Using Azure AD for SSO

This guide will teach you how to configure SAML-based Single Sign-On with Microsoft Entra ID (formerly Azure AD) for Clarity.

Estimated time to complete: 30 minutes

Before You Begin

To successfully configure Single Sign-On with Microsoft Entra ID, you'll need the following pre-requisites before you begin:

1. Admin access within your Microsoft Entra ID tenant
   • Note: If you do not have admin access, contact your Entra ID admins for provisioning.
2. Admin access within your Clarity Security tenant
   • Note: If you are a full admin in Clarity Security and get a permission error when trying to add a new application, reach out to support@claritysecurity.io.
3. Your users must already exist in Clarity as active identities
   • Note: Clarity matches the person signing in by email, using their Entra user principal name (UPN) first and then their email address claim. Make sure your identity source (for example, your HR sync) is running and that identity emails in Clarity match what your users sign in to Entra with.

How to Set Up SSO

Step 1: Log in to the Azure Portal

Log in to the Azure Portal by heading to the URL below.

https://portal.azure.com

Step 2: Search for Microsoft Entra ID

Search for Microsoft Entra ID (formerly Azure Active Directory) and click the option.

Step 3: Click Enterprise Applications

Click Enterprise Applications on the left side of the Microsoft Entra ID page.

Step 4: Click New Application

Click on New Application to add a new application to your Entra ID tenant.

Step 5: Click Create your own application

Click "Create your own application" to create a custom application for connecting to Clarity.

Step 6: Configure your new application

Create a name for your application and select "Integrate any other application you don't find in the gallery (Non-gallery)". Then click "Create" once you are done.

Step 7: Click Set up single sign-on

Click "Set up single sign-on" or "Single sign-on" on the side of the screen.

Step 8: Choose SAML

Click the SAML button to start the SAML setup process.

Step 9: Configure Basic SAML

Configure the Basic SAML Configuration section using the information below. These are Clarity's URLs, and they are only entered here in Entra.

• Identifier (Entity ID): https://yourtenant.claritysecurity.io/saml2/aad/metadata
• Reply URL (Assertion Consumer Service URL): https://yourtenant.claritysecurity.io/saml2/aad/acs
• Sign on URL: Leave blank
• Relay State: Leave blank
• Logout URL: https://yourtenant.claritysecurity.io/saml2/aad/sls

You must replace "yourtenant" with the sub-domain from your Clarity tenant.

Step 10: Double check the entries and hit Save

Confirm all the entries for Basic SAML Configuration and hit save.

Leave Attributes & Claims at the defaults. The Unique User Identifier should be user.userprincipalname.

Step 11: Download the Base64 SAML Certificate

In the SAML Certificates section, download Certificate (Base64). We also recommend setting the Notification Email to a shared mailbox so your team is warned before the certificate expires.

Step 12: Copy the Login URL, Microsoft Entra Identifier & Logout URL for later use

In the "Set up [your application name]" section, copy all three values. You'll enter them in Clarity in Step 15.

1. Login URL
2. Microsoft Entra Identifier (formerly Azure AD Identifier). It looks like https://sts.windows.net/<your-tenant-id>/
3. Logout URL

Use the copy button next to each value so nothing gets trimmed, including the trailing / on the Microsoft Entra Identifier.

Step 13: Assign Users and/or Groups

Assign the users and/or groups who should be able to sign in to Clarity. Only assigned users can sign in through this application.

Step 14: Log in to your Clarity Portal

https://yourtenant.claritysecurity.io 

Step 15: Configure SSO Settings in Clarity

Go to Settings > SSO.

1. Leave Enable SSO set to Off for now. You'll turn it on in Step 17 after testing.

2. Choose Azure Active Directory (aad) from the dropdown for SSO IDP

3. Entity ID is the Microsoft Entra Identifier (line 2 from Step 12)

4. Login URL is the Login URL (line 1 from Step 12)

5. Logout URL is the Logout URL (line 3 from Step 12)

6. x509 Certificate is what you downloaded in Step 11. Open it with a text editor, then copy and paste the entire contents.

7. Click "Save Edits".

Step 16: Test SSO before turning it on

Using an account that is assigned to the application in Entra (Step 13) and exists in Clarity as an active identity, open a private/incognito browser window and go to:

https://yourtenant.claritysecurity.io/saml2/aad/login

You can also use the Test button on the Entra SAML-based Sign-on page. If you land in Clarity, SSO is working. If you see an error, see Troubleshooting below.

Step 17: Turn on SSO

Go back to Settings > SSO in Clarity, toggle Enable SSO to On, and click "Save Edits". From now on, anyone who isn't signed in to Clarity will be sent to Microsoft Entra ID to sign in.

You're all set! 

Who Can Sign In, and What Access They Get

• Entra controls who can sign in. Only users and groups assigned to the application (Step 13) can sign in.
• Clarity must find a match. The user must already exist in Clarity, or have an active identity whose email matches their Entra UPN or email address.
• First login creates the user. The first time someone signs in with SSO, Clarity creates their user and grants basic access (Base User and End User). Users assigned to an access review also receive Manager.
• Roles are managed in Clarity. Admin and other roles are assigned in Clarity. Entra groups and role claims do not change a user's Clarity permissions.

Troubleshooting

Certificate Renewal

The Entra SAML signing certificate expires (3 years by default). The expiration date is shown in the SAML Certificates section. When you create or rotate to a new certificate in Entra, download the new Certificate (Base64) and paste it into Settings > SSO > x509 Certificate in Clarity right away, or SSO logins will fail.

Need Help?