--- title: "Configuring Lucanet SAML Single Sign-On with Microsoft Entra ID/Azure" source_url: https://support.lucanet.com/en/documentation/administration/platform-management/configure-ext-authentication/entra-id-registration-saml language: en last_updated: 2026-08-31 --- # Configuring Lucanet SAML Single Sign-On with Microsoft Entra ID/Azure ## Overview If you use **Azure/Microsoft Entra ID** as your identity provider and choose the **SAML** method for **external authentication** of the Lucanet CFO Solution Platform, you must first register Lucanet as an enterprise application in the Azure Portal/Microsoft Entra ID Admin Center. After completing the registration and configuration in Azure Portal/Microsoft Entra ID, you can copy the authentication parameters from Azure/Microsoft Entra ID and paste them into the Lucanet CFO Solution Platform to complete the configuration of external authentication. ## Creating an Enterprise Application for Lucanet in Azure/MS Entra ID To create an Enterprise application for Lucanet in Azure/Microsoft Entra ID: 1. Open the [Azure Portal](https://portal.azure.com/#home) or the Microsoft Entra Admin Center at [https://entra.microsoft.com](https://entra.microsoft.com/). 2. Navigate to **Enterprise applications**. Click **\+ New application.** ![The 'Enterprise applications' workspace in Microsoft Azure is displayed.](https://support.lucanet.com/assets/docs-images/administration/platform-management/configure-ext-authentication/entra-id-registration-saml/_images/en/enterprise-applications.png) 'Enterprise applications' Workspace in Microsoft Azure 3. On the displayed page **Browse Microsoft Entra Gallery**, click **Create your own application**. ![The button for creating your application is displayed.](https://support.lucanet.com/assets/docs-images/administration/platform-management/configure-ext-authentication/entra-id-registration-saml/_images/en/create-application.png) 'Create your own application' button 4. Enter a name for the application (e.g., _Lucanet CFO Platform Authentication SAML 2_) and choose **Integrate any other application you don't find in the gallery (Non-gallery)**. ![The options for creating your application are displayed.](https://support.lucanet.com/assets/docs-images/administration/platform-management/configure-ext-authentication/entra-id-registration-saml/_images/en/app-name.png) Creating your own application 5. Click **Create**. ### Changing Properties We recommend setting **Assignment required** to **No** in the **Properties** to simplify the configuration and reduce administrative effort. This allows all users in your Microsoft Entra ID organization to access the application automatically, without the need to manually assign individual users or groups. However, if your organization requires stricter access control for security or compliance reasons, you can keep the setting at **Yes**. To configure user assignment: 1. In the created enterprise application, navigate to **Manage | Properties**. ![Displays the 'Properties' section under 'Manage'](https://support.lucanet.com/assets/docs-images/administration/platform-management/configure-ext-authentication/entra-id-registration-saml/_images/en/properties.png) 'Properties' section 2. Set the **Assignment required** toggle based on your requirements: ![Setting 'Assignment required' to 'no'](https://support.lucanet.com/assets/docs-images/administration/platform-management/configure-ext-authentication/entra-id-registration-saml/_images/en/assignment-required.png) Setting 'Assignment required' to 'no' 3. Click **Save**. ## Configuring Single Sign-On in Azure/Microsoft Entra ID Go to the newly created enterprise application and perform the following steps to configure Single Sign-On for Lucanet in Azure/Microsoft Entra ID: 1. Navigate to **Manage | Single sign-on**. ![The 'Single sign-on' workspace in Azure Portal is displayed.](https://support.lucanet.com/assets/docs-images/administration/platform-management/configure-ext-authentication/entra-id-registration-saml/_images/en/single-sign-on-page.png) 'Single sign-on' workspace in Azure Portal 2. Select **SAML** as the single sign-on method. ![The option to select 'SAML' as single sign-on method is