How to connect Microsoft Entra ID for SAML SSO

Microsoft Entra ID, formerly Azure AD, needs a non-gallery enterprise application for Corma. Start from How to setup SAML SSO, which covers the Corma side, then come back here. You need Cloud Application Administrator or Global Administrator rights.

Create the enterprise application

1. In Corma, navigate to Settings → Security and turn on "Enable SAML SSO". Leave the tab open, you will copy the Audience URI (SP Entity ID) and the SSO URL (ACS) from it.

2. In the Microsoft Entra admin center, go to Entra ID → Enterprise apps → All applications, click "New application".

   

3. Go to "Create your own application" and name it "Corma".

   

4. Select Integrate any other application you don't find in the gallery (Non-gallery), and click "Create".

   

5. Under “Manage”, open "Single sign-on".

   

6. Choose "SAML", and Edit "Basic SAML Configuration", fill it in with the values from your Corma Security page, then click "Save".

   Entra ID field	Paste from Corma
   Identifier (Entity ID)	Audience URI (SP Entity ID)
   Reply URL (Assertion Consumer Service URL)	SSO URL (ACS)
   Sign on URL	https://app.corma.io

   

   Sign on URL is required because employees start from the Corma login page rather than from their Microsoft app list. Set it to https://app.corma.io.

7. Check "Attributes & Claims". The Unique User Identifier (Name ID) should be user.mail or user.userprincipalname, whichever matches the email address your employees have in Corma. Nothing else needs changing.

Assign users and connect

1. Open "Users and groups" and add the people or groups who should reach Corma.

   Anyone not assigned here cannot sign in, even with SAML configured correctly on both sides.

2. Copy the App Federation Metadata Url from the SAML Certificates section, or download the Federation Metadata XML file.

3. Back in Corma, select "Azure AD" from the SAML Provider dropdown. Paste the App Federation Metadata Url into Metadata URL, or drop the XML file into the upload area, then click "Save changes".

4. Test in a private browsing window using "Sign in with SAML SSO", before you enforce SAML.

If Corma returns you to the login page rather than signing you in, the Name ID claim is the first thing to check. SAML SSO troubleshooting covers the rest, and Microsoft documents the pane in Enable single sign-on for an enterprise application.