Set up SSO with Microsoft Entra ID

Connect Microsoft Entra ID (formerly Azure AD) as a SAML identity provider. You need the Cloud Application Administrator (or Global Administrator) role in Entra and an owner/admin role in Infinite Audience with the Enterprise tier.

Before you start

In Infinite Audience, open your SSO settings and create a connection to generate your SP Entity ID (Identifier) and ACS URL (Reply URL), shown in the Connection Setup card. Keep that tab open.

1. Create the Enterprise Application

1. In the Microsoft Entra admin center, go to Entra ID → Enterprise applications and click New application.
2. Click Create your own application, name it (e.g. “Infinite Audience”), choose Integrate any other application you don’t find in the gallery (Non-gallery), and click Create.
3. Open the app, go to Single sign-on, and choose SAML.

2. Paste our SP values (Basic SAML Configuration)

Edit Basic SAML Configuration and enter the values from your Infinite Audience Connection Setup card:

1. Identifier (Entity ID) → paste our SP Entity ID. It looks like https://<app-domain>/saml/<your-slug>.
2. Reply URL (Assertion Consumer Service URL) → paste our ACS URL. It looks like https://<app-domain>/__/auth/handler.
3. Leave Sign on URL blank — sign-in is always SP-initiated from our login page (see below). Save.

3. Set the NameID (Unique User Identifier) to email

1. Edit Attributes & Claims.
2. Set the Unique User Identifier (Name ID) source attribute to user.mail (or user.userprincipalname only if that is the user’s real email), with Name ID format Email address.

NameID must be the email address

Sign-in maps users by email — the Name ID must resolve to the user’s actual email address, or sign-in will fail.

4. Gather Entra’s values

In the SAML Certificates and Set up sections:

1. Download Certificate (Base64) → this is the signing certificate (open it as text to get the PEM block).
2. Copy the Login URL → this is our IdP SSO URL.
3. Copy the Microsoft Entra Identifier → this is our IdP Entity ID.

5. Assign users

Under Users and groups, assign the people who should be able to sign in. If the app requires assignment, only assigned users can authenticate.

6. Complete the connection in Infinite Audience

1. In the Connection Setup card, paste the IdP Entity ID, IdP SSO URL, and the certificate PEM, then save.
2. Claim and verify your email domain — see the DNS verification guide.
3. Run Test Connection, confirm the NameID is your email, then Activate.

Signing in

Users sign in at our sign-in page by entering their work email — not from the My Apps portal tile (IdP-initiated sign-in is not supported). If a sign-in fails, see the troubleshooting guide.