Set Up Single Sign-On with Entra ID

Configure SAML SSO for an enterprise app and control who gets access.

Introduction

30 Second Summary

Every time you sign into a work app with your company email, someone configured that access behind the scenes. They decided who gets in, who gets blocked, and how the login works.

In this project, you will set up that entire identity system yourself using Microsoft Entra ID. You'll create users, organize them into groups, and configure SAML-based Single Sign-On for an enterprise application.

What You'll Build

You'll watch a test user click once and land inside a protected application, proving that your identity setup, access control, and SSO configuration all work together.

By the end of this project, you'll have:

A directory with test users and a security group that you can browse and manage in the Microsoft Entra admin center.
An enterprise application protected by SAML-based Single Sign-On, where only assigned users can sign in with one click.
A tested access control setup where you've seen unassigned users get blocked and assigned users sign in successfully.
Secret Mission: Add a second department group and configure role-based access so each group gets different permissions in the application.

Are there any prerequisites?

You'll need a Microsoft Azure account. The free tier is sufficient for everything in this project.

Before We Start

Before We Start...

Before we dive in, let's lock in what you're about to build and why it matters. You're going to set up a complete identity and access management scenario, proving that only the right people can sign into an application with a single click.

Set Up Your Directory with Users and a Group

Before you can control who gets access to an application, you need people in your directory. Microsoft Entra ID is your organization's directory of users and groups.

In this step, you will create a test user representing a team member and organize them into a security group. This is the foundation of all identity management. Every access control decision starts with knowing who your people are and how they are organized.

In this step, get ready to:

Create a test user in your Entra ID directory.
Create a security group and add the user as a member.

Create a test user

You will create a user account that represents a team member named Alex Johnson. This is the person you will later assign to an enterprise application to test Single Sign-On.

In the Microsoft Entra admin center, expand the left navigation menu.
Browse to Entra ID > Users.
Click New user at the top of the page.
Select Create new user from the dropdown.

The new user form opens on the Basics tab. Fill in the required fields:

In the User principal name field, enter testuser. The domain after the @ symbol is already filled in with your tenant's default domain (ending in .onmicrosoft.com).
In the Display name field, enter Alex Johnson.
Uncheck Auto-generate password.
In the Password field, type a memorable password you will remember. You will need this later to sign in as Alex.
Confirm that Account enabled is checked.
Click Review + create.
Review the details on the summary page, then click Create.

What is a User Principal Name?

The User Principal Name (UPN) is the username your team member uses to sign in. It follows an email-like format: testuser@yourtenant.onmicrosoft.com. Think of it as the person's login ID for your organization.

The portal returns you to the Users list. You should see Alex Johnson now appearing in the list of users.

Don't see the new user?

If you see a message about insufficient privileges, make sure you are signed in with an account that has the Global Administrator or User Administrator role.

If the user does not appear in the list immediately, wait a few seconds and refresh the page.

Why isn't my new user showing up in the Entra ID Users list?

Create a security group and add the user

Now that you have a user, you need a way to organize them. Security groups let you manage access for a collection of users at once, instead of assigning permissions one person at a time.

In the left navigation, browse to Entra ID > Groups > All groups.
Click New group at the top of the page.
Set Group type to Security.
In the Group name field, enter Engineering Team.
In the Group description field, enter Engineering department members.
Set Membership type to Assigned.

Why choose Assigned membership?

Assigned means you manually pick who belongs to the group. The alternative, Dynamic, automatically adds users based on rules (like department or job title) but requires a paid Entra ID P1 or P2 license. Assigned works on the Free tier.

Now add your test user as a member:

Under Members, click the No members selected link.
In the search box, type Alex Johnson.
Select the checkbox next to Alex Johnson in the results.
Click Select.
Click Create at the bottom of the New group page.

The portal returns you to the All groups list. You should see Engineering Team in the list.

Group not appearing in the list?

If you see a permissions error, confirm your account has the Groups Administrator or User Administrator role. Refresh the page if the group does not appear immediately.

If Alex Johnson did not appear in the member search, go back to Entra ID > Users and confirm the user was created successfully.

Why can't I find my user when adding members to the group?

Verify your directory is set up

Before you move on, take a moment to predict what your directory should look like. You created one user and one group. What do you expect to see in the Users list and the Groups list?

Browse to Entra ID > Users and confirm Alex Johnson appears in the user list.
Browse to Entra ID > Groups > All groups and confirm Engineering Team appears.
Click on Engineering Team, then select Members in the left menu. Confirm that Alex Johnson is listed as a member.

You should see 1 member in the group. Your directory now has a user organized into a team.

Your directory is populated with a team member and a group. Next up, you will add an enterprise application from the gallery so you have something to protect with Single Sign-On.

