Configuring SAML-Based SSO with Entra ID

RapidIdentity Platform Documentation
Solution
Application
Content Type
Technical Documentation
Utilities & Services
ft:locale
en-US

In this configuration, Entra ID uses SAML authentication with RapidIdentity as the IdP.

  1. Configure the RapidIdentity federation partner:
    1. Open the Configuration module from the Dashboard pop-up menu.
    2. Navigate to Security > Identity Providers > Federation Partners.
    3. Click Add Federation Partner and choose "SAML" from the pop-up menu.
    4. Click Create a SAML Relying Party.
    5. In the Name field, provide a name for the federation partner.
    6. In the Metadata field, paste the Entra ID SAML metadata from your SAML configuration in Entra ID.
    7. After saving your Entra ID metadata, map the immutableID and UPN attributes to their corresponding RapidIdentity attributes.

      Both attributes must match what is present in Entra ID:

      • Configure the UPN attribute as follows:

        • SAML name: IDPEmail

        • Format: urn:oasis:names:tc:SAML:2.0:attrname-format:unspecified

        • Value: The userPrincipalName value from Entra ID.

        • Assertion node: SHA-256

        • Audience: urn:federation:MicrosoftOnline

        • Recipient/Destination: https://login.microsoftonline.com/login.srf

      • The immutableID attribute is sent as NameID. Due to this, configure the NameID attribute as follows:

        • Format: urn:oasis:names:tc:SAML:2.0:nameid-format:persistent

        • Value: The onPremisesImmutableId value from Entra ID. This can be the Base64 value of the Active Directory objectGUID, or your configured source anchor.

  2. Collect the required values for Entra ID domain federation:
    1. Confirm your RapidIdentity tenant URL.

      This is the base URL of your RapidIdentity instance, for example https://rimodel.example.com.

    2. Retrieve the RapidIdentity signing certificate in PEM format from the SAML metadata endpoint.

      The SAML metadata is accessible at the following URL, where RapidIdentityTenantURL is the base URL of your RapidIdentity instance:

      https://RapidIdentityTenantURL/idp/profile/Metadata/SAML

      Locate the certificate value within the returned metadata and copy the PEM-encoded certificate string. This value is used for the -SigningCertificate parameter.

    3. Confirm your Entra ID domain name.

      This is the domain you are federating, for example example.com. It is used for the -DomainId parameter.

  3. Open PowerShell as an administrator and run the following commands to configure Entra ID domain federation:
    1. Install the Microsoft.Graph module if it is not already installed.
      if (-not (Get-Module -ListAvailable -Name Microsoft.Graph)) {
    Install-Module -Name Microsoft.Graph -Scope CurrentUser -Force
}
    2. Connect to Microsoft Graph using your Entra ID administrator credentials.
      Connect-MgGraph -Scopes "Domain.ReadWrite.All", "Directory.AccessAsUser.All", "Organization.ReadWrite.All", "Directory.ReadWrite.All"

      A browser window will open prompting you to enter administrator credentials for your Entra ID domain.

    3. Run the following command to configure domain federation, replacing each placeholder with the values collected in the previous step.
      New-MgDomainFederationConfiguration -DomainId "DistrictMSTenant" `
    -DisplayName "RapidIdentity" `
    -IssuerUri "https://RapidIdentityTenantURL/idp" `
    -SignOutUri "https://RapidIdentityTenantURL/idp/logout" `
    -MetadataExchangeUri "https://RapidIdentityTenantURL/idp/profile/Metadata/SAML" `
    -PassiveSignInUri "https://RapidIdentityTenantURL/idp/profile/SAML2/POST/SSO" `
    -PreferredAuthenticationProtocol "saml" `
    -FederatedIdpMfaBehavior "acceptIfMfaDoneByFederatedIdp" `
    -SigningCertificate "RapidIdentityPEMSigningCertificate"
      Note:

      If an existing federation configuration exists, it must be removed by running the following command before proceeding:

      Update-MgDomain `
    -DomainId "YourO365Domain.com" `
    -AuthenticationType "Managed"
    4. Verify that the federation configuration was applied successfully.
      Get-MgDomainFederationConfiguration -DomainId "DistrictMSTenant" | Format-List *

RapidIdentity is now configured for SSO authentication via Entra ID.