# Single Sign-On SAML Integration - Microsoft Entra

If you have an Enterprise account in Row Zero, you can configure single sign-on (SSO) via [SAML 2.0](https://wiki.oasis-open.org/security/FrontPage#SAML_V2.0_Standard) using your organization's existing Microsoft Entra SSO provider. Row Zero supports SAML 2.0 for single sign-on with HTTP-POST binding.

**Prerequisites**

Before starting, ensure you have administrator access to **Microsoft Entra ID**.

## Step 1: Create an Enterprise Application

Log into the Microsoft Entra admin center.

1. Navigate to your company’s Microsoft Azure Home and in the left navigation menu of the, select **Enterprise applications**.

   ![entra enterprise applications](https://cdn.sanity.io/images/2w8agf2t/production/020f51a1e8fb80cf85031f50a7a1c67e2c0e68a2-484x592.jpg)

2. Click **+ New application**

   ![entra enterpirse new application](https://cdn.sanity.io/images/2w8agf2t/production/de99aad50b66060667909b52c6bb50d5ed7ea9e4-996x134.jpg)

3. Choose **+ Create your own application**

   ![entra create your own application](https://cdn.sanity.io/images/2w8agf2t/production/1e4b338a5c329a53d5b62ece493af9a08b9edaee-711x230.jpg)

4. Enter **Row Zero** as the application name and select **Integrate any other application you don’t find in the gallery (Non-gallery)**.

   ![entra integrate other application](https://cdn.sanity.io/images/2w8agf2t/production/0be7cc2769b8b6a7081d495f3fe06e6521121de7-722x451.jpg)

5. Click **Create**

## **Step 2: Configure SSO**

1. Once the enterprise application is created, click on “**Single sign-on**” in the left tab and click “**SAML**”:

   ![entra sso saml](https://cdn.sanity.io/images/2w8agf2t/production/a65a26e690e489d9b03ca40a6fc65a3cf6169b3f-1353x1212.jpg)

2. Under “**Basic SAML Configuration**” click the “**Edit**” icon:

   ![entra basic saml configuration](https://cdn.sanity.io/images/2w8agf2t/production/c19c3c91b9129148a81a4ae15306d06d5dd1a8ea-1395x1276.jpg)

3. Under “**Basic SAML Configuration**” populate the following and click “**Save**” (**Note:** You will need to replace **CONNECTION_NAME** above with an identifier that Row Zero will provide; contact us when you are setting up your SSO integration and we will give you the **CONNECTION_NAME** to use):
    - Identifier (Entity ID) - urn:auth0:rowzero:CONNECTION_NAME
    - Reply URL (Assertion Consumer Service URL) - https://auth.rowzero.io/login/callback?connection=CONNECTION_NAME
    - Sign on URL (Optional) - https://rowzero.com/startlogin?connection=CONNECTION_NAME
    - Relay State (Optional) - [https://rowzero.com/startlogin?connection=](https://rowzero.com/startlogin?connection=)CONNECTION_NAME

      ![entra basic saml configuration](https://cdn.sanity.io/images/2w8agf2t/production/1ab7502fe02dc3f5558a7211b0207f34de3e0df8-1069x1216.jpg)

4. Under “**Attributes & Claims**” click the “**Edit**” icon:

   ![entra attributes and claims edit](https://cdn.sanity.io/images/2w8agf2t/production/a2dccb8d574785c02cba118a40b735d311b31583-943x232.jpg)

5. Click “**+ Add new claim**” to establish both “**email**” and “**email_verified**” claims:
    - **Note**: For the “**email**” mapping, make sure it’s mapped to an attribute that _**is populated for each user**_. This attribute can be different for every user definition.
    - **Note**: For “**email_verified**” utilize the transformation “**ToLowercase (user.accountenabled)**” (or whatever user attribute that represents if an account is active) to produce a mapping to either “**true**” or “**false**”.

      ![entra required attributes and claims](https://cdn.sanity.io/images/2w8agf2t/production/6dde37b5426a85a90de1d5289b2cc546d83b6f2f-1098x619.jpg)

6. Provide Row Zero with the “**App Federation Metadata URL**” and “**Login URL**”:

![entra row zero needed attributes](https://cdn.sanity.io/images/2w8agf2t/production/24e2010486631843f62f9d392d2d614cbb581f72-946x721.jpg)

## **Step 3: Assign Users and Groups**

You must assign users and/or groups to the application before provisioning will sync them to Row Zero.

1. Open the **Row Zero** enterprise application.
2. In the left panel, select **Users and groups**.

   ![entra users and groups](https://cdn.sanity.io/images/2w8agf2t/production/8d5c147e91644a210bcb247a8e5df1b48bbcf1c6-401x465.jpg)

3. Under **Getting Started**, select **Assign users and groups**.

   ![entra assign users and groups](https://cdn.sanity.io/images/2w8agf2t/production/20bfce96ef8cda12defa8143b3ce251e94e8ab09-565x304.jpg)

4. Click on **Add user/group**
5. Click **None Selected** to open the selection panel.

   ![entra user group assignments](https://cdn.sanity.io/images/2w8agf2t/production/fdb5c252bc620e005260c34d808d6efb35031549-428x257.jpg)

6. Choose the users and/or groups you want to provision into Row Zero.
7. Click **Assign**