--- title: "Configure SSO with Entra ID" slug: "configure-sso-with-entra-id" updated: 2026-01-26T19:54:44Z published: 2026-01-26T19:54:44Z canonical: "support.controlup.com/configure-sso-with-entra-id" --- > ## Documentation Index > Fetch the complete documentation index at: https://support.controlup.com/llms.txt > Use this file to discover all available pages before exploring further. # Configure SSO with Entra ID 3rd party identity provider applicationsThis use case example is provided for your benefit, but we don't take responsibility for the screenshots, content, and functionality of these 3rd party applications. ## Prerequisites - Must have an Azure Enterprise account. - Microsoft Entra ID must be configured. - Must have the necessary permissions to create the application. ## Step 1 - Create the application in Microsoft Azure 1. In Microsoft Azure, go to **Enterprise Applications > New application**.![New Application tab in Enterprise applications](https://cdn.document360.io/098100b7-b9da-4bea-b4b9-017140ab863e/Images/Documentation/NewApplication.png) 2. Click **Create your own application**.![Create your own application button](https://cdn.document360.io/098100b7-b9da-4bea-b4b9-017140ab863e/Images/Documentation/CreateYourOwnApplication.png) 3. Enter a name for the application, select **Integrate any other application you don't find in the gallery**, and click **Create**.![click Integrate any other application you don't find in the gallery button](https://cdn.document360.io/098100b7-b9da-4bea-b4b9-017140ab863e/Images/Documentation/CreateYourOwnApplicationDetails.png) 4. Click **Get started** under **2. Set up single sign on**.![Click Set up single sign on](https://cdn.document360.io/098100b7-b9da-4bea-b4b9-017140ab863e/Images/Documentation/SetUpSingleSignOn.png) 5. Select **SAML** as the single sign-on method.![Select SAML as SSO method](https://cdn.document360.io/098100b7-b9da-4bea-b4b9-017140ab863e/Images/Documentation/SAMLmethod.png) ## Step 2 - Import data from ControlUp into Entra ID 1. In the ControlUp SAML settings page, click the **Export** icon and save the metadata file.![Click the Export icon](https://cdn.document360.io/098100b7-b9da-4bea-b4b9-017140ab863e/Images/Documentation/ExportFileFromControlUp.png) 2. In Entra ID, click **Upload metadata file**.![Click Upload Metadata file](https://cdn.document360.io/098100b7-b9da-4bea-b4b9-017140ab863e/Images/Documentation/UploadMetadataFile.png) 3. Select the file you exported from ControlUp and click **Add**.![Click Add to add the metadata file](https://cdn.document360.io/098100b7-b9da-4bea-b4b9-017140ab863e/Images/Documentation/AddUploadedMetadataFile.png) 4. The Identifier and Reply URL fields are automatically filled out. Click **Save**.![Click Save to save configuration](https://cdn.document360.io/098100b7-b9da-4bea-b4b9-017140ab863e/Images/Documentation/SaveBasicSAMLConfiguration(1).png) Note for single logout (SLO) If you want to use SLO, you must manually fill out an additional field in Entra ID. Copy the **IdP Logout URL** from the ControlUp SAML settings page and paste it into the **Logout Url** field in Entra ID. ## Step 3 - Import data from Entra ID into ControlUp 1. In Entra ID, download the **Federation Metadata XML** file.![Download Federation Metadata xml file](https://cdn.document360.io/098100b7-b9da-4bea-b4b9-017140ab863e/Images/Documentation/DownloadMetadataFileFromAzure.png) 2. In the ControlUp SAML settings page, click the **Import** icon and select the file you download from Entra ID in the previous step.![Click the Import icon](https://cdn.document360.io/098100b7-b9da-4bea-b4b9-017140ab863e/Images/Documentation/ImportFileToControlUp.png) ## Step 4 - Configure user attributes in Entra ID The required user attributes depend on how you use ControlUp and which SAML features you want to use. Read through this section and configure all user attributes that apply to your situation. Note that it is possible that none of the following sections apply to you and the default user attributes in Entra ID contain all the required information. ### IdP-initiated SSO Follow these steps if you want to use IdP-initiated SSO: 1. Click **Edit** in the **Attributes & Claims** section. 2. Click **Add new claim**. 