---
title: "EasySSO SAML with Azure AD"
canonical: "https://www.techtime-initiative.com/space/EasySSO/5898716/EasySSO%20SAML%20with%20Azure%20AD"
format: markdown
---
Step-by-Step Instructions to configure EasySSO SAML with Azure AD as an Identity Provider

## Step 1: Create new application in Azure 

Click "New application", and in the search bar enter “EasySSO”. Select the application that matches your platform. This guide will use EasySSO for Jira as an example. 

![EasySSO - AzureSetup 001.jpg](media://0ddd051f-0d0a-4f8a-a090-cbf9e5aca4c3)

![EasySSO - AzureSetup 002.jpg](media://8da9b92c-a768-486e-b0bc-9cee2269bf1c)

Click "Create". You should be automatically navigated to the Overview page for the enterprise app you have just created.

![EasySSO - AzureSetup 003.jpg](media://02f4b458-f50b-45c3-84eb-db122706b782)

## Step 2: Azure configuration

Navigate to the EasySSO Overview page. On the toolbar on the left-hand side of the page, click on "Single sign-on". On the Single Sign on page, Select the rectangle box that says "SAML". In the popup that appears, Click **"No, I'll save later"**.

![EasySSO - AzureSetup 005.jpg](media://27cf3354-b021-4bfb-b203-711ed294d24a)

![EasySSO SAML-SignedRequests-SaveSignOnSetting.png](media://6edb28dc-aac6-4dd7-808d-9d990047e490)

In the "Basic SAML Configuration" box, click on 'Edit' on the top right-hand corner

![EasySSO - AzureSetup 006.jpg](media://538b4b4f-d452-44d4-9717-399d37b4b6aa)

On the **Basic SAML configuration** edit panel

1. Set **Identifier (Entity ID)** URL to **https://<YOUR ATLASSIAN SERVER BASE URL>/plugins/servlet/easysso/saml**
2. Set **Reply URL (Assertion Consumer Service URL)** URL to **https://<YOUR ATLASSIAN SERVER BASE URL>/plugins/servlet/easysso/saml**
3. Set **Sign on URL (Optional)** URL to **https://<YOUR ATLASSIAN SERVER BASE URL>/plugins/servlet/easysso/saml**
4. Set **Relay State (Optional)** URL to **https://<YOUR ATLASSIAN SERVER BASE URL>/plugins/servlet/easysso/saml**
5. Set **Logout URL (Optional)** URL to **https://<YOUR ATLASSIAN SERVER BASE URL>/plugins/servlet/easysso/saml**

Click **Save**

![image-20240830-005307.png](media://06e43bc3-1baa-433b-8df7-4e8cacaf2ccb)

## Step 3: Azure Attributes and Claims

In the **Single sign-on** page**,** Edit the **Attributes claims**. The attribute claims must match between the Azure AD configuration and the EasySSO SAML attributes.

These are the default properties and the attributes:

|  |  |
| --- | --- |
| Claim Name | Value |
| urn:oid:0.9.2342.19200300.100.1.1 | UID Attribute such as user.userprincipalname |
| urn:oid:0.9.2342.19200300.100.1.1 | user.userprincipalname |
| urn:oid:0.9.2342.19200300.100.1.3 | user.primaryauthoritativeemail |
| urn:oid:2.16.840.1.113730.3.1.241 | user.displayname |
| urn:oid:2.5.4.42 | user.givenname |
| urn:oid:2.5.4.4 | user.surname |
| urn:oid:2.5.4.31 | groups |

![EasySSO Attributes and Claims 1.png](media://9ac260fb-e169-4850-92c3-9e5334972f46)

In some cases properties may want to be modified, for example removing the domain from an email address property. This can be done by using Azure Special Claims transformations. See [https://learn.microsoft.com/en-us/entra/identity-platform/saml-claims-customization#special-claims-transformations](https://learn.microsoft.com/en-us/entra/identity-platform/saml-claims-customization#special-claims-transformations) 

## Step 4: EasySSO Configuration

In the Azure **Single sign-on** page, under the **SAML Certificates**, copy the **App Federation Metadata Url**. We will need this next. 

![image-20240830-022556.png](media://1012aac3-f338-4d29-b81b-f121c608dc93)

Open EasySSO and select SAML. On the SAML configuration screen make sure **Enable SAML** is ticked, and navigate to the **Certificates** tab. 

1. Next to Load Metadata ensure the **URL** option is selected
2. In the **IdP Metadata URL** text box, paste the copied **App Federation Metadata Url** copied earlier
3. Click **Load Certificate**

Click **Save**

![EasySSO - EasySSO SAML Basic Setup 001.jpg](media://4691bc53-682c-4840-9eb7-cb5f1e83a6da)

Navigate to the **General** page.

1. Configure settings for **New Users** which are logging in for the first time from the SAML provider, based on your needs
2. Configure settings for **Existing Users** which have previously logged in, based on your needs
3. Configure **Default groups for Users** to ensure that logged in users are provisioned with the correct groups and permissions
4. Click **Save**

![EasySSO - EasySSO SAML Basic Setup 002.jpg](media://2c2863ea-d494-4703-bbae-8a6b0766d897)

You've completed the configuration of EasySSO SAML with Azure!

## Further optional configuration

For more customisation options, check out [EasySSO with SAML - Configuration](https://techtime-website.atlassian.net/wiki/spaces/EasySSO/pages/4948647)

For enabling signing, validation and encrypted assertions on Azure AD, check out [EasySSO with Azure AD - Signing, Validation, Encryption](https://techtime-website.atlassian.net/wiki/spaces/EasySSO/pages/5931607)