Microsoft Entra ID SAML single sign-on

This guide shows you how to configure Single Sign-On (SSO) for PADS4 using Microsoft Entra ID.

​

Create a Microsoft Azure enterprise application

To configure a Microsoft Entra identity provider, connect to Azure as an administrator and create a new enterprise application.

1. Go to https://portal.azure.com and sign in as an administrator.
2. On Azure, go to the Enterprise applications page.
3. Click New application.
4. Click Create your own Application.
5. Fill in the information requested in the form. For example, you can use PADS4.
6. Click the Create button.
7. Azure creates your application.

​

Set up single sign-on configuration

After Azure creates your application, enable and configure single sign-on.

• In the left menu, click Single sign-on.
• Select SAML as the single sign-on method.

To edit the basic SAML method, click Edit. Edit the Basic SAML configuration.

• For the Identifier, use the PADS4 server address and add /saml (e.g., https://pads4.mycompany.com/saml).
• For the Reply URL, use the PADS4 server address and add /rdx/nds.services.authentication.integration/api/v1/pads/Saml2/Acs (e.g., https://pads4.mycompany.com/rdx/nds.services.authentication.integration/api/v1/pads/Saml2/Acs).

• Click Save to apply the changes.

​

Edit attributes & claims

1. To edit the Attributes & Claims, click Edit.
2. Edit the Attributes & Claims.

​

Create the group claim

To map Microsoft Entra groups to PADS4 roles, configure the group claim:

1. Click Add new group claim.
2. Select Groups assigned to the application (radio button).
3. Select Group ID as the source attribute.
4. Click Save.

​

Assign users and groups

To specify which user groups can access the application, assign the appropriate user groups to it.

1. In the left menu, click Users and groups.
2. Click Add user/group to add a new group.
3. Click Users and groups, select the group you want to assign, and then click Select.
4. Click Assign.

You can repeat this action for each user group you want to assign to the application.

​

Collect configuration data for the PADS4 identity provider

To create the identity provider in PADS4, gather these details from your Microsoft Entra configuration. Open the Single sign-on page and collect:

1. App Federation Metadata URL (e.g., https://login.microsoftonline.com/xxxxxxxx-xxxx-xxxx-xxxx-xxxxxxxxxxxx/federationmetadata/2007-06/federationmetadata.xml?appid=xxxxxxxx-xxxx-xxxx-xxxx-xxxxxxxxxxxx)
2. Certificate (Raw) – Click the link to download it (e.g., your-application-name.cer)
3. Login URL (e.g., https://login.microsoftonline.com/xxxxxxxx-xxxx-xxxx-xxxx-xxxxxxxxxxxx/saml2)
4. Microsoft Entra Identifier (e.g., https://sts.windows.net/xxxxxxxx-xxxx-xxxx-xxxx-xxxxxxxxxxxx/)

You’ll use this information later when setting up the identity provider in PADS4.

​

Set up the identity provider in PADS4

After creating your identity provider application, you also need to set up the corresponding identity provider in PADS4.

​

Create the identity provider

To create the identity provider:

1. Sign in to PADS4 and go to Administration.
2. In the left menu, click Credentials.
3. Click Providers.
4. Click New and select Identity and Microsoft Entra.

​

Fill in provider details

1. Name – Enter a display name for the provider in PADS4.
2. Identifier – Enter the Microsoft Entra Identifier you collected earlier.
3. Reply URL – Enter the URL of your local PADS4 application (e.g., https://pads4.mycompany.com).
4. Metadata URL – Enter the Microsoft Entra: App Federation Metadata URL you collected.
5. PADS4 fills in the Identifier and Assertion Consumer Service URL.

​

Upload certificates

1. Provider Signing Certificate – Upload the Certificate (Raw) (.cer) file you downloaded from your Microsoft Entra identity provider configuration.
2. PADS4 Identity Provider Certificate – Upload a certificate (.pfx) to sign SAML assertions from PADS4 to Microsoft Entra.
3. Password – Enter the password for the uploaded .pfx certificate (below the certificate field).

If you don’t need to enable SCIM provisioning, click Create to finish setting up the identity provider.

​

Enable SCIM provisioning (optional)

You can enable SCIM provisioning during identity provider creation. This feature synchronizes users between Microsoft Entra and PADS4, automatically creating, updating, or deleting users linked to the application. Once enabled, save these values for later use in your Microsoft Entra SCIM configuration:

1. SCIM URL
2. SCIM Access Token

Click Create to complete the identity provider setup.

​

Finalize Microsoft Entra ID setup

1. Sign out and refresh the PADS4 Portal.
2. The SSO Login button should now be visible.
3. Sign in using your Microsoft Entra credentials.