# About SSO with Microsoft Azure Shipium supports single sign-on (SSO) using Azure as your SAML identity provider. This document provides guidance for configuring SSO with Azure in the Shipium system. For more general information about SSO requirements and Shipium, see [SSO for Your Shipium Account](https://docs.shipium.com/docs/sso-for-your-shipium-account). # Configure SSO for your Shipium account using Azure as the identity provider Your Shipium team member is available to assist as you set up Microsoft Azure as your SAML identity provider, but the process is outlined in the following steps. ## Step 1. Obtain values from Shipium To start the process, Shipium's IT team will provide your team with a metadata XML file that contains an Entity ID value and sign-in URL. ## Step 2. Set up or access a Microsoft Azure account You'll either sign into your existing Azure account or create a new one by visiting the [Azure portal](https://login.microsoftonline.com/organizations/oauth2/v2.0/authorize?redirect_uri=https%3A%2F%2Fportal.azure.com%2Fsignin%2Findex%2F&response_type=code%20id_token&scope=https%3A%2F%2Fmanagement.core.windows.net%2F%2Fuser_impersonation%20openid%20email%20profile&state=OpenIdConnect.AuthenticationProperties%3D79zLMWd1BVI0ZXlXn56_RsiLHYjq14qW0DGwgJZHlGd363v5pZmLgo7J582cN0msEfzrr0IYy7ezVE4tldjeHpyYe-mD9dh7XxtAlNdLGF_qxV-wSLIq3WsYb8XX8H01xxHKygdkRuVZN6BdZIT2eWQM2KXuRq35KdEEo86QeTmo7QtkVlsnw1bHyCLvSQYX_d7q_IiXm-2b3cUyiifUEJUkC56EobYXIlzkjF1H28m_qUzvEc8Bj9o29Rcw-_DEZb17HhjlYDJRhyYELu5mhtrAV9qZc9_WYO1Ex1J1fB2MXbhBRFp9Y-RGWBIigEPubbJq7kOApk6WbRvDoGiHweWFgzwV2g-d9MbQO08G9CC1yJ_7lZpVgRqFX15Vnls_So8u0_QMZ1ZgG1zYBje6Fm6iIUZOlZA6S3m-Y2v-ngRYv0Uku5y0oIjvqbU6KqGOLPaDI28QF5gwwml4779cP6N-ECRzvW-0kB_vFjSwXtM&response_mode=form_post&nonce=638878599678292931.ODZhMjllZTUtNmZmYy00N2U0LWFmMTEtMGE3NzI5N2FmNGJhYjk0YjE1ZGMtZTE3OS00MTZiLWI4ZmUtMzlmYTgzZjdmNTNl&client_id=c44b4083-3bb0-49c1-b47d-974e53cbdf3c&site_id=501430&instance_aware=true&client-request-id=7c3223ef-fd2d-479a-b71f-1a2c0ccb292a&x-client-SKU=ID_NET472&x-client-ver=8.3.0.0&sso_reload=true). ## Step 3. Create your application You will need to create your own application in Azure to integrate with Microsoft Entra ID (formerly Azure ID). Once you're logged into your account, you'll navigate to **Azure Active Directory** and then **Enterprise applications**. You'll select the **\+ New application** tab within the Enterprise Applications screen. Next, you'll select the **\+ Create your own application** tab. The **Create your own application** window will appear and prompt you to provide a name, such as AzureViaSAML, for your new app. You'll select the **Integrate any other application you don’t find in the gallery (Non-gallery)** as your choice for what you are planning to do with the app, and then select **Create**. The next step guides you through the SAML connection process, which begins on the **Overview** page that appears after you create your application. ## Step 4. Configure Azure SAML integration Within the **Overview** page of your new application, you'll select **Single sign-on** from the lefthand navigation menu. When prompted to select a single sign-on method, you'll choose **SAML**. Within the SAML-Based Sign-On page, you'll choose the **Edit** button within the **Basic SAML Configuration** section. Within the Basic SAML Configuration window, you'll select **Add identifier** under **Identifier (Entity ID)**. Next, an identifier for the Entity ID is needed. You'll enter the value of the Entity ID provided to you in the metadata file from Shipium. After adding the identifier, you'll add the Reply URL under **Reply URL (Assertion Consumer Service URL)**. The value to enter for the Reply URL is the one supplied in the metadata file from Shipium. You'll select **Save** after entering the Entity ID and Reply URL. A success message will indicate you have saved the configuration correctly. Back in the SAML-Based Sign-On page, you'll select **Download** next to both the Base64 Certificate option and the Federation Metadata XML option under **SAML Certificates**. You will need to provide these files to your Shipium IT representative. ## Step 5. Set up users and groups Back within the Azure page for your application, you'll select **Users and groups** from the lefthand navigation menu under **Manage**. Within the Users and Groups page, you'll select the **\+ Add user/group** tab. Within Users and Groups, you will add users to their appropriate group, based on [user roles](https://docs.shipium.com/docs/managing-users-roles) in the Shipium Console, by selecting the desired group for each user: - Admin - Editor - Viewer - Site Manager (specific to the [Shipium Pack App](https://docs.shipium.com/docs/pack-application-pack-app#user-roles)) - Site Associate (specific to the [Shipium Pack App](https://docs.shipium.com/docs/pack-application-pack-app#user-roles)) To assign all users your organization would like to be able to use the Shipium Console to the Shipium application, you'll assign each group to the Shipium application you created earlier. To assign roles to your users, you'll [add a group claim](https://learn.microsoft.com/en-us/entra/identity/hybrid/connect/how-to-connect-fed-group-claims#add-group-claims-to-tokens-for-saml-applications-using-sso-configuration) to the Shipium SAML application. This group claim tells Shipium which role a user receives when they sign in. - Within the **Enterprise Applications** page of Azure, you'll select the application you created to integrate with Shipium's SAML; for that app, you'll select **Single sign-on configuration** and then **User Attributes & Claims**. - Under User Attributes & Claims, you'll select **\+ Add a group claim**. When asked which groups associated with the user should be returned in the claim, if you select **Groups assigned to the application**, you're choosing only those users within your organization in groups that are assigned to the Shipium application. - The source attribute you will select from the dropdown menu is **sAMAccountName**. After adding the group claim, you can optionally [add filtering](https://learn.microsoft.com/en-us/entra/identity/hybrid/connect/how-to-connect-fed-group-claims#group-filtering) to the group. You can configure filters to be applied to the group's display name or **sAMAccountName** attribute. When a filter is configured, only groups that match the filter will be included in the group's claim that's sent to that application. - For **Attribute to match**, you'll select **Display name**. - For **Match with**, you'll select **Prefix**. - For **String**, you'll enter **shipium**. ## Step 6. Provide credentials to Shipium To configure SSO for your organization's account users, you'll need to provide the following values to Shipium's IT team: - Sign-in URL - Sign-out URL - X.509 signing certificate - Email address attribute (optional) You can find details about these requirements in [Requirements for Configuring SSO with Shipium](https://docs.shipium.com/docs/sso-for-your-shipium-account#requirements-for-configuring-sso-with-shipium). # Resources Your Shipium team member is available to help along the way. However, you might find these resources helpful: - [Terms and Definitions](https://docs.shipium.com/docs/common-terms) - [Troubleshooting Guide](https://docs.shipium.com/docs/troubleshooting-guide) - [Contact Shipium Support](https://docs.shipium.com/docs/contacting-shipium-support)