Skip to main content
Connect Microsoft Entra ID (formerly Azure AD) to Enclave. Both OIDC and SAML 2.0 are supported — pick one. See Authentication for how SSO fits with the rest of Enclave.
Where: Organization → Single Sign-On in Enclave (Owner role). One email domain maps to one connection.
1

Register an app in Entra

Entra admin center → App registrations → New registration.
  • Redirect URI (type Web): https://<your-enclave-host>/api/auth/oidc/callback
  • Copy the Application (client) ID and Directory (tenant) ID.
  • Certificates & secrets → New client secret → copy the secret Value.
  • Token configuration → Add optional claim → ID → email (Entra often omits email unless added; Enclave falls back to upn/preferred_username, but adding it is cleanest).
2

Add the connection in Enclave

Add Connection → OIDC:
3

Verify domain, enable, test

Complete domain verification, enable, and sign in.
If the ID token omits email, Enclave uses preferred_username / upn automatically.

​
Option B — SAML 2.0

1

Create an Enterprise application

Entra → Enterprise applications → New application → Create your own application → Integrate any other application (Non-gallery). Then Single sign-on → SAML.
2

Basic SAML Configuration

Set SAML Signing Certificate to sign the assertion (Entra does by default), and download the Certificate (Base64).
3

Add the connection in Enclave — map the fields

Add Connection → SAML. From Entra’s Set up single sign-on panel:
IdP Entity ID / Issuer = the Microsoft Entra Identifier (https://sts.windows.net/<tenant-id>/), not the federation metadata URL. A wrong value fails with idp_issuer_mismatch.
4

NameID format

Entra often rejects the emailAddress NameID policy. If sign-in errors on NameID, set the connection’s NameID Format to Persistent or Unspecified.
5

SP certificate, domain verify, enable

Generate the SP signing certificate on the connection card (one click), set Entra’s Identifier to the per-connection metadata URL shown there, complete domain verification, enable, and test.
Signing-key rotation: Entra rotates its signing certificate periodically. Enclave’s certificate field accepts multiple concatenated PEM certs — paste the new one alongside the current before Entra switches over, so sign-in never breaks.

​
Shared steps & troubleshooting

Domain verification, SP-certificate generation, provisioning mode, Require-fresh-sign-in, and Single Logout work the same as for Okta — see the Okta guide and Authentication. The troubleshooting table (audience / issuer / signature / timing reasons) applies to Entra too.