Add an Enterprise Application from the Gallery

Your directory now has a team member and a security group organizing them. The next piece is the application your team needs to access.

You need a real application to protect with Single Sign-On. The Microsoft Entra gallery provides hundreds of pre-integrated apps you can add without building or hosting anything yourself.

In this step, get ready to:

Add the Microsoft Entra SAML Toolkit from the gallery.
Configure the application to require user assignment.

Add the Microsoft Entra SAML Toolkit from the gallery

Enterprise applications in Microsoft Entra ID represent the software your organization uses. By registering an app in your directory, you gain a single place to control who can access it and how they sign in.

In the left menu, browse to Entra ID > Enterprise apps > All applications.
Click New application.

The Browse Microsoft Entra Gallery pane opens, showing thousands of pre-integrated apps.

In the search box, type Microsoft Entra SAML Toolkit.
Select Microsoft Entra SAML Toolkit from the results.
In the Name field, enter Microsoft Entra SAML Toolkit 1.
Click Create.

After a moment, the application's Overview page appears, confirming it was added to your tenant.

What is an enterprise application?

An enterprise application is a record in your directory that represents a piece of software your organization uses. It gives you a single control panel for managing who can access the app and how they authenticate.

The Microsoft Entra SAML Toolkit is a purpose-built test application by Microsoft. It lets you practice SAML-based SSO configuration without needing to set up your own server.

Can't find the SAML Toolkit in the gallery?

Make sure you are searching for the exact name Microsoft Entra SAML Toolkit (not "Azure AD SAML Toolkit", the older name).

If you see a permissions error, your account needs at least the Cloud Application Administrator role. Help me troubleshoot adding an enterprise application

Require user assignment for the application

By default, any user in your tenant can access a new enterprise application. You need to lock it down so only explicitly assigned users can sign in.

On the application page, in the left menu under Manage, select Properties.
Find the Assignment required? setting and set it to Yes.
Find Enabled for users to sign in? and confirm it is set to Yes.
Click Save in the top bar.

Why set Assignment required to Yes?

When this is set to Yes, users and services must be explicitly assigned to the application before they can sign in or obtain an access token. Anyone not on the assignment list gets blocked.

This is the access control mechanism you will test in the next step. Right now, zero users are assigned, which means nobody can sign in yet.

Don't see the Properties option?

Make sure you are inside the Microsoft Entra SAML Toolkit 1 application page, not the main Enterprise applications list. The Properties link appears under the Manage section in the left menu.

If your changes do not persist after clicking Save, refresh the page and try again. Help me find the Properties page for my enterprise application

Verify the application is in your tenant

Before you move on, confirm everything landed correctly. How many users do you think currently have access to this application?

In the left menu, browse back to Entra ID > Enterprise apps > All applications.
Confirm that Microsoft Entra SAML Toolkit 1 appears in the list.

The answer is zero. You set Assignment required? to Yes but have not assigned anyone yet. The application exists, but nobody can sign in to it.

Your enterprise application is registered and locked down. Next up, you will see exactly what happens when someone tries to access an application they have not been assigned to.

Try to Access the App Without Assignment

Your enterprise application is registered and locked down. You set Assignment required? to Yes, which means only users you explicitly grant access can sign in.

But does that setting actually do anything? In this step, you will configure SAML-based Single Sign-On on your application and then attempt to use it. With no users assigned, this is the moment you find out what access control looks like in practice.

In this step, get ready to:

Enable SAML SSO on your enterprise application.
Attempt the SSO test and observe what happens when no users are assigned.

Enable SAML SSO on the application

Before you can test whether access control blocks unassigned users, you need a sign-on method configured. SAML SSO lets users authenticate through Microsoft Entra ID instead of a separate username and password for every app.

In the Microsoft Entra admin center, browse to Entra ID > Enterprise apps > All applications.
Select Microsoft Entra SAML Toolkit 1 from the list.
In the left menu under Manage, select Single sign-on.
Select SAML as the single sign-on method.
In the Basic SAML Configuration section, click Edit.
In the Reply URL (Assertion Consumer Service URL) field, enter https://samltoolkit.azurewebsites.net/SAML/Consume.
In the Sign on URL field, enter https://samltoolkit.azurewebsites.net/.
Leave the Identifier (Entity ID) as-is. It auto-generates based on your tenant.
Click Save.

What is SAML SSO?

SAML (Security Assertion Markup Language) is a protocol that lets one system vouch for a user's identity to another system. Instead of each application managing its own login, SAML lets Microsoft Entra ID handle authentication centrally.

The Reply URL tells Entra where to send the authentication token after a user signs in. The Sign on URL is where the user starts the login flow.

After saving, your Basic SAML Configuration section displays the Reply URL and Sign on URL you just entered.

Don't see the Save button?

