How do I set up SAML SSO with Microsoft?

In this article, you will get a step-by-step guide to setting up SAML SSO with Microsoft as the identity provider.

In this article, you will receive a step-by-step guide to setting up SAML SSO if you use Microsoft as your identity provider. If you are looking for instructions on setting up SSO login at sipgate, you can find them here.

1

Open the Identity section

In the first step, log in to your Microsoft account as an admin and select in the right-hand menu: Show all --> Identity .

sipgate-Hilfecenter-SSO-Microsoft1.png

2

Create application

In the Entra Admin Center, go to the right-hand menu, select Applications and then click on Create your own application.

sipgate-Hilfecenter-SSO-Microsoft2.png

After a new window has opened on the right-hand side, you can enter any name that should sipgate be included. The remaining settings can be left unchanged at the default settings. Finally, click the Create.

sipgate-Hilfecenter-SSO-Microsoft3.png

3

Choose SSO method

The sipgate application has been created successfully. You can find it under Applications --> Overview . In the next step, go to Set up SSO.

sipgate-Hilfecenter-SSO-Microsoft4.png

Click under Select SSO method to SAML.

sipgate-Hilfecenter-SSO-Microsoft5.png

4

Transfer IdP data

In the next step, you will receive an overview of the setup steps as well as all required data for configuring the SSO setup at sipgate. This data includes the SSO URL, which Entity ID and the certificate.

To transfer this data to your sipgate account, go to point 4 in the overview Set up sipgate and copy the following information: the Login URL (SSO URL) and the Azure AD identifier (Entity ID).

sipgate-Hilfecenter-SSO-Microsoft6.png

5

Enter certificate

In point 3 SAML certificates proceed as follows: Click on Edit and select SAML signing certificate. Then open the certificate's context menu and download the Base64 certificate download it.

sipgate-Hilfecenter-SSO-Microsoft8.png

Open the certificate with the default text editor (file with the extension '.cer'). Copy the certificate text from the editor and paste it into sipgate under certificate .

6

Enter SP data

Go to point 1 Basic SAML configuration and click Edit. Enter the following data from the SSO area in sipgate (service provider data): Entity-Id --> Entity ID and ACS URL --> Reply URL (Assertion Consumer Service URL) and click Save.

sipgate-Hilfecenter-SSO-Microsoft10.png

7

Assign users

In the next step, go to the left navigation menu and select Users and groups --> Add user/group .

sipgate-Hilfecenter-SSO-Microsoft11.png

To select specific users or groups for SSO use, click under Users and groups to None selected.

sipgate-Hilfecenter-SSO-Microsoft12.png

Here you have the option to select the groups or users for your SSO application.

sipgate-Hilfecenter-SSO-Microsoft13.png

In the final step, click Assign.

sipgate-Hilfecenter-SSO-Microsoft14.png

8

Enable SSO at sipgate

Once you have successfully completed these steps, the interface between sipgate and Microsoft should be set up. You can then activate SSO login using the toggle at sipgate.

sipgate-Hilfecenter-SSO7.3.png

Errors and solutions

Error message: "An error occurred. Please try again. Back to login."

Cause: The sipgate web user with Microsoft SSO was deleted and created as a new sipgate web user. In the Microsoft SSO database, the old sipgate web user is still linked. Workaround: ask sipgate Support to delete the Microsoft SSO entry so that the next Microsoft SSO login works. Solution: We are working on a solution so that when a sipgate web user is deleted, the Microsoft SSO deletion is also carried out. Error: SSO login does not work with error “AADSTS750054: SAMLRequest or SAMLResponse must be present as query string parameters in HTTP request for SAML Redirect binding.” Cause: unknown Solution approach: In the browser, e.g. Chrome sipgate.de open, via F12 go to the Network tab, then log in to sipgate via SSO and look in the network tab for the POST request to our ACS URL (contains sipgate-sso- and the customer number), and send us the SAMLResponse there via sipgate Support