Azure Entra ID SSO - SAML

This guide covers setting up SAML-based SSO with Azure Entra ID using Enterprise Applications.

---

Prerequisites

✅ Organization Admin Account: You must be logged in as an organization admin
✅ Azure Entra ID Admin Access: You need administrator access to your organization’s Azure Entra ID

---

Phase 1: Azure Entra ID Enterprise Application

Step 1: Create Enterprise Application

1. Sign into Azure Portal
   • Go to portal.azure.com
   • Navigate to Azure Active Directory → Enterprise applications
2. Create New Application
   • Click “New application”
   • Click “Create your own application”
   • Name: Full-Fill SSO (or your preferred name)
   • Select: “Integrate any other application you don’t find in the gallery (Non-gallery)”
   • Click “Create”

Step 2: Configure Single Sign-On

1. In your new Enterprise Application, click “Single sign-on” in the left sidebar
2. Select “SAML” as the single sign-on method

Step 3: Get Full-Fill Configuration URLs

1. Log into Full-Fill as an organization admin
2. Go to Settings → SSO Configuration
3. Set SSO Provider to “Microsoft SAML”
4. Copy these URLs that appear (you’ll need them for Azure):
   • Identifier (Entity ID)
   • Reply URL (Assertion Consumer Service URL)

⚠️ Important: Keep these URLs handy - you’ll paste them into Azure in the next step.

Step 4: Configure Basic SAML Configuration in Azure

1. Back in Azure, in the SAML configuration page
2. In Section 1 (Basic SAML Configuration), click “Edit”
3. Manually enter the Full-Fill URLs:
   • Identifier (Entity ID): Paste the Entity ID from Full-Fill
   • Reply URL (Assertion Consumer Service URL): Paste the Reply URL from Full-Fill
4. Click “Save”

Step 5: Download Identity Provider Metadata

1. In Section 3 (SAML Signing Certificate)
2. Click “Download” next to “Federation Metadata XML”
3. Save this file & Copy the content

---

Phase 2: Full-Fill SAML Configuration

Step 6: Upload Azure Metadata to Full-Fill

1. In Full-Fill Settings → SSO Configuration
2. In the SAML Configuration section:
   • Paste the Azure metadata XML you downloaded in Step 5
   • The XML should start with <EntityDescriptor…
   • Click “Update SAML configuration”
3. Configure basic SSO settings:
   • Organization Domain: your-company.com
   • Enable SSO: Turn on the toggle
4. Click “Save All Settings”

---

Phase 3: Azure User Assignment

Step 7: Assign Users and Groups (unless configuring SCIM provisioning)

1. Back in Azure Enterprise Application
2. Click “Users and groups” in the left sidebar
3. Click “Add user/group”
4. Select users or groups who should have access to Full-Fill
5. Click “Assign”

⚠️ Important: Only assigned users can access Full-Fill via SAML SSO.

---

Phase 4: Testing and Rollout

Step 8: Test SAML SSO

1. In Azure Enterprise Application, click “Single sign-on”
2. Click “Test” at the bottom of the SAML configuration
3. OR manually test:
   • Open incognito browser
   • Go to Full-Fill login page
   • Enter email from your organization domain
   • Should redirect to Azure SAML login

Step 9: Verify SAML Response

If test succeeds, you should see:

• ✅ Successful redirect to Azure login
• ✅ User authentication in Azure
• ✅ SAML assertion sent to Full-Fill
• ✅ User logged into Full-Fill

If test fails:

• Check metadata XML was uploaded correctly in both directions
• Verify user is assigned to the Azure Enterprise Application
• Check Full-Fill domain matches user’s email domain