Skip to content

Single sign-on with Microsoft Entra ID

Use OIDC. SAML is the alternative if you prefer an enterprise application with SAML (Alternative: SAML).

Verify your email domain first (Single sign-on). Entra ID tokens carry no email_verified claim, so Preloop links an email to an existing member only when the domain is verified on the account.

Register the application

  1. In the Microsoft Entra admin center, go to App registrations > New registration.
  2. Supported account types: Accounts in this organizational directory only (single tenant). Leave the redirect URI empty for now and register.
  3. Copy the Application (client) ID and the Directory (tenant) ID from Overview.
  4. Under Certificates & secrets, create a client secret and copy its Value.
  5. Under Token configuration, add the optional ID-token claim email. Optional, for group mapping: Add groups claim and choose the group types to send. Entra sends group object IDs. If a user is in more groups than fit in the token, Entra sends an overage marker instead, and Preloop applies the connection's default role.

Finish in Preloop

  1. Go to Account settings > Single sign-on and click Add OIDC connection.
  2. Issuer: https://login.microsoftonline.com/<tenant-id>/v2.0, with your Directory (tenant) ID. The multi-tenant common and organizations endpoints are refused.
  3. Enter the client id and secret. Scopes: openid email profile. Choose the default role and whether first sign-in creates a membership. Enable the connection and save.
  4. In Entra, open Authentication > Add a platform > Web and enter the connection's callback URL as the redirect URI.
  5. Under Enterprise applications, open the app, set Assignment required? to Yes under Properties if only assigned people should sign in, and assign them under Users and groups.
  6. If you added a groups claim, set Groups claim or attribute to groups and map the group object IDs.
  7. Click Test sign-in.
  8. Optional: turn on Require single sign-on (Enforcement and break-glass).

Alternative: SAML

Create the enterprise application

  1. In Preloop, go to Account settings > Single sign-on, click Add SAML connection, enter a name and save. Copy the SP metadata URL and the ACS URL.
  2. In the Microsoft Entra admin center, go to Enterprise applications > New application > Create your own application. Choose "Integrate any other application you don't find in the gallery".
  3. Open Single sign-on, choose SAML, and edit Basic SAML Configuration:
  4. Identifier (Entity ID): the Preloop SP metadata URL.
  5. Reply URL (Assertion Consumer Service URL): the Preloop ACS URL.
  6. Leave Sign on URL and Relay State empty. Users start from the Preloop sign-in page.
  7. Under Attributes & Claims:
  8. Add a claim named email (no namespace) with source attribute user.mail. (Alternatively, keep only the default http://schemas.xmlsoap.org/ws/2005/05/identity/claims/emailaddress claim and set the connection's attribute_mapping email key to that name through the API.)
  9. Optional: add a claim named displayName from user.displayname.
  10. Optional: Add a group claim. Entra sends group object IDs, so you map those IDs in Preloop. If a user is in more groups than fit in the assertion, Entra sends an overage marker instead, and Preloop applies the connection's default role.
  11. Under SAML Certificates, keep the default signing option "Sign SAML assertion" and the SHA-256 algorithm. Copy the App Federation Metadata Url.
  12. Under Users and groups, assign the people who should sign in.

Finish the SAML connection in Preloop

  1. Edit the connection. Under Import identity provider metadata, paste the App Federation Metadata URL, click Preview metadata, then Apply metadata to editor.
  2. If you added a group claim, set Groups claim or attribute to http://schemas.microsoft.com/ws/2008/06/identity/claims/groups and map the group object IDs.
  3. Choose the default role and whether first sign-in creates a membership. Enable the connection and save.
  4. Click Test sign-in.
  5. Optional: turn on Require single sign-on (Enforcement and break-glass).

Entra token encryption is optional. To use it, set an SP signing key in Preloop and upload the public SP certificate shown on the connection to Entra.