Single Sign-On with Microsoft Entra ID (SAML)

Learn how to configure Microsoft Entra ID as a SAML-based identity provider

Note: Microsoft Entra ID is the new name for Azure AD (Azure Active Directory)

• Create a SAML Connection 
• Add the Kandji Application to Microsoft Entra ID
• Assign Users and Groups
• Configure the SAML Connection in Kandji
• Enable the SAML Connection
• Enforcing Single Sign-On
• Add a User to Kandji

Create a SAML Connection 

1. In Kandji, navigate to the Settings page.

2. Click the Access tab.

3. Find the Authentication section and click the Add button at the bottom left of the authentication section.

4. In the Add SSO Connection pane, select the Custom SAML option.

5. Click Next.
   

6. Select Show Advanced Details.

7. Copy the Assertion Consumer Service URL and save it in a text document for later use.

8. Copy the Entity ID and save it, too.

   

9. Leave this browser tab open as you proceed with the instructions below. 

Add the Kandji Application to Microsoft Entra ID

1. Sign in to the Microsoft Entra admin center.
2. Open the portal menu and then select Identity.
3. On the Identity menu, under Applications, select Enterprise Applications.

4. In the Manage section, select All applications.

5. Select New Application.
   

6. Select Create your own application.

7. Give the application a name.

8. Select Integrate any other application you don't find in the gallery (Non-gallery).
9. Click Create.
   
10. Under Manage, select Single sign-on.
11. Click SAML.
    
12. Click the Edit pencil in the Basic SAML configuration box.
    
13. Click the Add Identifier link in the Identifier (Entity ID) section. Paste the Entity ID that you copied earlier into the Identifier (Entity ID) field.
14. In the Reply URL (Assertion Consumer Service URL) section, paste the Assertion Consumer Services URL that you copied earlier.
15. Click Save.
16. Click the X at the top right of the pane to close it.
17. Leave the settings in the Attributes & Claims section set to their default.
    
18. Click Download to download the Base 64 certificate in the SAML Certificates section. This certificate will be used in the Custom SAML configuration in Kandji.
19. In the Setup [App Name] section, copy the Login URL and Logout URL and paste them into a secure text document for later use.
    

Assign Users and Groups

1. Under Manage, select Users and Groups.
2. On the menu, select Add user/group.
   
3. On the Add Assignment dialog, select the link under Users and groups. 
4. A list of users and security groups is displayed. You can search for a certain user or group, as well as select multiple users and groups that appear in the list.
5. After you have selected your users and groups, select Select.
   If you see the message below, it means that a free tier is being used. The Single Sign-On Enterprise App allows you to add users (not groups) only.
   
6. Select Assign to finish assigning users and groups to the app.
   
7. Confirm that the users and groups you added appear in the Users and groups list.
   

Configure the SAML Connection in Kandji

1. Go back to the Custom SAML modal in Kandji.

2. Give the connection a Name.

3. Paste in the Sign In URL you copied from Entra ID.

4. Paste in the Sign Out URL you copied from Entra ID.

5. Upload the certificate you downloaded from Entra ID.
   

6. Ensure that the User ID Attribute is set to the default value of:

   http://schemas.xmlsoap.org/ws/2005/05/identity/claims/nameidentifier

7. Ensure that Sign Request is set to Yes.

8. Ensure that the Request Algorithm is set to RSA-SHA256.

9. Ensure that Sign Request Algorithm Digest is set to SHA 256.

10. Set the Protocol Binding to HTTP-POST.

11. Click Save and then click Cancel to exit the configuration.
    
    

     

Enable the SAML Connection

Once you have configured the SAML connection in Kandji and your identity provider, you can enable it. For step-by-step instructions, please refer to the Enable and Manage a Connection section in our Single Sign-On support article.