Configure SAML with Microsoft Entra ID

This page explains how to integrate Microsoft Entra ID (Azure AD) as a SAML Identity Provider to authenticate your users on Reemo.

Note

Depending on your deployment mode, SAML can be enabled at the instance level (Private Cloud / On-Prem) or at the organization level (Public Cloud).
Screenshots and labels may vary slightly depending on your interface version.

Configure SAML in Reemo

Case 1: Instance level (Private Cloud / On-Prem)
From verified_user Admin Area > dashboard General > passkey SSO Connectors, configure SAML for the instance.
Access SSO Connectors in the instance Admin Area

Access SSO Connectors in the instance Admin Area.

Case 2: Organization level (Public Cloud)
From domain Organization > dashboard General > passkey SSO Connectors, configure SAML for that organization.
Configure SSO in Organization > SSO Connectors

Configure SAML in Organization > SSO Connectors.

Create the SAML Connector in Reemo

  1. From verified_user Admin Area > domain Organizations, select your organization, then go to dashboard General > passkey SSO Connectors and click New Connector > New SAML Connector.

  2. Fill in the basic fields:

  • Friendly Name: name displayed to your users (e.g., EntraID).

  • Issuer / App URI ID: reemo.

  • Attributes Mapping: attribute names Reemo expects in the SAML assertion (email, username, fullname by default).

  • The other fields (Entry Point, Federation XML) will be completed after configuring Entra ID.

Creating a SAML connector in Reemo

Fill in the basic fields of the SAML connector.


../../_static/images/guides/sso/samlentra_mapping.jpg

Configure Attributes.


SAML connector creation form

Create the connector

3) Click Create to generate the connector’s Callback URL. You will need this in EntraID (Single sign-on URL).

Retrieving the connector Callback URL

Copy the Callback URL generated by the SAML connector.

Configure the SAML Application in Entra ID

  1. Log in to the EntraID portal: https://portal.azure.com

  2. Create a new application: Microsoft Entra ID > Manage > Enterprise applications > New application.

  3. Click Create your own application.

    • Give it a name (e.g., Reemo).

    • Choose Integrate any other application you don’t find in the gallery (Non-gallery).

    • Click Create.

  4. Open the application and go to Single sign-on > select SAML.

Select SAML as the Single Sign-On method

Choose SAML as the Single Sign-On method.

  1. In the Set up [app name] section:

  • Copy the Login URL and paste it into Entry Point in Reemo.

Microsoft Entra ID Login URL

Copy the Login URL into the Entry Point field.

  1. In the SAML Certificates section:

  • Copy the federationmetadata.xml URL from the App Federation Metadata URL.

../../_static/images/guides/sso/samlazure_certificate.png

Copy the federationmetadata.xml URL.

  1. Paste it into the Federation XML URL field of the Reemo connector.

../../_static/images/guides/sso/samlentra_xml.jpg

Fill the fields left to be filled previously

Configure Attributes (Attribute Statements)

Map the attributes so that Reemo receives the correct information from Entra ID:

  • Username → name

  • Email → emailaddress

  • Full Name → displayname

Configure the Identifier and Reply URL

To finish the configuration, Entra requires setting up the Identifier and Reply URL (Assertion Consumer Service URL):

  1. In the Basic SAML Configuration section, click Edit.

Edit the Basic SAML configuration

Click Edit to modify the Basic SAML configuration.

  1. Add an Identifier: use the value defined in Reemo (reemo).

  2. Add a Reply URL: use the Callback URL generated by the connector in Reemo.

Add an Identifier and Reply URL

Add an Identifier and a Reply URL with the values from Reemo.

  1. Click Save, then use the Test button to verify the configuration.

Note

The connector’s Callback URL is visible in the connector list, under the Configuration column.

Declare users

There are two approaches to grant SSO access to users.

Approach A: Explicit provisioning from the organization
From verified_user Admin Area > domain Organizations, select your organization, then go to inventory_2 Inventory > person Users and click New User > Provision SAML User to add users by entering their email.
New User menu with the Provision SAML User option

Select Provision SAML User from the New User menu.

Popup to add SAML users by email

Add users by email through the provisioning popup.

Approach B: Provisioning via SCIM (automatic)
You can automate user account creation with SCIM:

  1. In the Entra portal, open the Reemo application.

  2. Go to Provisioning > Get Started.

  3. Set Provisioning Mode to Automatic.

  4. Fill in:

    • Tenant URL: SCIM API value provided by Reemo (in the connector list).

    • Secret Token: SCIM Token value provided by Reemo.

  5. Click Test Connection, then Save.

SCIM configuration in Entra

Automate user provisioning with SCIM.

You should now be able to provision users from Microsoft Entra ID using the provisioning interface.

Log in via SAML

Once the connector is active and users are declared (or JIT is enabled), your users can log in:

  • General access to your portal (Private Cloud / On-Prem):

    https://[portal_url]/

  • Direct access to the organization (Public Cloud):

    https://[portal_url]/login/[organization_shortname]

On the login screen, select the SSO tab, then click Login to be redirected to the identity provider.

SSO tab on the login screen

Select the SSO tab, then click Login.