Microsoft Azure

This document describes how to use Microsoft Azure (Microsoft Entra ID) as the identity provider to configure SAML single sign-on for EngageLab. Follow it together with the four-step process in SSO Configuration: this document covers "Step 1: Configure EngageLab in IdP" and "Step 2: Enter Information Returned by IdP".

Prerequisites

• Administrator permissions for Microsoft Entra ID in Microsoft Azure (able to create enterprise applications).
• An EngageLab account with an organization created, and the organization has SSO benefits. If not, please contact sales.
• The configuration wizard is open in EngageLab Personal Center > SSO > Configure SSO, so you can copy the SP information.

Step 1: Create an Enterprise Application

1. Log in to the Microsoft Azure portal and go to Microsoft Entra ID.

   

2. Go to Manage > Enterprise applications.

   

3. Click New application, then click Create your own application.

   

4. Enter an application name (for example, EngageLab), select Integrate any other application you don't find in the gallery (Non-gallery), and click Create. Creation takes a few seconds.

   

5. After creation, the application's overview page opens.

   

To modify the application later, search for it by application name or object ID in Enterprise applications > All applications.

Step 2: Assign Users and Groups

Only users assigned to the application can log in to EngageLab through Azure. You can add or remove members here at any time.

Important: EngageLab matches the email in the member's Azure profile (the mail attribute), not the Azure sign-in name. Make sure this email matches the member's EngageLab account email.

1. On the application overview page, click Assign users and groups.

   

2. Click Add user/group, then click None Selected under Users.

   

3. Select the users who need to log in to EngageLab, click Select, then click Assign.

   

4. After assignment, you return to the application overview page.

   

Step 3: Enable SAML Single Sign-On

1. On the application overview page, click Set up single sign on, or click Manage > Single sign-on in the left menu.

   

2. Select SAML.

   

Step 4: Enter EngageLab SP Information

1. Copy the SP information in step 1 of the EngageLab configuration wizard.

   

2. In the Basic SAML Configuration section in Azure, click Edit, fill in the fields according to the table below, and click Save.

   

   Azure field	Enter EngageLab's
   Identifier (Entity ID)	Entity ID
   Reply URL (Assertion Consumer Service URL)	ACS URL
   Sign on URL	Login URL
   Logout Url	Logout URL

   

Step 5: Check the Email Claim

EngageLab identifies users by the email read from the SAML assertion. Azure's default claims already include the standard email attribute, so usually no changes are needed. Confirm it with the following steps.

1. In the Attributes & Claims section of the SAML configuration page, confirm that the following claim exists:

   Claim name	Value
   http://schemas.xmlsoap.org/ws/2005/05/identity/claims/emailaddress	user.mail

2. If this claim has been deleted or modified, click Edit > Add new claim, add it according to the table below, and click Save:

   Field	Value
   Name	email
   Namespace	Leave blank
   Source	Attribute
   Source attribute	user.mail

Tip: Also set Unique User Identifier (Name ID) to user.mail, with the format Email address, to make troubleshooting easier.

Step 6: Enter Azure Information in EngageLab

1. In the SAML Certificates section of the SAML configuration page, download Certificate (Base64).

   

2. Open the certificate file in a text editor, copy all of its content, and paste it into x509 Certificate in step 2 of the EngageLab configuration wizard.

   

3. In the Set up <application name> section of the SAML configuration page, copy Login URL and Logout URL, and enter them into IdP Login URL and IdP Logout URL in EngageLab respectively.

   

4. Enter the SSO Service Name in EngageLab, click Continue, and then complete organization authorization and verification according to SSO Configuration.

   

Step 7: Test in Azure

After configuration, you can click Test on the SAML configuration page in Azure to test single sign-on as the current user. The test account must be assigned to the application and must have joined an organization in EngageLab that is authorized for the SSO service.

FAQ