SAML Single Sign-On with Microsoft Entra ID (Azure AD)

Who this guide is for: The IT administrator who manages your organization’s Microsoft Entra ID tenant (formerly Azure Active Directory). You will need Global Administrator or Application Administrator access. See also: SAML SSO Admin Guide for the embaylms side.

Overview

This guide walks through registering embaylms as an Enterprise Application in Microsoft Entra ID and configuring SAML 2.0 SP-initiated SSO.

Protocol: SAML 2.0, SP-initiated, HTTP-POST binding

Prerequisites

• Microsoft Entra ID tenant with Global Administrator or Application Administrator role
• embaylms admin access
• embaylms tenant slug (e.g., acme for acme.embaylms.com)

Step 1 — Get SP values from embaylms

In embaylms: Admin Panel → Settings → Single Sign-On → View SP Metadata.

Note these values (replace {slug} with your actual tenant slug):

Step 2 — Create an Enterprise Application

1. In the Azure portal, navigate to Microsoft Entra ID → Enterprise applications → New application.
2. Click Create your own application.
3. Name it (e.g., EmbayLMS) and select Integrate any other application you don’t find in the gallery (Non-gallery).
4. Click Create.

Step 3 — Configure single sign-on

1. On the application overview page, click Single sign-on.
2. Select SAML as the sign-on method.
3. Click the edit pencil on Basic SAML Configuration:

Click Save.

Step 4 — Configure attributes and claims

Click the edit pencil on Attributes & Claims.

Entra ID sends a default set of claims. Ensure the following are present:

To set the NameID format to Email:

1. Click Unique User Identifier (Name ID).
2. Set Name identifier format to Email address.
3. Set Source attribute to user.mail.
4. Click Save.

Step 5 — Get IdP values from Entra ID

On the SAML-based Sign-on page, scroll to SAML Certificates and Set up EmbayLMS sections.

Collect:

Download the Base64 certificate (not the Raw/PEM option). The downloaded .cer file contains a PEM-encoded certificate — you can paste its contents directly into embaylms.

Step 6 — Enter IdP values in embaylms

1. In embaylms: Admin Panel → Settings → Single Sign-On → Add Identity Provider.
2. Select SAML 2.0.
3. Enter the values from Step 5:

4. Under JIT Provisioning, confirm:
   • Enabled: ON (recommended)
   • Default role: learner
5. Click Save and enable the configuration.

Step 7 — Assign users or groups

1. In Entra ID, go to Enterprise applications → EmbayLMS → Users and groups.
2. Click Add user/group.
3. Search for and select the users or groups who should have access to embaylms.
4. Click Assign.

Only assigned users or group members can sign in via SSO.

Step 8 — Test

1. Open a private / InPrivate browser window.
2. Navigate to https://{slug}.embaylms.com/login.
3. Click Sign in with SSO.
4. You should be redirected to Microsoft’s login page.
5. Sign in with a test user who is assigned to the application.
6. You should land on the embaylms dashboard.

Troubleshooting

“AADSTS50105: The signed-in user … is not assigned to a role for the application” The user is not assigned to the Entra ID enterprise application. Go to Entra ID → Enterprise applications → EmbayLMS → Users and groups and add the user.

“The SSO response from your identity provider was invalid” (in embaylms) The certificate stored in embaylms doesn’t match Entra ID’s current signing certificate. Download the current Base64 certificate from the SAML Certificates section in Entra ID and update it in embaylms.

NameID is not an email address Ensure the Name ID claim in Entra ID is set to user.mail with format Email address (Step 4). If user.mail is empty for guest users, use user.userprincipalname instead.

“Your account was not found” (in embaylms) JIT provisioning is disabled. Enable it in embaylms or pre-create the user account.

Related guides

• SAML SSO Admin Guide
• Okta SAML setup
• SCIM Provisioning