| 
1 |  | -# Configuring SAML with Microsoft Entra ID  | 
 | 1 | +# Configuring SAML with Microsoft Entra ID   | 
 | 2 | +<Callout type="note">Formerly known as Azure Active Directory, or Azure AD.</Callout>  | 
2 | 3 | 
 
  | 
3 | 4 | ## 1. Add an unlisted (non-gallery) application to your Microsoft Entra ID organization  | 
4 | 5 | 
 
  | 
5 | 6 | 1. In Microsoft Entra ID, create an unlisted (non-gallery) application [following the official documentation](https://docs.microsoft.com/en-us/azure/active-directory/manage-apps/add-non-gallery-app).  | 
6 |  | -1. Once the application is created, follow [these instructions to enable SAML SSO](https://docs.microsoft.com/en-us/azure/active-directory/manage-apps/configure-single-sign-on-non-gallery-applications). Use these configuration values (replacing "sourcegraph.example.com" with your Sourcegraph instance URL):  | 
7 |  | -  * **Identifier (Entity ID):** `https://sourcegraph.example.com/.auth/saml/metadata`  | 
8 |  | -  * **Reply URL (Assertion Consumer Service URL):** `https://sourcegraph.example.com/.auth/saml/acs`  | 
9 |  | -  * **Sign-on URL, Relay State, and Logout URL** can be left empty.  | 
10 |  | -  * **User Attributes & Claims:** Add the following attributes.  | 
11 |  | -    - `emailaddress`: user.mail (required)  | 
12 |  | -    - `name`: user.userprincipalname (optional)  | 
13 |  | -    - `login`: user.userprincipalname (optional)  | 
14 |  | -  * **Name ID**: `email`  | 
15 |  | -  * You can leave the other configuration values set to their defaults.  | 
16 |  | -1. Record the value of the "App Federation Metadata Url". You'll need this in the next section.  | 
 | 7 | +2. Once the application is created, follow [these instructions to enable SAML SSO](https://docs.microsoft.com/en-us/azure/active-directory/manage-apps/configure-single-sign-on-non-gallery-applications). Use these configuration values (replacing "sourcegraph.example.com" with your Sourcegraph instance URL):  | 
 | 8 | +    * **Identifier (Entity ID):** `https://sourcegraph.example.com/.auth/saml/metadata`  | 
 | 9 | +    * **Reply URL (Assertion Consumer Service URL):** `https://sourcegraph.example.com/.auth/saml/acs`  | 
 | 10 | +    * **Sign-on URL, Relay State, and Logout URL** can be left empty.  | 
 | 11 | +    * **User Attributes & Claims:** Add the following attributes.  | 
 | 12 | +      - `emailaddress`: user.mail (required)  | 
 | 13 | +      - `name`: user.userprincipalname (optional)  | 
 | 14 | +      - `login`: user.userprincipalname (optional)  | 
 | 15 | +    * **Name ID**: `email`  | 
 | 16 | +    * You can leave the other configuration values set to their defaults.  | 
 | 17 | +3. Record the value of the "App Federation Metadata Url". You'll need this in the next section.  | 
17 | 18 | 
 
  | 
18 | 19 | ## 2. Add the SAML auth provider to Sourcegraph site config  | 
19 | 20 | 
 
  | 
 | 
33 | 34 | }  | 
34 | 35 | ```  | 
35 | 36 | 
 
  | 
36 |  | -> NOTE: Optional, but recommended: [add automatic provisioning of users with SCIM](/admin/scim).  | 
 | 37 | +<Callout type="note">Recommended: [add automatic provisioning of users with SCIM](/admin/scim).</Callout>  | 
0 commit comments