation/2quglwbnhb7cuhkakqatdlnpw8xaay_mea.png)
10. Under **Manage**, select **Single sign-on**.
11. Click **SAML**. ![](https://cdn.document360.io/0844b095-d720-4a7b-bb17-ec97d9bc6e41/Images/Documentation/vm00t_an34lkzgwjlwzwirkigdoib1zx3a.png)
12. Click the **Edit** pencil in the Basic SAML configuration box. ![](https://cdn.document360.io/0844b095-d720-4a7b-bb17-ec97d9bc6e41/Images/Documentation/m_nmwcf08dp3amgdxnxrbf_4toxo77b5cw.png)
13. Click the Add Identifier link in the Identifier (Entity ID) section. Paste the Entity ID that you copied earlier into the Identifier (Entity ID) field.
14. In the Reply URL (Assertion Consumer Service URL) section, paste the Assertion Consumer Services URL that you copied earlier.
15. Click **Save.**
16. Click the **X** at the top right of the pane to close it.
17. Leave the settings in the **Attributes & Claims section** set to their default. ![](https://cdn.document360.io/0844b095-d720-4a7b-bb17-ec97d9bc6e41/Images/Documentation/l_lj3iybtemiqydtdzfcgz4jy2arggm0zg.png)
18. Click **Download** to download the Base 64 certificate in the SAML Certificates section. This certificate will be used in the Custom SAML configuration in Kandji.
19. In the Setup [App Name] section, copy the Login URL and Logout URL and paste them into a secure text document for later use. ![](https://cdn.document360.io/0844b095-d720-4a7b-bb17-ec97d9bc6e41/Images/Documentation/ugpbkhmeapvybwlkbs0xfefddenwhdbwfw.png)

### Assign Users and Groups

1. Under **Manage**, select **Users and Groups**.
2. On the menu, select **Add user/group**. ![](https://cdn.document360.io/0844b095-d720-4a7b-bb17-ec97d9bc6e41/Images/Documentation/xpgadhqy4xgtyhrpropurnycid_t-xzavw.png)
3. On the **Add Assignment** dialog, select the link under **Users and groups**.
4. A list of users and security groups is displayed. You can search for a certain user or group, as well as select multiple users and groups that appear in the list.
5. After you have selected your users and groups, select **Select**. ![](https://cdn.document360.io/0844b095-d720-4a7b-bb17-ec97d9bc6e41/Images/Documentation/ht6x2wrxg2yjv7-t6lnpximuewljimpotg.png)If you see the message below, it means that a free tier is being used. The Single Sign-On Enterprise App allows you to add users (not groups) only. ![](https://cdn.document360.io/0844b095-d720-4a7b-bb17-ec97d9bc6e41/Images/Documentation/zuszlhhr13jy0ezbm29fwtz7j_vgvegneq.png)
6. Select **Assign** to finish assigning users and groups to the app. ![](https://cdn.document360.io/0844b095-d720-4a7b-bb17-ec97d9bc6e41/Images/Documentation/63gip4lfaim6qqvzwjabev20fssit999lw.png)
7. Confirm that the users and groups you added appear in the **Users and groups** list. ![](https://cdn.document360.io/0844b095-d720-4a7b-bb17-ec97d9bc6e41/Images/Documentation/_mkp3oczchdvraxsswcmb6sdrla1d8rpsq.png)

### Configure the SAML Connection in Kandji

1. Go back to the Custom SAML modal in Kandji.
2. Give the connection a **Name**.
3. Paste in the **Sign In URL** you copied from Entra ID.
4. Paste in the **Sign Out URL** you copied from Entra ID.
5. Upload the **certificate** you downloaded from Entra ID.![](https://cdn.document360.io/0844b095-d720-4a7b-bb17-ec97d9bc6e41/Images/Documentation/6nny4dacgefxgxg8fhu8ol2i6fbzuxbv6w.png)
6. Ensure that the User ID Attribute is set to the default value of:

```bash
http://schemas.xmlsoap.org/ws/2005/05/identity/claims/nameidentifier
```
7. Ensure that **Sign Request** is set to **Yes**.
8. Ensure that the **Request Algorithm** is set to **RSA-SHA256**.
9. Ensure that **Sign Request Algorithm Digest** is set to **SHA 256**.
10. Set the **Protocol Binding** to **HTTP-POST**.
11. Click **Save** and then click **Cancel** to exit the configuration. ![](https://cdn.document360.io/0844b095-d720-4a7b-bb17-ec97d9bc6e41/Images/Documentation/_ito6icbh74xvtkotcl8r9t4wd6l_gr4cq.png)

### Enable the SAML Connection

Once you have configured the SAML connection in Kandji and your identity provider, you can enable it. For step-by-step instructions, please refer to the **Enable and Manage a Connection** section in our [Single Sign-On](/v1/docs/single-sign-on) support article.

### Enforcing Single Sign-On

Once you have configured at least one single sign-on connection, you can disable the standard authentication connection. Doing so will remove the ability for Kandji administrators in your tenant to authenticate via email/password, Google Sign in, or Office 365 Sign in.

### Add a User to Kandji

1. Add a user to the **Admin Team** in Kandji by clicking **New User**.
2. Fill in all of the corresponding user information. This user must exist in Microsoft Entra ID and must be assigned to the Kandji SSO app in your Microsoft Entra ID tenant.
3. Click **Submit**.![](https://cdn.document360.io/0844b095-d720-4a7b-bb17-ec97d9bc6e41/Images/Documentation/kyRfUO8R2QbwIWGR00Z_WO4HZQy3Lqfihg.png)
4. Once the invite is submitted, close the Invite User window.
5. Refresh the Access page in Kandji. You should see the user you just added.
6. Check the user’s email to accept the invitation and log into Kandji with the new SAML SSO connection.