> ## Documentation Index
> Fetch the complete documentation index at: https://docs.pads4.com/llms.txt
> Use this file to discover all available pages before exploring further.
# Microsoft Entra ID
This manual provides step-by-step instructions to configure **Single Sign-On** (SSO) for **PADS4** using **Microsoft Entra ID**.
## Create a Microsoft Azure Enterprice Application
To configure a Microsoft Entra Identity provider, you will need to connect to Azure as an Administrator and create a new enterprise application.
1. Go to [**https://portal.azure.com**](https://portal.azure.com) and sign in as an administrator.
2. On Azure, go to the **Enterprise applications** page
3. Click on **New application**
4. Click on **Create your own Application**
5. Fill in the information requested in the from. For example you can use PADS4
6. Click the **Create** button
7. Your application is now being created.
## Setup Single Sign On configuration
Now that your application has been created, you need to enable and configure single sign-on.
* In the left menu, click on **Single sign-on**
* Select **SAML** as Single Sign-On methode
You need to edit the basic SAML method. Click on **Edit** to do so.
Edit the **Basic SAML configuration**.
* For the Identifier use the PADS4 server address and add **/saml** (e.g. [https://pads4.mycompany.com/saml](https://pads4.mycompany.com/saml))
* For the Reply URL use the PADS server address and add **/rdx/nds.services/authentication.integration/api/v1/pads/Saml2/Acs** (e.g. [https://pads4.mycompany.com/rdx/nds.services.authentication.integration/api/v1/pads/Saml2/Acs](https://pads4.mycompany.com/rdx/nds.services.authentication.integration/api/v1/pads/Saml2/Acs))
If your PADS4 server uses a domain other than "pads", replace it with your actual domain name in the URL \
e.g., for a domain named "domainone", use [https://pads4.mycompany.com/rdx/nds.services.authentication.integration/api/v1/domainone/Saml2/Acs](https://pads4.mycompany.com/rdx/nds.services.authentication.integration/api/v1/domainone/Saml2/Acs)).
* Click on **Save** to apply the changes
## Edit Attributes & Claims
1. You need to edit the **Attributes & Claims**. Click on **Edit** to do so.
2. Edit the **Attributes & Claims**
## Create the Group Claim
To map Microsoft Entra groups to PADS4 roles, configure the group claim:
1. Click **Add new group claim**.
2. Select **Groups assigned to the application** (radio button).
3. Choose **Group ID** as the source attribute.
4. Click **Save**.
| **Name** | **Type** | **Value** |
| :------------------------------------------------------------------------------------------------------------------------------------------- | :---------- | :--------------------- |
| [**http://schemas.xmlsoap.org/ws/2005/05/identity/claims/emailaddress**](http://schemas.xmlsoap.org/ws/2005/05/identity/claims/emailaddress) | Claim | user.mail |
| [**http://schemas.xmlsoap.org/ws/2005/05/identity/claims/givenname**](http://schemas.xmlsoap.org/ws/2005/05/identity/claims/givenname) | Claim | user.givenname |
| [**http://schemas.xmlsoap.org/ws/2005/05/identity/claims/name**](http://schemas.xmlsoap.org/ws/2005/05/identity/claims/name) | Claim | user.userprincipalname |
| [**http://schemas.xmlsoap.org/ws/2005/05/identity/claims/surname**](http://schemas.xmlsoap.org/ws/2005/05/identity/claims/surname) | Claim | user.surname |
| [**http://schemas.microsoft.com/ws/2008/06/identity/claims/groups**](http://schemas.microsoft.com/ws/2008/06/identity/claims/groups) | Group claim | user.groups |
## Assign users and groups
To specify which user groups can access the application, assign the appropriate user groups to it.
1. In the left menu, select Users and groups.
2. Click Add user/group to add a new group.
3. Click **Users and groups**, choose the group you want to assign, and then click **Select**.
4. Click **Assign**
You can repeat this action for each user group you want to assign to the application.
## Collect configuration data for the PADS4 identity provider
To create the identity provider in PADS4, gather these details from your Microsoft Entra configuration. Open the **Single sign-on** page and collect:
1. **App Federation Metadata URL** (e.g., `https://login.microsoftonline.com/xxxxxxxx-xxxx-xxxx-xxxx-xxxxxxxxxxxx/federationmetadata/2007-06/federationmetadata.xml?appid=xxxxxxxx-xxxx-xxxx-xxxx-xxxxxxxxxxxx`)
2. **Certificate (Raw)** – Click the link to download it (e.g., `your-application-name.cer`)
3. **Login URL** (e.g., `https://login.microsoftonline.com/xxxxxxxx-xxxx-xxxx-xxxx-xxxxxxxxxxxx/saml2`)
4. **Microsoft Entra Identifier** (e.g., `https://sts.windows.net/xxxxxxxx-xxxx-xxxx-xxxx-xxxxxxxxxxxx/`)
You'll use this information later when setting up the identity provider in PADS4.
# Set up the identity provider in PADS4
After creating your identity provider application, you also need to set up the corresponding identity provider in PADS4.
## Create the identity provider
To create the identity provider:
1. Log in to PADS4 and navigate to Adminstration
2. In the left-hand menu, click **Credentials**.
3. Click on **Providers**
4. Click on**New** and select \*\*Identity \*\*and **Microsoft Entra**
### Fill in provider details
1. **Name** – Enter a display name for the provider in PADS4
2. **Identifier** – Enter the **Microsoft Entra Identifier** you collected earlier
3. **Reply URL** – Enter the URL of your local PADS4 application (e.g., `https://pads4.mycompany.com`).
4. **Metadata URL** – Enter the **Microsoft Entra: App Federation Metadata URL** metadata URL you collected.
5. The **Identifier** and **Assertion Consumer Service URL** are filled in.
### Upload certificates
1. **Provider Signing Certificate** - Upload the **Certificate (Raw)** (`.cer`) file you downloaded from your Microsoft Entra identity provider configuration.
2. **PADS4 Identity Provider Certificate** - Upload a certificate (`.pfx`) to sign SAML assertions from PADS4 to Microsoft Entra.
3. \*\*Password \*\*- Enter the password for the uploaded `.pfx` certificate (below the certificate field).
If you don’t need to enable SCIM provisioning, click **Create** to finish setting up the identity provider.
### Enable SCIM Provisioning (Optional)
You can enable SCIM provisioning during identity provider creation. This feature synchronizes users between Microsoft Entra and PADS4, automatically creating, updating, or deleting users linked to the application.
Once enabled, save these values for later use in your Microsoft Entra SCIM configuration:
1. **SCIM URL**
2. **SCIM Access Token**
Click **Create** to complete the identity provider setup.
# **Finalizing Microsoft Entra ID set-up**
1. **Log out** and **refresh** the PADS4 Portal.
2. The **SSO Login** button should now be visible.
3. **Sign in** using your Microsoft Entra credentials.
