> ## Documentation Index
> Fetch the complete documentation index at: https://infisical.com/docs/llms.txt
> Use this file to discover all available pages before exploring further.

# Entra ID / Azure AD SAML

> Learn how to configure Microsoft Entra ID for Infisical SSO.

<Info>
  Azure SAML SSO is a paid feature.

  If you're using Infisical Cloud, then it is available under the **Pro Tier**. If you're self-hosting Infisical,
  then you should contact [sales@infisical.com](mailto:sales@infisical.com) to purchase an enterprise license to use it.
</Info>

<Note>
  SSO authentication requires [Email Domain Verification](/documentation/platform/email-domain).
  You must verify your organization's email domain before users can log in via SSO.
</Note>

<Steps>
  <Step title="Prepare the SAML SSO configuration in Infisical">
    In Infisical, head to the **Single Sign-On (SSO)** page and select the **General** tab. Click **Connect** for **SAML** under the Connect to an Identity Provider section. Select **Azure / Entra**, then click **Connect** again.

    <img src="https://mintlify.s3.us-west-1.amazonaws.com/infisical/images/sso/connect-saml.png" alt="SSO connect section" />

    Next, copy the **Reply URL (Assertion Consumer Service URL)** and **Identifier (Entity ID)** to use when configuring the Azure SAML application.

    <img src="https://mintlify.s3.us-west-1.amazonaws.com/infisical/images/sso/azure/init-config.png" alt="Azure SAML initial configuration" />
  </Step>

  <Step title="Create a SAML application in Azure">
    In the Azure Portal, navigate to the Azure Active Directory and select **Enterprise applications**. On this screen, select **+ New application**.

    <img src="https://mintlify.s3.us-west-1.amazonaws.com/infisical/images/sso/azure/enterprise-applications.png" alt="Azure SAML enterprise applications" />

    <img src="https://mintlify.s3.us-west-1.amazonaws.com/infisical/images/sso/azure/new-application.png" alt="Azure SAML new application" />

    On the next screen, press the **+ Create your own application** button.
    Give the application a unique name like Infisical; choose the "Integrate any other application you don't find in the gallery (Non-gallery)"
    option and hit the **Create** button.

    <img src="https://mintlify.s3.us-west-1.amazonaws.com/infisical/images/sso/azure/create-own-application.png" alt="Azure SAML create own application" />

    On the application overview screen, select **Single sign-on** from the left sidebar. From there, select the **SAML** single sign-on method.

    <img src="https://mintlify.s3.us-west-1.amazonaws.com/infisical/images/sso/azure/sso-method.png" alt="Azure SAML sign on method" />

    Next, select **Edit** in the **Basic SAML Configuration** section and add/set the **Identifier (Entity ID)** to **Entity ID** and add/set the **Reply URL (Assertion Consumer Service URL)** to **ACS URL** from step 1.

    <img src="https://mintlify.s3.us-west-1.amazonaws.com/infisical/images/sso/azure/edit-basic-config.png" alt="Azure SAML edit basic configuration" />

    <img src="https://mintlify.s3.us-west-1.amazonaws.com/infisical/images/sso/azure/edit-basic-config-2.png" alt="Azure SAML edit basic configuration 2" />

    <Note>
      If you're self-hosting Infisical, then you will want to replace
      `https://app.infisical.com` with your own domain.
    </Note>

    Back in the **Set up Single Sign-On with SAML** screen, select **Edit** in the **Attributes & Claims** section and configure the following map:

    * `email -> user.userprincipalname`
    * `firstName -> user.givenname`
    * `lastName -> user.surname`

          <img src="https://mintlify.s3.us-west-1.amazonaws.com/infisical/images/sso/azure/edit-attributes-claims.png" alt="Azure SAML edit attributes and claims" />

          <img src="https://mintlify.s3.us-west-1.amazonaws.com/infisical/images/sso/azure/edit-attributes-claims-2.png" alt="Azure SAML edit attributes and claims 2" />

    Back in the **Set up Single Sign-On with SAML** screen, select **Edit** in the **SAML Certificates** section and set the **Signing Option** field to **Sign SAML response and assertion**.

