There are three parts to setting up Azure AD, which we'll cover step-by-step:

First, you need to create a new Enterprise Application on the Azure side, of type non-gallery.

In that new application, you should set-up Single Sign-on using SAML. For now, only enable it - we'll fill it out in section 2 below.

To set up the SSO connection, there are some values in Planhat you need to input to Azure, and vice versa. Below we will walk through the required parameters, and the Planhat/Azure defines where the value should be input.

Planhat: Initiator

This controls whether users should be able to log-in via IdP-initiated flow only (ie, only log in via Azure Directory), or also SP-initiated (ie, via Planhat's website). It's purely a setting, requiring no other input than a decision from your end on what works best. We recommend to use both (IdP + SP).

Planhat: Identifier (Application ID) - required

Called "Application ID" on Azure's side, found under Overview of the Application page.

____

After this, go into the Single Sign-on page. First, you need to do Basic SAML Configuration using input from Planhat's side.

Azure: Identifier (Entity ID) - required

This you can find in the Instructions under Single Sign-on > Security on Planhat's side. But the general rule is: https://api-[cluster].planhat.com/samlmetadata/[tenant_name]

So if you're Apple on the US cluster, then your Identifier (Entity ID) will be: https://api-us.planhat.com/samlmetadata/apple. You can find out what cluster you are on by looking at the URL when logged into Planhat - for example, it will look like https://app-eu.planhat.com/data.

Azure: Reply URL (Assertion Consumer Service URL) - required

Again, this can be found on the SSO page in Planhat. The general rule is: https://api-[cluster].planhat.com/samlassert/[tenant_name]

So if you're Apple on the US cluster, then your Identifier (Entity ID) will be: https://api-us.planhat.com/samlassert/apple

____

Planhat: Log-in URL - required

Then on the Planhat side, you should set the Login URL. You find this under the Single Sign-on page on step 4 in Azure.

After setting this, you have a couple of optional parameters to set in Planhat, including Logout URL, Session Length, whether there are any users who can bypass SSO and log-in with a password.

Planhat: Certificate (Base64) - required

Download the Certificate (Base64) and open the file in the Notepad/Text Editor in Windows/Mac, take the full content, and paste it into Planhat.

The content should look something like:

Planhat: Disable SAML AuthnContext - required

This can typically be set to disabled but if you face the error below when trying out the set-up, then enable the "Disable SAML AuthnContext".

After everything has been set-up, you can try out the connection on the Azure side on step 5 in the SSO section.

Some common issues: