> ## Documentation Index
> Fetch the complete documentation index at: https://zenskar.com/docs/llms.txt
> Use this file to discover all available pages before exploring further.

# SAML authentication with Microsoft Entra ID

Zenskar supports single sign-on (SSO) through SAML 2.0, letting an organization authenticate users through its existing identity provider. This guide sets up SAML in Zenskar using **Microsoft Entra ID** as the identity provider.

***

<Accordion title="Step 1: Domain verification" icon="fa-shoe-prints">
  1. Click the account menu at the bottom of the sidebar, and select **Settings**.
  2. Open the **SAML** tab.
  3. In the **Connection** section, enter a **Name** for this configuration and the **Domain** to verify, for example `acme.com`.
  4. Click **GET TXT RECORDS**.
  5. Add the resulting TXT record to the domain's DNS.
  6. Click **VERIFY DOMAIN** once the record has propagated. The domain's status changes from Pending to Verified.
  7. Under **Identity Provider**, select **Microsoft Entra ID** from the dropdown.
</Accordion>

<Accordion title="Step 2: Identity provider configuration" icon="fa-shoe-prints">
  1. Log in to the [Azure portal](https://portal.azure.com/).
  2. Go to **Microsoft Entra ID > Applications > Enterprise Applications > + New Application**.
  3. Select **Create your own application**.
  4. Name the application, for example "Zenskar SSO", and choose **Integrate any other application you don't find in the gallery (non-gallery application)**.
  5. After the app is created, go to **Single Sign-On**, and choose **SAML**.
  6. Copy the following values from the Azure portal into Zenskar's **Identity Provider Configuration** section:

  | Source                                                                                                                                           | Destination                                                                         |
  | ------------------------------------------------------------------------------------------------------------------------------------------------ | ----------------------------------------------------------------------------------- |
  | Azure portal > Microsoft Entra ID > App registrations > \[Your App] > Overview > Directory (tenant) ID                                           | Zenskar SAML tab > Identity Provider Configuration > **Microsoft Entra Identifier** |
  | Azure portal > Microsoft Entra ID > App registrations > \[Your App] > Endpoints > OAuth 2.0 authorization endpoint (v2)                          | Zenskar SAML tab > Identity Provider Configuration > **Login URL**                  |
  | Azure portal > Microsoft Entra ID > Enterprise applications > \[Your App] > Single sign-on > SAML Certificates > Certificate (Base64) > Download | Zenskar SAML tab > Identity Provider Configuration > **Certificate**                |

  <Note>
    Open the downloaded certificate file in a text editor, and copy the certificate including the BEGIN CERTIFICATE header and the END CERTIFICATE footer.
  </Note>

  7. Assign the users or groups who should have access.
</Accordion>

<Accordion title="Step 3: Attribute mapping" icon="fa-shoe-prints">
  In Zenskar's **Attribute Mapping** section, map each Zenskar field to the Microsoft Entra claim that carries it:

  | Zenskar field | Microsoft Entra claim (common default) |
  | ------------- | -------------------------------------- |
  | User ID       | `user.objectid`                        |
  | Email address | `user.mail`                            |
  | First name    | `user.givenname`                       |
  | Last name     | `user.surname`                         |

  These are Microsoft's default claim names. If the enterprise application's claims have been customized, use the actual claim names configured under **Microsoft Entra ID > Enterprise applications > \[Your App] > Single sign-on > User Attributes & Claims** instead.
</Accordion>

<Accordion title="Step 4: Add Zenskar's SAML values to Microsoft Entra" icon="fa-shoe-prints">
  1. Copy the following values from Zenskar's **Zenskar SAML Configuration Values** section into the Azure portal:

  | Source                                                               | Destination                                                                                                                                                        |
  | -------------------------------------------------------------------- | ------------------------------------------------------------------------------------------------------------------------------------------------------------------ |
  | Zenskar SAML tab > Zenskar SAML Configuration Values > **Entity ID** | Azure portal > Microsoft Entra ID > Enterprise applications > \[Your App] > Single sign-on > Basic SAML Configuration > Identifier (Entity ID)                     |
  | Zenskar SAML tab > Zenskar SAML Configuration Values > **ACS URL**   | Azure portal > Microsoft Entra ID > Enterprise applications > \[Your App] > Single sign-on > Basic SAML Configuration > Reply URL (Assertion Consumer Service URL) |

  2. Save the configuration in the Azure portal.
  3. Back in Zenskar, turn on **SAML Status**, and click **Save Configuration**.
</Accordion>

<Accordion title="Step 5: Test SSO login" icon="fa-shoe-prints">
  1. Confirm the user exists in both Microsoft Entra ID and Zenskar, with a matching email address.
  2. Sign out, and go to the Zenskar sign-in screen.
  3. Sign in using the account's email address. With a verified domain and an enabled configuration, the sign-in should route through Microsoft Entra ID.
  4. On success, the sign-in returns to the Zenskar dashboard.
</Accordion>

Reach out to [help@zenskar.com](mailto:help@zenskar.com) with questions while going through setup.