---
title: "Configure SSO with Azure AD"
slug: "configure-saml-with-azure-ad-sso"
description: "This guide will teach you how to configure SAML-based Single Sign-On with Azure AD for Clarity."
tags: ["sso", "aad"]
updated: 2026-10-13T14:24:03Z
published: 2026-10-13T14:24:03Z
canonical: "help.claritysecurity.com/configure-saml-with-azure-ad-sso"
---

> ## Documentation Index
> Fetch the complete documentation index at: https://help.claritysecurity.com/llms.txt
> Use this file to discover all available pages before exploring further.

# Using Azure AD for SSO

This guide will teach you how to configure SAML-based Single Sign-On with Microsoft Entra ID (formerly Azure AD) for Clarity.

**Estimated time to complete:** 30 minutes

If you encounter any problems, please contact your support team or [support@claritysecurity.io](mailto:support@claritysecurity.io).

## Before You Begin

To successfully configure Single Sign-On with Microsoft Entra ID, you'll need the following pre-requisites before you begin:

1. Admin access within your Microsoft Entra ID tenant
  - **Note:** If you do not have admin access, contact your Entra ID admins for provisioning.
2. Admin access within your Clarity Security tenant
  - **Note:** If you are a full admin in Clarity Security and get a permission error when trying to add a new application, reach out to [support@claritysecurity.io](mailto:support@claritysecurity.io).
3. Your users must already exist in Clarity as **active identities**
  - **Note:** Clarity matches the person signing in by email, using their Entra user principal name (UPN) first and then their email address claim. Make sure your identity source (for example, your HR sync) is running and that identity emails in Clarity match what your users sign in to Entra with.

## How to Set Up SSO

### Step 1: Log in to the Azure Portal

Log in to the Azure Portal by heading to the URL below.

[https://portal.azure.com](https://portal.azure.com)

### Step 2: Search for Microsoft Entra ID

Search for Microsoft Entra ID (formerly Azure Active Directory) and click the option.

![Microsoft Entra ID](https://cdn.document360.io/2d020999-1823-4d4d-b6d2-4b52fb4a9617/Images/Documentation/image-1678988277378.png?sv=2026-02-06&spr=https&st=2026-11-11T00%3A17%3A38Z&se=2026-11-11T01%3A17%3A38Z&sr=c&sp=r&sig=zf%2BXZq8gNhTqOCbNNhc%2B04niEGUrMIpFF01PZRlAqfc%3D)

### Step 3: Click Enterprise Applications

Click Enterprise Applications on the left side of the Microsoft Entra ID page.

![Enterprise Applications](https://cdn.document360.io/2d020999-1823-4d4d-b6d2-4b52fb4a9617/Images/Documentation/enterprise%20applications.png?sv=2026-02-06&spr=https&st=2026-11-11T00%3A17%3A38Z&se=2026-11-11T01%3A17%3A38Z&sr=c&sp=r&sig=zf%2BXZq8gNhTqOCbNNhc%2B04niEGUrMIpFF01PZRlAqfc%3D)

### Step 4: Click New Application

Click on New Application to add a new application to your Entra ID tenant.

![Add New Application](https://cdn.document360.io/2d020999-1823-4d4d-b6d2-4b52fb4a9617/Images/Documentation/aad%20new%20application.png?sv=2026-02-06&spr=https&st=2026-11-11T00%3A17%3A38Z&se=2026-11-11T01%3A17%3A38Z&sr=c&sp=r&sig=zf%2BXZq8gNhTqOCbNNhc%2B04niEGUrMIpFF01PZRlAqfc%3D)

### Step 5: Click Create your own application

Click "Create your own application" to create a custom application for connecting to Clarity.

![Create your own application](https://cdn.document360.io/2d020999-1823-4d4d-b6d2-4b52fb4a9617/Images/Documentation/aad%20create%20new%20application.png?sv=2026-02-06&spr=https&st=2026-11-11T00%3A17%3A38Z&se=2026-11-11T01%3A17%3A38Z&sr=c&sp=r&sig=zf%2BXZq8gNhTqOCbNNhc%2B04niEGUrMIpFF01PZRlAqfc%3D)

### Step 6: Configure your new application

Create a name for your application and select "Integrate any other application you don't find in the gallery (Non-gallery)". Then click "Create" once you are done.

![Configure the New Application](https://cdn.document360.io/2d020999-1823-4d4d-b6d2-4b52fb4a9617/Images/Documentation/aad%20configure%20new%20app.png?sv=2026-02-06&spr=https&st=2026-11-11T00%3A17%3A38Z&se=2026-11-11T01%3A17%3A38Z&sr=c&sp=r&sig=zf%2BXZq8gNhTqOCbNNhc%2B04niEGUrMIpFF01PZRlAqfc%3D)

### Step 7: Click Set up single sign-on

Click "Set up single sign-on" or "Single sign-on" on the side of the screen.