displayed.](https://support.lucanet.com/assets/docs-images/administration/platform-management/configure-ext-authentication/entra-id-registration-saml/_images/en/select-saml.png) Selecting 'SAML' as the single sign-on method The options for the **Basic SAML Configuration** are displayed as followed: ![The Options for Basic SAML Configuration on the 'Set up Single Sign-On with SAML' page are displayed.](https://support.lucanet.com/assets/docs-images/administration/platform-management/configure-ext-authentication/entra-id-registration-saml/_images/en/set-up-sso.png) Options for Basic SAML Configuration on the 'Set up Single Sign-On with SAML' page 3. Copy the **Entity ID** from the **External authentication** workspace in the **Lucanet CFO Solution Platform**. ![Displays the 'External authentication' workspace in Lucanet](https://support.lucanet.com/assets/docs-images/administration/platform-management/configure-ext-authentication/entra-id-registration-saml/_images/en/external-authentication-workspace.png) 'External authentication' workspace in Lucanet ![Copying the 'Entigy ID' from Lucanet CFO Solution Platform](https://support.lucanet.com/assets/docs-images/administration/platform-management/configure-ext-authentication/entra-id-registration-saml/_images/en/entity-id-lucanet.png) Copying the 'Entigy ID' from Lucanet CFO Solution Platform 4. In the **Basic SAML Configuration** area in the Azure Portal, click **Add identifier** under **Identifier (Entity ID)**. ![The button for adding Entity ID in the Azure Portal is displayed.](https://support.lucanet.com/assets/docs-images/administration/platform-management/configure-ext-authentication/entra-id-registration-saml/_images/en/add-entity-id.png) Button for adding Entity ID in the Azure Portal 5. Paste the **Entity ID** copied from Lucanet into the corresponding field. ![The Entity ID was added into the corresponding field in the Azure Portal.](https://support.lucanet.com/assets/docs-images/administration/platform-management/configure-ext-authentication/entra-id-registration-saml/_images/en/add-entity-id-result.png) Entity ID added in Azure Portal 6. Copy the **Reply URL** from the **External authentication** workspace in the **Lucanet CFO Solution Platform**. ![Displays the 'External authentication' workspace in Lucanet](https://support.lucanet.com/assets/docs-images/administration/platform-management/configure-ext-authentication/entra-id-registration-saml/_images/en/external-authentication-workspace.png) 'External authentication' workspace in Lucanet ![Copying the 'Reply URL' from the Lucanet CFO Solution Platform](https://support.lucanet.com/assets/docs-images/administration/platform-management/configure-ext-authentication/entra-id-registration-saml/_images/en/reply-url-lucanet.png) Copying the 'Reply URL' from the Lucanet CFO Solution Platform 7. In the **Basic SAML Configuration** area in the Azure Portal, click **Add reply URL** under **Reply URL (Assertion Consumer Service URL)**. ![The button for adding reply URL in the Azure Portal is displayed.](https://support.lucanet.com/assets/docs-images/administration/platform-management/configure-ext-authentication/entra-id-registration-saml/_images/en/add-reply-url.png) Button for adding reply URL in the Azure Portal 8. Paste the **Reply URL** copied from Lucanet into the corresponding field. ![Displays the 'Reply URL' area in the Azure Portal. The reply URL was added in the corresponding field.](https://support.lucanet.com/assets/docs-images/administration/platform-management/configure-ext-authentication/entra-id-registration-saml/_images/en/add-reply-url-result.png) Reply URL added in the Azure Portal 9. Click **Save**. ## Configuring Authentication Parameters for the Lucanet CFO Solution Platform After configuring the enterprise application and Single Sign-On in Azure/Microsoft Entra ID, you need to retrieve specific authentication parameters and add them to the Lucanet CFO Solution Platform to complete the external authentication setup. To configure authentication parameters for the Lucanet CFO Solution Platform: 1. Get the **App Federation Metadata Url** from Azure Portal/Microsoft Entra ID: In the Enterprise application for Lucanet, navigate to **Manage | Single sign-on | Set up Single Sign-on with SAM** L. In the **SAML Certificates** area, copy the **App Federation Metadata Url**. ![The 