Make sure you clicked Edit in the Basic SAML Configuration section first. The fields are read-only until you enter edit mode.

If you still have trouble, check that you have the Cloud Application Administrator or Application Administrator role on your account.

Help me troubleshoot why I cannot edit the Basic SAML Configuration fields in my enterprise application.

Attempt to test SSO

The SAML configuration is saved. Now you have a fully configured sign-on method pointing at a real application. The only thing missing is user assignment.

On the same page, scroll down to the Test single sign-on with Microsoft Entra SAML Toolkit 1 section.

Before you click Test, think about what you expect to happen. No users have been assigned to this application, and you set Assignment required to Yes in the previous step. What do you think the system will do?

Click Test.

You see an error. The system blocks the sign-in attempt with error code AADSTS50105, indicating that the signed-in user is not assigned to a role for the application.

Why did this fail?

This is access control working exactly as intended. When you set Assignment required? to Yes, Microsoft Entra ID checks whether the signing-in user has been explicitly granted access. Since nobody has been assigned yet, the request is denied.

In a real organization, this is how you prevent unauthorized employees from accessing applications they should not use. The gate works. Now you need to open it for the right people.

What does AADSTS50105 mean?

The error code AADSTS50105 confirms that Entra ID authenticated you successfully, but then blocked access because no assignment exists. Authentication (proving who you are) succeeded. Authorization (proving you are allowed in) failed.

The gate is confirmed working. In the next step, you will assign your test user to the application, complete the full SAML configuration, and prove that the right person can sign in with a single click.

Assign Your User and Complete the SSO Configuration

The access denial you saw in the previous step proves that your access control is working as designed. Only assigned users can reach the application.

Now it is time to fix that gap by assigning Alex Johnson to the application and completing the full SAML configuration. By the end of this step, your test user will sign in with a single click via Single Sign-On.

In this step, get ready to:

Assign Alex Johnson to the enterprise application with the Standard User role.
Register on the SAML Toolkit website and configure it with your tenant's SAML values.
Update the SSO configuration and verify a successful single sign-on.

Assign your test user to the application

The application currently blocks everyone because no users are assigned to it. Adding Alex Johnson to the app's user list with a role is what unlocks access for that account.

In the Microsoft Entra SAML Toolkit 1 application, select Users and groups in the left menu.
Click Add user/group.
Under Users and groups, click None Selected.
Search for Alex Johnson.
Select the user, then click Select.
Under Select a role, click None Selected.
Choose Standard User, then click Select.
Click Assign.

Alex Johnson now appears in the Users and groups list with the role Standard User.

Don't see Alex Johnson in the list?

Make sure you searched for the display name, not the email address. Also verify the user was created in the same directory (tenant) as the enterprise application.

If you see an AADSTS50105 error later when testing, it means the assignment did not save correctly. Return to Users and groups and confirm the user is listed.

Help me troubleshoot why my user assignment isn't working in Microsoft Entra ID.

Configure the SAML Toolkit application

Now that your user is assigned, you need to complete the second half of the SAML handshake. The Entra admin center holds configuration values that the SAML Toolkit application needs to know about, and vice versa.

In the Microsoft Entra SAML Toolkit 1 application, select Single sign-on in the left menu.
Scroll down to the Set up Microsoft Entra SAML Toolkit 1 section.
Copy the Login URL, Microsoft Entra Identifier, and Logout URL values and paste them into a text file or notepad for safekeeping.
In the SAML Certificates section, click Download next to Certificate (Raw).
Save the certificate file to your computer.

What are these values for?

The Login URL tells the SAML Toolkit where to send users for authentication. The Microsoft Entra Identifier is your tenant's unique identity. The Logout URL handles sign-out.

The certificate proves that SAML tokens really came from your tenant and were not forged. Together, these four pieces let the toolkit trust your Microsoft Entra ID tenant.

Open a new browser tab and go to https://samltoolkit.azurewebsites.net.
Click Register in the upper right corner.
In the Email field, enter your test user's UPN (testuser@your-tenant-domain.onmicrosoft.com).
Enter a password in the Password field and confirm it.
Click Register.

You are now registered on the SAML Toolkit site. Next, you will configure the SAML settings so the toolkit knows how to talk to your tenant.

Sign in to the SAML Toolkit with the credentials you just created.
Click SAML Configuration at the upper-left corner of the page.
Click Create.
Paste the Login URL value you recorded from the Entra admin center into the Login URL field.
Paste the Microsoft Entra Identifier value into the Identifier field.
Paste the Logout URL value into the Logout URL field.
Upload the certificate file you downloaded earlier.
Click Create.

The page now displays a SP Initiated Login URL and an Assertion Consumer Service (ACS) URL.

Copy both the SP Initiated Login URL and the Assertion Consumer Service (ACS) URL values.

