Microsoft Entra ID (Azure AD) SSO

Before you start

• !Create the app as a single-tenant application — Entra greys out SAML SSO for multi-tenant apps.

Values to give Microsoft Entra ID (Azure AD)

Copy these from ComplianceScout → Settings → SSO when you create the connection. The exact, per-connection values are shown there.

Configure Microsoft Entra ID (Azure AD)

Steps verified against the vendor documentation linked at the bottom of this page. Labels can change — that link is the source of truth.

1. 1

   Sign in to the Microsoft Entra admin center (entra.microsoft.com) as at least a Cloud Application Administrator.

2. 2

   Go to Entra ID → Enterprise apps → All applications, and select New application.

3. 3

   Select Create your own application. Name it (for example, ComplianceScout), choose "Integrate any other application you don't find in the gallery (Non-gallery)", and select Create.

4. 4

   In the app, open Single sign-on and select SAML.

5. 5

   In Basic SAML Configuration, select Edit. Either Upload metadata file (ComplianceScout's SP metadata XML), or enter manually: Identifier (Entity ID) = urn:guardstream:sp:<tenant_id> and Reply URL (ACS URL) = the ACS URL shown in ComplianceScout. Because ComplianceScout is SP-initiated, set Sign on URL to your ComplianceScout login URL. Save.

6. 6

   In Attributes & Claims, select Edit, open the Unique User Identifier (Name ID) claim, set Source attribute to user.mail (or user.userprincipalname), and set the name-identifier format to Email address.

7. 7

   In SAML Certificates, copy the App Federation Metadata Url (or download Certificate (Base64)). If your ComplianceScout connection also requires the response signed, use Edit → Signing Option = "Sign SAML response and assertion".

8. 8

   In the Set up <app> section, record Microsoft Entra Identifier (IdP Entity ID) and Login URL (IdP SSO URL).

9. 9

   Under Users and groups, assign the users/groups that should be able to sign in.

Values to enter in ComplianceScout

Back in Settings → SSO, paste these into the connection and save.

Role mapping (optional)

In Attributes & Claims select Add a group claim, choose Security groups (or Groups assigned to the application), and Save. Entra emits group object IDs (GUIDs) by default, so map those GUIDs to roles in ComplianceScout (or configure name emission where your directory supports it).

MFA pass-through (optional)

ComplianceScout treats the SAML authentication-context value http://schemas.microsoft.com/claims/multipleauthn as an MFA signal. Enable "Trust IdP for MFA" in ComplianceScout to honor it, and confirm your Entra Conditional Access / sign-in policy actually requires MFA so Entra emits that value. (Entra does not use a standard MultiFactor AuthnContextClassRef.)

Things to watch for

• !ComplianceScout always requires the assertion to be signed (this is not optional). You can additionally require the SAML response to be signed and/or the assertion to be encrypted to the SP certificate — toggle those per connection in Settings → SSO.
• !SAML SSO is only configurable on single-tenant apps — create the app as single-tenant.
• !Metadata import on the Basic SAML Configuration blade is a file upload, not a live URL fetch — download ComplianceScout's SP metadata XML and upload it.
• !Group claims emit GUIDs by default, not names.

Vendor documentation

• Microsoft — Add an enterprise application →
• Microsoft — Configure SAML-based SSO →
• Microsoft — Customize SAML token claims →