---
title: "Configure Microsoft Entra ID as an Identity Provider"
date: "2026-06-23T10:51:29+00:00"
summary: "Set up Microsoft Entra ID as a SAML 2.0 IdP for Acquia SSO with step-by-step configuration guidance."
image:
type: "page"
url: "/resources/configure-microsoft-entra-id-identity-provider"
id: "7cfd4e47-6080-4105-9112-51a5b6510de5"
---

Configure Microsoft Entra ID as a Security Assertion Markup Language (SAML) 2.0 Identity Provider (IdP) for Acquia Single Sign-On (SSO). Users authenticate through Entra ID to access Acquia products.

Prerequisites 
--------------

To configure Microsoft Entra ID as an IdP, you must have the following prerequisites:

*   Active Acquia subscription with SSO entitlement.
    
*   Organization administrator access in Acquia.
    
*   Entra ID administrator access.
    
*   Verified domain in Acquia SSO.
    

The following table explains the steps to configure Microsoft Entra ID as an Identity Provider:

S.No.

Step

Description

1

Add and verify your domain in Acquia

Add your domain to Acquia SSO console and verify its ownership.

2

Create the SAML application in Microsoft Entra ID

Create a custom enterprise application in Entra ID and gather the initial SAML metadata.

3

Add the Identity Provider in Acquia

Enter the Entra ID metadata in Acquia to create the provider and generate Acquia metadata.

4

Complete the SAML application configuration in Microsoft Entra ID

Paste Acquia metadata into Entra ID to finalize the SAML configuration.

5

Configure SAML attribute configuration

Map the exact first name, last name, and email attributes between Entra ID and Acquia.

6

Enable user access

Assign the necessary users or groups to the Acquia SSO enterprise application in Entra ID.

### Add and verify your domain in Acquia 

Before you configure your Identity Provider, ensure that you add and verify your domain in Acquia SSO management console. You cannot assign an Identity Provider without a verified domain. For detailed information, refer to [Adding a domain](/resources/using-acquia-single-sign-on#section-adding-a-domain "Using Acquia Single Sign-On").

### Create enterprise application in Microsoft Entra ID 

To create the Acquia enterprise application in Entra ID and gather the required metadata:

1.  Sign in to Microsoft Entra admin center.
    
2.  Go to **Enterprise applications**, select **New application**, and select **Create your own application**.
    
3.  Enter a name such as Acquia SSO, select **Integrate any other application you do not find in the gallery (Non-gallery)**, and select **Create**.
    
4.  In the left menu of the application, go to **Single sign-on** and select **SAML**.
    
5.  In the **SAML Signing Certificate** section, download the **Certificate Base64**.
    
6.  In the **Set up Application Name** section, copy the **Login URL** and **Microsoft Entra Identifier**. Keep these values available for the next step.
    

### Add the Identity Provider in Acquia 

For detailed information, refer to [Adding an Identity Provider](/resources/using-acquia-single-sign-on#section-adding-an-identity-provider "Using Acquia Single Sign-On").

1.  In Acquia SSO, click **Add identity provider**.
2.  Enter a **Label**, select your verified **Domain** from the list, and paste the **Microsoft** **Entra Identifier** and **Login URL**.
    
3.  Open your downloaded Base64 Certificate in a text editor and paste the contents into the Public certificate field.
    
4.  Click **Add identity provider**.
    
    The system displays the Service Provider details.
    
5.  Under Service provider details, copy Acquia **Entity ID** and **ACS URL**.

### Complete the SAML configuration in Entra ID 

To finalize the SAML configuration in Microsoft Entra ID:

1.  Return to your Entra ID application, go to **Single sign-on**, and select **SAML**.
    
2.  In the **Basic SAML Configuration** section, select **Edit**.
    
3.  In the **Identifier Entity ID** field, select **Add identifier** and paste the Acquia Entity ID.
    
4.  In the **Reply URL Assertion Consumer Service URL** field, select **Add reply URL** and paste the Acquia ACS URL.
    
5.  Select **Save** and close the panel.
    

### Configure SAML attribute configuration and claims 

Acquia SSO requires exact attribute names. You must configure Entra ID claims to match the required format of Acquia SSO.

To configure SAML attribute configuration:

1.  In the **Attributes and Claims** section, select **Edit**.
    
2.  Select **Add new claim** to map the required attributes exactly as written.
    
    *   Name: `firstName` and Source attribute: user.givenname. 
        
    *   Name: `lastName` and Source attribute: user.surname.
        
    *   Name: `email` and Source attribute: user.mail.
        
3.  Ensure that the **Namespace** field is completely blank for all three claims.
    
4.  Select **Save** for each claim.
    

### Enable user access 

To grant your organization access to the Acquia SSO app:

1.  In your Entra ID application, go to **Users and groups**.
    
2.  Select **Add user or group** and select the required users or groups.
    
3.  Select **Assign**.