Enterpret

In this section, we'll go through a step-by-step guide to configure SAML SSO on Microsft Azure for Enterpret. You can read more about using SSO on Enterpret <a href="https://helpcenter.enterpret.com/en/articles/6870807-using-single-sign-on-sso#h_d67ce6e092">here</a>.

​ ​<code>NOTE: You might require elevated permissions on Azure to perform the following steps. Please contact your account admin if you don't find any of the referred settings on your Azure dashboard. </code> ​

Navigate to Applications &gt; Enterprise Applications on your Azure dashboard ​

On the Applications page, click on New application ​

Next click on Create your own application ​

On the modal that pops up, provide the following input: 

1. Add <code>Enterpret SAML App</code> as the application name 
2. Select <code>Integrate any other application you don't find in the gallery (Non-gallery)</code> as the application type. 
3. Click On Create

1. Navigate to Applications &gt; Enterprise Applications on your Azure dashboard ​
 
 ​ 
2. On the Applications page, click on New application ​
 
 ​
3. Next click on Create your own application ​ 
 
 ​ 
4. On the modal that pops up, provide the following input: 
 1. Add <code>Enterpret SAML App</code> as the application name 
 2. Select <code>Integrate any other application you don't find in the gallery (Non-gallery)</code> as the application type. 
 3. Click On Create

Provide the following input in the Basic SAML Configuration section:

1. Identifier (Entity ID): <code>urn:amazon:cognito:sp:us-east-2_kLiRrPBis</code>
2. Reply URL (Assertion Consumer Service URL): <code>https://enterpret-prod.auth.us-east-2.amazoncognito.com/saml2/idpresponse</code>
3. You can leave Sign-on URL, Logout URL, and Default RelayState empty.

1. Under Manage, click on Single sign-on.
 
 
2. Select SAML from the option 
 
 
3. Provide the following input in the Basic SAML Configuration section:
 1. Identifier (Entity ID): <code>urn:amazon:cognito:sp:us-east-2_kLiRrPBis</code>
 2. Reply URL (Assertion Consumer Service URL): <code>https://enterpret-prod.auth.us-east-2.amazoncognito.com/saml2/idpresponse</code>
 3. You can leave Sign-on URL, Logout URL, and Default RelayState empty.

Note: For Idp-initiated SSO, you will need to provide the relay state value. Please reach out to Team Enterpret to get the value.

Verifying the Correct Source Attribute for Email

Before proceeding with attribute configuration, ensure that the correct attribute is mapped to the email claim. 

Navigate to Microsoft Entra ID &gt; Users &gt; Select a sample user.

Check the <code>User Principal Name (UPN)</code> and <code>Mail</code> attributes.

If users only have their email in <code>User Principal Name (UPN)</code>, map <code>user.userprincipalname</code>.

If users have valid email addresses in <code>Mail</code>, map <code>user.mail</code> to the email claim, instead.

Confirm with your IT admin if UPN is always an email format in your organization before finalizing the mapping. 

- Navigate to Microsoft Entra ID &gt; Users &gt; Select a sample user.
- Check the <code>User Principal Name (UPN)</code> and <code>Mail</code> attributes.
- If users only have their email in <code>User Principal Name (UPN)</code>, map <code>user.userprincipalname</code>.
- If users have valid email addresses in <code>Mail</code>, map <code>user.mail</code> to the email claim, instead.
- Confirm with your IT admin if UPN is always an email format in your organization before finalizing the mapping.

Under Attributes &amp; Claims, click on Edit icon 

Add Source attribute as the verified email attribute (<code>user.userprincipalname</code> or <code>user.mail</code>) based on the verification step above.

- Under Attributes &amp; Claims, click on Edit icon 
- Click on Add new claim
- Add Name as <code>email</code>
- Select Source as <code>Attribute</code>
- Add Source attribute as the verified email attribute (<code>user.userprincipalname</code> or <code>user.mail</code>) based on the verification step above.
- Namespace can be left empty
- Click on Save Icon on the top. ​

You have successfully created an Application that would allow Microsoft Azure to communicate with Enterpret! As the next steps, you'll need to copy relevant details from the created app and configure it on the Enterpret dashboard. ​

On the Single sign-on page , you can copy the App Federation Metadata URL from SAML Certificates section, this is the metadata URL that you will need to configure on the Enterpret dashboard.

Configuring SSO

Creating an Application

Configure SAML Application

Under Manage, click on Single sign-on.

Select SAML from the option

Provide the following input in the Basic SAML Configuration section:

4. Adding claims to your SSO Aplication

Verifying the Correct Source Attribute for Email

Adding Claims to your SSO application

Copying Metadata URL Values