'SAML Certificates' area in the Azure Portal is displayed. The value of 'App Federation Metadata Url' is copied.](https://support.lucanet.com/assets/docs-images/administration/platform-management/configure-ext-authentication/entra-id-registration-saml/_images/en/copy-metadata-url.png) Copying App Federation Metadata URL 2. Add the **App Federation Metadata Url** to the Lucanet CFO Solution Platform: In the Lucanet CFO Solution Platform, navigate to the **External authentication** workspace. ![Displays the 'External authentication' workspace in Lucanet](https://support.lucanet.com/assets/docs-images/administration/platform-management/configure-ext-authentication/entra-id-registration-saml/_images/en/external-authentication-workspace.png) 'External authentication' workspace in Lucanet Paste the **App Federation Metadata Url** into the **Metadata document URL** field. ![Displays the 'Metadata document URL' field in Lucanet](https://support.lucanet.com/assets/docs-images/administration/platform-management/configure-ext-authentication/entra-id-registration-saml/_images/en/metadata-document-url.png) 'Metadata document URL' field in Lucanet 3. Get the **Attribute** value from Azure Portal/Entra ID Admin Center: In the Enterprise application for Lucanet, navigate to **Manage | Single sign-on | Set up Single Sign-on with SAML**. ![The 'Single sign-on' workspace in Azure Portal is displayed.](https://support.lucanet.com/assets/docs-images/administration/platform-management/configure-ext-authentication/entra-id-registration-saml/_images/en/single-sign-on-page.png) 'Single sign-on' workspace in Azure Portal In the **Attributes & Claims** area, click **Edit**. The **Attributes & Claims** page will be displayed as follows, for example: ![The 'Attributes & Claims' page in the Azure Portal is displayed. The row with the 'user.mail' value is selected.](https://support.lucanet.com/assets/docs-images/administration/platform-management/configure-ext-authentication/entra-id-registration-saml/_images/en/attributes-claims.png) 'Attributes & Claims' page in the Azure Portal In the **Additional claims** area, click the row with the value **user.mail**. The **Manage claim** page will be displayed as follows, for example: ![The 'Manage claim' page with the claim 'Name' and the 'Namespace' is displayed.](https://support.lucanet.com/assets/docs-images/administration/platform-management/configure-ext-authentication/entra-id-registration-saml/_images/en/copy-claim.png) 'Manage claim' page with the claim 'Name' and the 'Namespace' Copy the **Namespace** field value and the **Name** field value. Combine them to create the **Attribute** value using the following structure: **Namespace/Name** Example in the screenshot above: - **Namespace**: http://schemas.xmlsoap.org/ws/2005/05/identity/claims - **Name**: emailaddress - **Attribute**: http://schemas.xmlsoap.org/ws/2005/05/identity/claims/emailaddress 4. Add the **Attribute** value to the Lucanet CFO Solution Platform: In the Lucanet CFO Solution Platform, navigate to the **External authentication** workspace. ![Displays the 'External authentication' workspace in Lucanet](https://support.lucanet.com/assets/docs-images/administration/platform-management/configure-ext-authentication/entra-id-registration-saml/_images/en/external-authentication-workspace.png) 'External authentication' workspace in Lucanet Paste the **Attribute** value into the **Attribute** field. ![Displays the 'Attribute' field in Lucanet](https://support.lucanet.com/assets/docs-images/administration/platform-management/configure-ext-authentication/entra-id-registration-saml/_images/en/attribute-filed.png) 'Attribute' field in Lucanet > **Warning:** **Attention**: The e-mail address of a user on the **Lucanet CFO Solution Platform** must be identical to the e-mail address in **Azure/MS Entra ID**. The upper and lower case of e-mail addresses must match exactly. You can find additional information on how to use the parameters when configuring the external authentication for the Lucanet CFO Solution Platform with the SAML method in the section [Configuring SAML](https://support.lucanet.com/en/documentation/administration/platform-management/configure-ext-authentication.md#configuring-saml) in **Configuring External Authentication**.