Skip to main content
Zenskar supports single sign-on (SSO) through SAML 2.0, letting an organization authenticate users through its existing identity provider. This guide sets up SAML in Zenskar using Microsoft Entra ID as the identity provider.

New to SSO?

If terms like identity provider (IdP) and service provider (SP) are unfamiliar, start with the Concepts page.

Reference

Field-level detail, validation rules, and the assertion Zenskar expects. Keep it open while you work through the steps.
This guide is for administrators. You need admin access to both Microsoft Entra ID and Zenskar: a Microsoft Entra ID account that can create enterprise applications, and a Zenskar role with SAML permissions. If your organization does not use Microsoft Entra ID yet, set it up and add your users there first. Adding the Zenskar application does not change your existing Microsoft Entra ID setup, and your users keep the credentials they already use.
Sign-in must start from the Zenskar sign-in page. Launching Zenskar from the Microsoft My Apps portal does not complete sign-in.
Zenskar does not control the Azure portal, and Microsoft may rename or move fields at any time. Each Microsoft Entra label in this guide is paired with the SAML 2.0 concept it maps to, which does not change, so a rename does not break the mapping. The labels were accurate on 2 September 2026; if one no longer matches what you see, match on the concept and use Microsoft’s current guide to configuring SAML SSO for an enterprise application to find the field.

​
Step 1: Verify your domain

  1. Click the account menu at the bottom of the sidebar, and select Settings.
  2. Open the SAML tab.
  3. In the Connection section, enter a Name for this configuration and the Domain to verify, for example acme.com. Enter the bare domain, with no https:// prefix and no path.
  4. Click GET TXT RECORDS.
  5. Add the resulting TXT record to the domain’s DNS.
  6. Click VERIFY DOMAIN once the record has propagated. The domain’s status changes from Pending to Verified.
  7. Under Identity Provider, select Microsoft Entra ID from the dropdown.
If VERIFY DOMAIN reports a failure, the TXT record may not have propagated yet. DNS changes can take from a few minutes to 48 hours; wait and try again.

​
Step 2: Set up the application in Microsoft Entra ID

Create a non-gallery enterprise application for Zenskar and open its SAML single sign-on settings. Assign the users and groups who should be able to sign in to Zenskar. A user who is not assigned cannot sign in.

​
Service provider values

From the Zenskar SAML Configuration Values section on the SAML tab, enter these in Microsoft Entra ID: The ACS URL appears once Microsoft Entra ID is selected on the SAML tab in Step 1. Copy it and the Entity ID exactly as shown.

​
NameID

Set the Unique User Identifier (Name ID) claim to the attribute holding the user’s email address, with the Email address name-identifier format. Zenskar requires the NameID to be the user’s email.

​
Attribute claims

Edit the application’s SAML claims so each is emitted with a plain name and no namespace, then map Zenskar to those names. Microsoft’s default claims use namespace-URI names (http://schemas.xmlsoap.org/ws/2005/05/identity/claims/...), which Zenskar’s attribute mapping does not match. user.mail is empty for users without a mailbox. If any of your users do not have one, source the email claim and the NameID from an attribute that always holds their email address. Attribute names are case-sensitive and must contain no spaces. If the given-name or surname claim is absent, Zenskar asks the user to enter their name on first sign-in. Leave anything else at its default.

​
Step 3: Finish in Zenskar

On the SAML tab, in the Identity Provider Configuration section, enter these values from Microsoft Entra ID:
Zenskar needs the certificate as a PEM block with its -----BEGIN CERTIFICATE----- and -----END CERTIFICATE----- lines. The <ds:X509Certificate> value in the federation metadata XML has no such lines and will fail the check: use the downloaded Certificate (Base64) file, or wrap the Base64 in those lines before pasting.
Then set the four Attribute Mapping fields to the claim names from Step 2. Turn on SAML Status and click Save Configuration. Zenskar checks the form first: with SAML Status on, the Name, Domain, both Identity Provider Configuration values, the Certificate, and all four attribute mappings are required, and the single sign-on URL must use https. See Field validation for the certificate format and the other checks. Good to know
  • A user who already has a Zenskar password confirms it once, on their first SSO sign-in, to link their account. Every sign-in after that goes through Microsoft Entra ID.
  • Once the domain is verified and SAML Status is on, invited users no longer receive a password-setup email; their account is created on first SSO sign-in.
  • To change an Identity Provider Configuration value later, edit the field with SAML Status on and click Save Configuration again. A save made while SAML Status is off is stored but does not update the live connection.

​
Step 4: Test

  1. Test in a private or incognito window: go to the Zenskar sign-in page, enter the work email address of an assigned user, and continue. The sign-in should route to Microsoft Entra ID and return to the Zenskar dashboard.
  2. Test with a second assigned user before announcing it to the team. This confirms the group assignment works, not just one account.

​
Troubleshooting and upkeep

Troubleshooting

Common sign-in failures and what each one means.

Keeping SAML running

Certificate rotation, adding and removing access, and passwords.
Reach out to help@zenskar.com with questions while going through setup.