3. Enter "orgurl" in the **Name** field and enter the name of your organization in the **Source attribute** field. For example, if you access ControlUp from [app.controlup.com/acmeorg,](//app.controlup.com/acmeorg,) enter acmeorg for the source attribute. 4. Click **Save**. ![Enter name of organization in the Source attribute field](https://cdn.document360.io/098100b7-b9da-4bea-b4b9-017140ab863e/Images/Documentation/orgurlAttribute.png) ### Assign user roles based on Entra ID group membership Follow these steps if you want to assign ControlUp user roles based on Entra ID group membership. Note that this feature requires [additional configuration in your ControlUp SAML settings page](/v1/docs/assign-user-roles-with-idp-groups). Read [Microsoft's documentation](https://learn.microsoft.com/en-us/entra/identity/hybrid/connect/how-to-connect-fed-group-claims#add-group-claims-to-tokens-for-saml-applications-using-sso-configuration) to learn more about adding group claims. 1. Click **Edit** in the **Attributes & Claims** section. 2. Click **Add a group claim**.![Add a group claim link](https://cdn.document360.io/098100b7-b9da-4bea-b4b9-017140ab863e/Images/Documentation/AddGroupClaim.png) 3. Select the groups to add to the claim and click **Save**. Note that `groups` shown in the screenshot below is just the friendly name for the attribute. You should not change the real name of the attribute from it's default value: `http://schemas.microsoft.com/ws/2008/06/identity/claims/groups`.![Select Groups assigned to the application](https://cdn.document360.io/098100b7-b9da-4bea-b4b9-017140ab863e/Images/Documentation/UserGroupsAttributes.png) NoteIf you have more than 150 groups in Entra ID, then you might have to manually add the relevant groups to the ControlUp enterprise application in Entra ID and select **Groups assigned to the application** when configuring the group claim. ### ControlUp for VDI & DaaS The attributes in this section are necessary only if you use ControlUp for VDI & DaaS and either of the following is true: - You use Real-Time DX version 9.0 or higher AND use LDAP to authorize to the VDI App in the web interface. To learn more about web interface authorization methods, see [here](/v1/docs/vdi-daas-authentication-methods). - You use a Real-Time DX version lower than 9.0. If either of the above bullet points applies to you, perform the following steps: 1. Click **Edit** in the **Attributes & Claims** section. 2. Click **Add new claim**. 3. Enter sAMAccountName in the **Name** field and select user.onpremisessamaccountname in the **Source attribute** field. Click **Save**. 4. Click **Add new claim** to add a second attribute. 5. Enter distinguishedName in the **Name** field and select user.onpremisesdistinguishedname in the **Source attribute** field. Click **Save**. ![Enter distinguishedName in the name field](https://cdn.document360.io/098100b7-b9da-4bea-b4b9-017140ab863e/Images/Documentation/VDIandDaaSAttributes.png) ## Step 5 - Set default role and save changes In the ControlUp SAML settings page, set the **Default** user role for DEX user accounts that are automatically provisioned when a new user signs in with SAML for the first time. Click **Apply** to save your SAML settings.![Set the default user role](https://cdn.document360.io/098100b7-b9da-4bea-b4b9-017140ab863e/Images/Documentation/DefaultRole(1).png) If you want to set ControlUp user roles based on Entra ID group membership, make sure you go to the **SSO Groups** settings and follow the steps in [Assign User Roles with SSO Groups](/v1/docs/assign-user-roles-with-idp-groups). ## Manual configuration (not required) The steps above show you how to set up SAML by importing and exporting XML metadata files between ControlUp and Entra ID. If you want to configure SAML manually, you can use these screenshots for reference. **Note that this is not required if you followed the steps above**. ![Manual configuration flow](https://cdn.document360.io/098100b7-b9da-4bea-b4b9-017140ab863e/Images/Documentation/Azure%20AD%20Basic%20SAML%20Configuration%20arrows.png) ![Click Upload Certificate button](https://cdn.document360.io/098100b7-b9da-4bea-b4b9-017140ab863e/Images/Documentation/AAD-DEX-DownloadAndUploadCertificate.png) ![Entity/Issuer ID link](https://cdn.document360.io/098100b7-b9da-4bea-b4b9-017140ab863e/Images/Documentation/AAD-DEX-SetUpControlUpSAML.png)