![Setup Single Sign-On](https://cdn.document360.io/2d020999-1823-4d4d-b6d2-4b52fb4a9617/Images/Documentation/aad%20setup%20sso.png?sv=2026-02-06&spr=https&st=2026-11-11T00%3A17%3A38Z&se=2026-11-11T01%3A17%3A38Z&sr=c&sp=r&sig=zf%2BXZq8gNhTqOCbNNhc%2B04niEGUrMIpFF01PZRlAqfc%3D)

### Step 8: Choose SAML

Click the SAML button to start the SAML setup process.

![Choose SAML](https://cdn.document360.io/2d020999-1823-4d4d-b6d2-4b52fb4a9617/Images/Documentation/aad%20saml.png?sv=2026-02-06&spr=https&st=2026-11-11T00%3A17%3A38Z&se=2026-11-11T01%3A17%3A38Z&sr=c&sp=r&sig=zf%2BXZq8gNhTqOCbNNhc%2B04niEGUrMIpFF01PZRlAqfc%3D)

### Step 9: Configure Basic SAML

Configure the Basic SAML Configuration section using the information below. These are **Clarity's** URLs, and they are only entered here in Entra.

- **Identifier (Entity ID):** https://**yourtenant**.claritysecurity.io/saml2/aad/metadata
- **Reply URL (Assertion Consumer Service URL):** https://**yourtenant**.claritysecurity.io/saml2/aad/acs
- **Sign on URL:** *Leave blank*
- **Relay State:** *Leave blank*
- **Logout URL:** https://**yourtenant**.claritysecurity.io/saml2/aad/sls

You must replace "**yourtenant**" with the sub-domain from your Clarity tenant.

![Configure Basic SAML](https://cdn.document360.io/2d020999-1823-4d4d-b6d2-4b52fb4a9617/Images/Documentation/aad%20config%20saml.png?sv=2026-02-06&spr=https&st=2026-11-11T00%3A17%3A38Z&se=2026-11-11T01%3A17%3A38Z&sr=c&sp=r&sig=zf%2BXZq8gNhTqOCbNNhc%2B04niEGUrMIpFF01PZRlAqfc%3D)

### Step 10: Double check the entries and hit Save

Confirm all the entries for Basic SAML Configuration and hit save.

Leave **Attributes & Claims** at the defaults. The **Unique User Identifier** should be `user.userprincipalname`.

### Step 11: Download the Base64 SAML Certificate

In the SAML Certificates section, download **Certificate (Base64)**. We also recommend setting the **Notification Email** to a shared mailbox so your team is warned before the certificate expires.

![Download Base64 Certificate](https://cdn.document360.io/2d020999-1823-4d4d-b6d2-4b52fb4a9617/Images/Documentation/Screenshot%202023-04-10%20at%209.20.51%20AM.png?sv=2026-02-06&spr=https&st=2026-11-11T00%3A17%3A38Z&se=2026-11-11T01%3A17%3A38Z&sr=c&sp=r&sig=zf%2BXZq8gNhTqOCbNNhc%2B04niEGUrMIpFF01PZRlAqfc%3D)

### Step 12: Copy the Login URL, Microsoft Entra Identifier & Logout URL for later use

In the "Set up *[your application name]*" section, copy all three values. You'll enter them in Clarity in Step 15.

1. **Login URL**
2. **Microsoft Entra Identifier** (formerly Azure AD Identifier). It looks like `https://sts.windows.net/<your-tenant-id>/`
3. **Logout URL**

Use the copy button next to each value so nothing gets trimmed, including the trailing `/` on the Microsoft Entra Identifier.

![Copy Login URL, Microsoft Entra Identifier and Logout URL](https://cdn.document360.io/2d020999-1823-4d4d-b6d2-4b52fb4a9617/Images/Documentation/Screenshot%202023-04-10%20at%209.21.05%20AM.png?sv=2026-02-06&spr=https&st=2026-11-11T00%3A17%3A38Z&se=2026-11-11T01%3A17%3A38Z&sr=c&sp=r&sig=zf%2BXZq8gNhTqOCbNNhc%2B04niEGUrMIpFF01PZRlAqfc%3D)

### Step 13: Assign Users and/or Groups

Assign the users and/or groups who should be able to sign in to Clarity. Only assigned users can sign in through this application.

