Skip to main content

SAML Setup for Microsoft Entra ID SSO

To set up TrustLayer access via SSO in Microsoft Entra ID, perform the following steps.

Configure the app in Microsoft Entra

  1. Go to Enterprise Applications.

  2. Click New Application.

  3. Click Create your own application.

  4. Enter TrustLayer as the app name, select "Integrate any other application you don't find in the gallery (Non-gallery)", and click Create.

  5. Go to Single sign-on in the newly created app and select SAML.

  6. Click Edit in the Basic SAML Configuration panel.

  7. Click Add identifier and enter trustlayer.io.

  8. Click Add reply URL and enter https://auth.trustlayer.io/__/auth/handler, then Save.

  9. In Attributes & Claims, click Edit, then click Add new claim two times to add these claims. Keep the Namespace field empty. TrustLayer reads only these exact claim names to show the first and last names of your users:

    • Name firstName → Source attribute user.givenname

    • Name lastName → Source attribute user.surname

    If your Unique User Identifier (Name ID) is not the email address of the user, also add an email claim mapped to user.mail.

  10. In the SAML Certificates section, download the Certificate (Base64) file. Microsoft Entra creates this signing certificate. TrustLayer does not send you a certificate.

  11. In the Set up TrustLayer box, copy the Login URL and the Microsoft Entra Identifier. You will need them in TrustLayer.

  12. Assign the app to users as needed from the Users and groups section.

Token encryption: TrustLayer does not use SAML assertion encryption and does not supply an encryption certificate. Keep Token encryption off for the TrustLayer app.

Create the configuration in TrustLayer

  1. In TrustLayer, go to Settings → Single Sign-On (visible to workspace Owners) and click Create configuration.

  2. Select SAML 2.0 and fill in:

    • Entity ID → the Microsoft Entra Identifier (step 11)

    • Single sign-on URL → the Login URL (step 11)

    • Certificate → the contents of the Certificate (Base64) file (step 10)

    • Domains → the email domain(s) you want SAML login for (e.g. yourdomain.com)

  3. Save, then verify each domain by adding the DNS TXT record shown on the page (record name @) and clicking Verify. DNS changes can take up to 48 hours to propagate.

  4. Once at least one domain is verified, go to the Activation card on the same page and click Turn on single sign-on. Verifying a domain proves that you own it; it does not switch single sign-on on by itself.

The SAML 2.0 configuration form:

From then on, all users with emails on your activated domains will be redirected to Microsoft Entra when they log in, and will be able to access TrustLayer if they have the app assigned. See Setting Up SSO (Single Sign-On) for how to add domains later or turn single sign-on off again.

Did this answer your question?