    <img src="https://mintlify.s3.us-west-1.amazonaws.com/infisical/images/sso/azure/edit-saml-certificate.png" alt="Azure SAML edit certificate" />

    <img src="https://mintlify.s3.us-west-1.amazonaws.com/infisical/images/sso/azure/edit-saml-certificate-2.png" alt="Azure SAML edit certificate signing option" />
  </Step>

  <Step title="Retrieve Identity Provider (IdP) Information from Azure">
    In the **Set up Single Sign-On with SAML** screen, copy the **Login URL** and **SAML Certificate** to use when finishing configuring Azure SAML in Infisical.

    <img src="https://mintlify.s3.us-west-1.amazonaws.com/infisical/images/sso/azure/idp-values.png" alt="Azure SAML identity provider values 1" />

    In the **Properties** screen, copy the **Application ID** to use when finishing configuring Azure SAML in Infisical.

    <img src="https://mintlify.s3.us-west-1.amazonaws.com/infisical/images/sso/azure/idp-values-2.png" alt="Azure SAML identity provider values 2" />
  </Step>

  <Step title="Finish configuring SAML in Infisical">
    Back in Infisical, set **Login URL**, **Azure Application ID**, and **SAML Certificate** from step 3. Once you've done that, press **Update** to complete the required configuration.

    <img src="https://mintlify.s3.us-west-1.amazonaws.com/infisical/images/sso/azure/idp-values-3.png" alt="Azure SAML paste identity provider values" />

    <Note>
      When pasting the certificate into Infisical, you'll want to retain `-----BEGIN
                  CERTIFICATE-----` and `-----END CERTIFICATE-----` at the first and last line
      of the text area respectively.

      Having trouble?, try copying the X509 certificate information from the Federation Metadata XML file in Azure.
    </Note>
  </Step>

  <Step title="Assign users in Azure to the application">
    Back in Azure, navigate to the **Users and groups** tab and select **+ Add user/group** to assign access to the login with SSO application on a user or group-level.

    <img src="https://mintlify.s3.us-west-1.amazonaws.com/infisical/images/sso/azure/assignment.png" alt="Azure SAML assignment" />
  </Step>

  <Step title="Enable SAML SSO in Infisical">
    Enabling SAML SSO allows members in your organization to log into Infisical via Azure.

    <img src="https://mintlify.s3.us-west-1.amazonaws.com/infisical/images/sso/azure/enable-saml.png" alt="Azure SAML assignment" />
  </Step>

  <Step title="Enforce SAML SSO in Infisical">
    Enforcing SAML SSO ensures that members in your organization can only access Infisical
    by logging into the organization via Azure.

    To enforce SAML SSO, you're required to test out the SAML connection by successfully authenticating at least one Azure user with Infisical;
    Once you've completed this requirement, you can toggle the **Enforce SAML SSO** button to enforce SAML SSO.

    <Warning>
      We recommend ensuring that your account is provisioned the application in Azure
      prior to enforcing SAML SSO to prevent any unintended issues.
    </Warning>

    <Info>
      In case of a lockout, an organization admin can use the [Admin Login Portal](https://infisical.com/docs/documentation/platform/sso/overview#admin-login-portal) in the `/login/admin` path e.g. [https://app.infisical.com/login/admin](https://app.infisical.com/login/admin).
    </Info>
  </Step>
</Steps>

<Tip>
  If you are only using one organization on your Infisical instance, you can configure a default organization in the [Server Admin Console](../admin-panel/server-admin#default-organization) to expedite SAML login.
</Tip>

<Note>
  If you're configuring SAML SSO on a self-hosted instance of Infisical, make
  sure to set the `AUTH_SECRET` and `SITE_URL` environment variable for it to
  work:

  <div class="height:1px;" />

  * `AUTH_SECRET`: A secret key used for signing and verifying JWT. This
    can be a random 32-byte base64 string generated with `openssl rand -base64
        32`.

  <div class="height:1px;" />

  * `SITE_URL`: The absolute URL of your self-hosted instance of Infisical including the protocol (e.g. [https://app.infisical.com](https://app.infisical.com))
</Note>

<Note>
  If you'd like to require Multi-factor Authentication for your team members to access Infisical check out our [Entra ID / Azure AD MFA](../mfa#entra-id-azure-ad-mfa) guide.
</Note>