![Assign Users and Groups](https://cdn.document360.io/2d020999-1823-4d4d-b6d2-4b52fb4a9617/Images/Documentation/Screenshot%202023-04-10%20at%209.22.29%20AM.png?sv=2026-02-06&spr=https&st=2026-11-11T00%3A17%3A38Z&se=2026-11-11T01%3A17%3A38Z&sr=c&sp=r&sig=zf%2BXZq8gNhTqOCbNNhc%2B04niEGUrMIpFF01PZRlAqfc%3D)

### Step 14: Log in to your Clarity Portal

https://yourtenant.claritysecurity.io

### Step 15: Configure SSO Settings in Clarity

Go to **Settings > SSO**.

1. Leave **Enable SSO** set to **Off** for now. You'll turn it on in Step 17 after testing.

2. Choose Azure Active Directory (aad) from the dropdown for **SSO IDP**

3. **Entity ID** is the **Microsoft Entra Identifier** (line 2 from Step 12)

4. **Login URL** is the **Login URL** (line 1 from Step 12)

5. **Logout URL** is the **Logout URL** (line 3 from Step 12)

6. **x509 Certificate** is what you downloaded in Step 11. Open it with a text editor, then copy and paste the entire contents.

****Important:******The **Entity ID** field in Clarity is **not** the `.../saml2/aad/metadata` URL from Step 9. It must be the **Microsoft Entra Identifier** (`https://sts.windows.net/<your-tenant-id>/`), including the trailing `/`. If this value is wrong, every SSO login will fail with "SAML 2 Error - Ask Admin to check settings".**

7. Click "Save Edits".

![](https://cdn.document360.io/2d020999-1823-4d4d-b6d2-4b52fb4a9617/Images/Documentation/image-1791901339278.png?sv=2026-02-06&spr=https&st=2026-11-11T00%3A17%3A38Z&se=2026-11-11T01%3A17%3A38Z&sr=c&sp=r&sig=zf%2BXZq8gNhTqOCbNNhc%2B04niEGUrMIpFF01PZRlAqfc%3D)

### Step 16: Test SSO before turning it on

Using an account that is assigned to the application in Entra (Step 13) and exists in Clarity as an active identity, open a private/incognito browser window and go to:

https://**yourtenant**.claritysecurity.io/saml2/aad/login

You can also use the **Test** button on the Entra SAML-based Sign-on page. If you land in Clarity, SSO is working. If you see an error, see **Troubleshooting** below.

### Step 17: Turn on SSO

Go back to **Settings > SSO** in Clarity, toggle **Enable SSO** to **On**, and click "Save Edits". From now on, anyone who isn't signed in to Clarity will be sent to Microsoft Entra ID to sign in.

You're all set!

## Who Can Sign In, and What Access They Get

- **Entra controls who can sign in.** Only users and groups assigned to the application (Step 13) can sign in.
- **Clarity must find a match.** The user must already exist in Clarity, or have an active identity whose email matches their Entra UPN or email address.
- **First login creates the user.** The first time someone signs in with SSO, Clarity creates their user and grants basic access (Base User and End User). Users assigned to an access review also receive Manager.
- **Roles are managed in Clarity.** Admin and other roles are assigned in Clarity. Entra groups and role claims do not change a user's Clarity permissions.

## Troubleshooting

| What you see | What it means |
| --- | --- |
| SAML 2 Error - Ask Admin to check settings | A value in Clarity's SSO settings doesn't match Entra. Most often the **Entity ID** (must be the Microsoft Entra Identifier, with the trailing `/`) or the **x509 Certificate**. |
| Unknown identity | Clarity couldn't find a user or an active identity whose email matches the user's Entra UPN or email address. Check the identity's email and that the identity is active. |
| A Microsoft error page before reaching Clarity | Usually the user isn't assigned to the application in Entra (Step 13), or the Identifier / Reply URL in Basic SAML Configuration (Step 9) doesn't match. |

## Certificate Renewal

The Entra SAML signing certificate expires (3 years by default). The expiration date is shown in the SAML Certificates section. When you create or rotate to a new certificate in Entra, download the new **Certificate (Base64)** and paste it into **Settings > SSO > x509 Certificate** in Clarity right away, or SSO logins will fail.

### Need Help?

If you have any problems, contact your customer success team. You can also get in touch with our general support [via email](mailto:support@claritysecurity.io), open a [support ticket](https://support.claritysecurity.com/home). Our general support team is available Monday - Friday from 8:00 AM - 6:30 PM CST.

A Service User is a user, or service account, discovered by Clarity in a downstream application.

An Entitlement is an assignable permission found in a downstream application. Common examples include licenses, groups, and policies.

Service User Entitlements are the pairings of users and active entitlement access in downstream applications.

An attribute is a piece of information used to describe a service user, entitlement, or identity. Common examples include First Name, Last Name, Job Title, Department, etc.