Oxelone Docs

Search docs and API

Find a guide, a section of one, or an API operation by its name.

Open console (opens in a new tab)

Administration Microsoft Entra ID

Single sign-on with Microsoft Entra ID

This page connects Microsoft Entra ID to Oxelone over SAML 2.0. It uses the values on Single sign-on, so read that page first for who can do this and what each setting means. You need the Owner role in Oxelone and, in Entra, at least the Cloud Application Administrator role.

Set it up

  1. In Oxelone, open Settings › Access › Single sign-on and set Protocol to SAML 2.0. Leave the page open. It shows the ACS URL and the Entity ID.

  2. In the Microsoft Entra admin center, go to Entra ID › Enterprise apps › All applications and create your own application.

  3. In the app's Manage section, choose Single sign-on, then SAML.

  4. Choose Edit in Basic SAML Configuration and map the console's values to Entra's fields:

    OxeloneMicrosoft Entra ID
    ACS URLReply URL (Assertion Consumer Service URL)
    Entity IDIdentifier (Entity ID)

    Choose Save.

  5. Make sure the name ID Entra sends is the person's email address. Oxelone identifies people by email address.

  6. In the SAML Certificates section, download the Federation Metadata XML. Open the file and copy its contents.

  7. Under Users and groups, assign the people or groups who should sign in.

  8. Back in Oxelone, paste the XML into IdP metadata.

  9. Add your Email domains, choose Test connection, switch on Sign in with SSO and choose Save.

Sign in once from Oxelone's sign-in page, with Continue with SSO, before you turn on Require SSO. Starting from Entra's My Apps page does not work; Oxelone refuses a response it did not ask for.

Certificates expire

Entra creates the app's signing certificate with a lifetime of three years by default, and emails a warning 60, 30 and 7 days before it expires. When you renew it in Entra, paste the new Federation Metadata XML into IdP metadata. Oxelone shows the date the stored certificate is valid until under that box, and Test connection answers "The IdP's signing certificate has expired." once it has.

When it goes wrong

  • The IdP metadata isn't valid SAML metadata. The text pasted is not Entra's metadata. Download the Federation Metadata XML again and paste all of it.
  • The IdP's signing certificate has expired. Paste current metadata.
  • Your identity provider's answer couldn't be verified. Try again, or ask your administrator. (on the sign-in page) The Reply URL or Identifier (Entity ID) in Entra does not match the console's ACS URL or Entity ID exactly.
  • Your identity provider hasn't verified your email address. (on the sign-in page) Entra sent no email address for the person. Add a name ID or attribute that carries it.

The other messages are listed on Single sign-on.

With the API

Not available with an API key.

Microsoft's own documentation