Skip to main content

SAML Setup for Azure SSO

To set up TrustLayer access via SSO in Microsoft Entra ID, perform the following steps.

Configure the app in Microsoft Entra

  1. Go to Enterprise Applications.

  2. Click New Application.

  3. Click Create your own application.

  4. Enter TrustLayer as the app name, select "Integrate any other application you don't find in the gallery (Non-gallery)", and click Create.

  5. Go to Single sign-on in the newly created app and select SAML.

  6. Click Edit in the Basic SAML Configuration panel.

  7. Click Add identifier and enter trustlayer.io.

  8. Click Add reply URL and enter https://auth.trustlayer.io/__/auth/handler, then Save.

  9. In Attributes & Claims, click Edit and make sure the name attributes are sent: add a claim givenname → user.givenname and surname → user.surname (these populate your users' first and last names in TrustLayer). If your Unique User Identifier (Name ID) is not the user's email address, also add an email claim mapped to user.mail.

  10. In the SAML Certificates section, download the Certificate (Base64) file — you will need it in TrustLayer.

  11. In the Set up TrustLayer box, copy the Login URL and the Microsoft Entra Identifier — you will need them in TrustLayer.

  12. Assign the app to users as needed from the Users and groups section.
    ​

Create the configuration in TrustLayer

  1. In TrustLayer, go to Settings → Single Sign-On (visible to workspace Owners) and click Create configuration.

  2. Select SAML 2.0 and fill in:

    • Entity ID → the Microsoft Entra Identifier (step 11)

    • Single sign-on URL → the Login URL (step 11)

    • Certificate → the contents of the Certificate (Base64) file (step 10)

    • Domains → the email domain(s) you want SAML login for (e.g. yourdomain.com)

  3. Save, then verify each domain by adding the DNS TXT record shown on the page (record name @) and clicking Verify. DNS changes can take up to 48 hours to propagate.

  4. Once at least one domain is verified, go to the Activation card on the same page and click Turn on single sign-on. Verifying a domain proves that you own it; it does not switch single sign-on on by itself.

From then on, all users with emails on your activated domains will be redirected to Microsoft Entra when they log in, and will be able to access TrustLayer if they have the app assigned. See Setting Up SSO (Single Sign-On) for how to add domains later or turn single sign-on off again.

Did this answer your question?