Guides

Set up SAML with Microsoft Entra ID (Azure AD)

Step by step: register a SAML application in Microsoft Entra ID (Azure AD), then check the sign-in with ID-Kit.

The steps

1. Entra admin center → Identity → Applications → Enterprise applications → New application → Create your own application, choose "Integrate any other application you don't find in the gallery (Non-gallery)".

2. Ouvrir l'application → Authentification unique → SAML → Configuration SAML de base → Modifier : Identifier (Entity ID) = https://app.example.com/saml/metadata ; Reply URL (ACS) = https://app.example.com/saml/acs ; Sign-out URL = https://app.example.com/saml/slo. Enregistrer.

3. Users and groups: assign at least one person (without this, login fails with AADSTS50105).

4. "SAML Certificates" section: copy the application's Federation Metadata URL and paste it into ID-Kit (step "Tell ID-Kit where your IdP is").

Check the sign-in

Start a sign-in, get the SAML response, then paste it into theanalyseur : ID-Kit checks the signature, audience, receiving address and clock.

Common errors

• AADSTS50011: the reply address does not match (Entra ID)
• AADSTS700016 / AADSTS50020: the application or account does not exist in this tenant (Entra ID)
• AADSTS65001: consent is required (Entra ID)
• “Invalid audience” / “Audience restriction”
• “Unknown certificate” / “signature matches no certificate”