Details of the steps required to configure a SAML SSO between Edflex and Microsoft Entra (Microsoft Azure Directory)
Learn how to set up an automatic login (SSO). This will allow your learners to not have to login manually to Edflex if they are already logged into your Azure Active Directory.
1. Add an Enterprise Application
From the Azure Active Directory overview, on the left menu, click Enterprise Applications.
➡️ Then from the navbar, click on New Application
You may need to select again "Create your new application".
A window will open on the right side of your screen.
Add an application name so you can find it easily and then select Integrate any other application you don't find in the gallery (Non-gallery) as in the example below 🔽
Then click on Create, the process may take a few minutes.
2. Configure SSO
In the left-hand menu of your Enterprise Application, click on Single Sign-on. Then select the SAML block when choosing the Single Sign-on Method.
2.1 Set up "Basic SAML Configuration"
From this screen, fill in the "Identifier (Entity ID)" and "Reply URL (URL Assertion Consumer Service)" values:
2.2 Set up "Attributes & Claims"
2.2.1 Customise the NameID
By default, NameId is set up on UserPrincipalName (UPN).
Edflex advises you to change it for user.objectid, conditionally upon when a user is changing his.her lastname you update his.her Azure profile (meaning you are not creating a new one).
Otherwise, please discuss this topic with you Edflex Technical contact.
How to customise the NameId?
From "Attributes & Claims", select the line Required claim > Claim name:
Then select:
- Name identifier format > "Unspecified"
- Source attribute > "user.objectid"
And save your modification!
2.2.2 Add additional attributes
Additional attributes may be useful to enrich your reporting and/or support Edflex features.
From "Attributes & Claims", add additional attributes at the "Additional claims" level:
Please share with your Edflex Technical contact, a screenshot displaying all the Additional claims registered:
Labels listed on the "Claim name" column will be useful for the set up on Edflex side:
2.3 Share the Metadata URL
From step 3 "SAML certificates " copy the url present in the field "Application federation metadata URL".
It is this url that you must provide to your Edflex contact so that the configuration can be finalized.
Tests will then be performed to validate the proper functioning of the SSO configuration 🚀
3. Restrict access to a group of users
In the left-hand menu of your Enterprise Application, click on Users and Groups and then on Add a User/Group.
Add one or more user groups to restrict access to the Edflex application.
Please note that it is mandatory to add at least one group to enable access to Edflex.