Keep these URLs handy

You will paste both values back into the Entra admin center in the next substep. Save them in the same text file where you recorded the earlier values.

Update the SSO values in your tenant and test

The SAML Toolkit now knows about your Entra tenant. You need to complete the loop by telling your Entra tenant about the toolkit's specific URLs.

Switch back to the Microsoft Entra admin center tab in your browser.
On the Set up single sign-on with SAML pane, click Edit in the Basic SAML Configuration section.
Replace the Reply URL (Assertion Consumer Service URL) with the ACS URL you copied from the toolkit.
Replace the Sign on URL with the SP Initiated Login URL you copied from the toolkit.
Click Save.

Before you click Test, what do you expect to happen this time compared to your last attempt? Remember, Alex Johnson is now assigned to the application.

Scroll down to the Test single sign-on with Microsoft Entra SAML Toolkit 1 section.
Click Test.
Sign in with your test user's Microsoft Entra credentials (Alex Johnson's UPN and password).

You are successfully signed into the SAML Toolkit application via SSO. The same test that failed with an access denied error in the previous step now succeeds because Alex Johnson is assigned to the app.

What just happened?

Your Entra tenant issued a SAML token proving Alex Johnson's identity. The SAML Toolkit received that token, validated it against the certificate you uploaded, and signed the user in without asking for a separate password.

This is SSO in action. One set of credentials, managed in one place, grants access to any application that trusts your tenant.

Still seeing an error when you test?

If you see AADSTS50105 - The signed in user is not assigned to a role for the application, the user assignment did not take effect. Go back to Users and groups and confirm Alex Johnson is listed with the Standard User role.

If the sign-in page loads but then redirects to an error on the toolkit side, double-check that the ACS URL and SP Initiated Login URL were pasted into the correct fields in Basic SAML Configuration.

Help me debug why my SSO test is still failing after assigning the user.

Secret mission

Add Role-Based Access with Multiple Groups

Real organizations have multiple departments with different access levels. In this challenge, you will create a second department group, define custom app roles, and assign each group a different role. You will verify that each group's members receive the correct role when signing in via SSO.

Clean Up Your Resources

Decide whether to keep your resources running, pause them to come back later, or delete them entirely. This project runs entirely within the Microsoft Entra admin center using free-tier features, so there are no ongoing costs.

Resources you used:

Test users in your Microsoft Entra directory (Alex Johnson, Jordan Smith).
Security groups (Engineering Team, Marketing Team).
Enterprise application (Microsoft Entra SAML Toolkit 1) with SAML SSO configuration and custom app roles.

Keep everything running

No action needed. Choose this if you are still actively experimenting with Microsoft Entra ID or plan to extend this project further.

All resources are free-tier and incur no charges.
Your test users, groups, enterprise application, and SSO configuration will remain available for continued learning.
The SAML Toolkit registration at https://samltoolkit.azurewebsites.net also remains active.

Pause - I'll come back to this later

Disable sign-in to the application so no one can use SSO while you are away, without deleting any configuration.

In the Microsoft Entra admin center, browse to Entra ID > Enterprise apps > All applications.
Select Microsoft Entra SAML Toolkit 1.
Select Properties in the left menu under Manage.
Set Enabled for users to sign in? to No.
Click Save.
When you return, set it back to Yes to re-enable SSO access.

Delete - I don't want to use this again

Remove all project resources from your tenant and start fresh.

Delete the enterprise application:

Browse to Entra ID > Enterprise apps > All applications.
Select Microsoft Entra SAML Toolkit 1.
Select Properties in the left menu.
Click Delete at the top of the page, then confirm the deletion.

Delete the security groups:

Browse to Entra ID > Groups > All groups.
Select Engineering Team.
Click Delete at the top of the page, then confirm.
Repeat for the Marketing Team group.

Delete the test users:

Browse to Entra ID > Users.
Select the checkbox next to Alex Johnson.
Click Delete at the top of the page, then confirm.
Repeat for Jordan Smith.

Deleted users go to a soft-delete state

Microsoft Entra ID retains deleted users for 30 days before permanently removing them. You can restore them during this period if needed.

Nice Work!

You just built a complete identity and access management setup using Microsoft Entra ID. Your directory has real users, organized groups, an enterprise application protected by SAML-based Single Sign-On, and proven access control.

You've learned how to:

Set up a Microsoft Entra ID directory with test users and a security group to organize them by department.
Configure SAML-based Single Sign-On on an enterprise application and prove that unassigned users are blocked from access.
Assign users to the application and verify successful SSO with a single-click sign-in using Microsoft Entra credentials.
Secret Mission: Configure role-based access with multiple department groups, giving each group different permissions in the application.

Ready to quiz yourself?