---
title: "Microsoft Azure SAML Login"
description: "How do you log in using Microsoft Azure SAML, and how do admins set it up for their Organization?"
url: https://support.mosaicapp.com/en/articles/198-microsoft-azure-saml-login
collection: "Admin Hub - Security"
updated: 2026-11-06
language: en
---

# Microsoft Azure SAML Login

How do you log in using Microsoft Azure SAML, and how do admins set it up for their Organization?

This documentation only applies to Organizations using Microsoft Azure SAML login. If your Organization uses a [different login method](https://support.mosaicapp.com/en/articles/193-Authentication.md), consult the appropriate documentation.

Microsoft Azure is a provider for [Single-Sign On (SSO) Login](https://support.mosaicapp.com/en/articles/196-Single-Sign-On-\(SSO\)-Login.md).

# Using Microsoft Azure SAML

1.  Go to Mosaic log in page and enter your email. Click **Next.**
    
    ![](https://staticfiles.gleap.io/ghelparticle/mHJTsjNrSOF8FTSv3Sxly64gFQ7AphWetMOYOMhWYBYc4eRmikTWIKSS6Is3szfWz1TAwtP76tb.png)
2.  You will be redirected to the Microsoft log in page. Select your existing account or click use another account.
    
    ![](https://staticfiles.gleap.io/ghelparticle/WJ7M8MY3jIjfGEFZR1qrJM6tzIaoXP5XQBURXSbJHmI9QAtPpftgvozneNWuL6xAQb0YteSuAy7.png)
3.  Enter your password for that account, and click **Sign in.**
    
    ![](https://staticfiles.gleap.io/ghelparticle/8Q1mhJ0QQdS1g3guhBJgE7CYwRqvsAyjV1Kj0o4vCwikTjTbD9yaTBCfIFHnjpxtc7DFZtCkyes.png)

# Setting up Microsoft Entra ID (Azure AD) SAML for your Organization

This section is for Organization admins. It walks through configuring Microsoft Azure SAML so your members can use the log-in steps above.

> Microsoft Entra ID is the new name for Azure Active Directory (Azure AD). Mosaic’s SAML SSO integration fully supports Microsoft Entra ID using the same setup steps described below.

## Initial Setup with Microsoft Entra ID (formerly Azure Active Directory) using SAML

1.  On the **Welcome to Azure!** page or **Microsoft Entra admin center**, click the **Enterprise applications** option.
    

![](https://staticfiles.gleap.io/p635040750025c60054dcae10/20261105155029_2828.png)

2.  Click on **New application** on the Enterprise applications page.
    

![](https://staticfiles.gleap.io/p635040750025c60054dcae10/20261105155030_7918.png)

![](https://staticfiles.gleap.io/p635040750025c60054dcae10/20261105155031_8084.png)

3.  Click on the **Create your own application** button.
    

![](https://staticfiles.gleap.io/p635040750025c60054dcae10/20261105155032_2490.png)

4.  Input a name that is easily identifiable and select **Integrate any other application you don't find in the gallery (Non-gallery)**.
    

![](https://staticfiles.gleap.io/p635040750025c60054dcae10/20261105155033_1166.png)

5.  Once the app has been created by Azure, navigate to the **Single sign-on** menu and select **SAML**.
    

![](https://staticfiles.gleap.io/p635040750025c60054dcae10/20261105155034_3765.png)

## Add and Verify Domain on Mosaic

1.  Go to **Mosaic Settings** → **Authentication** page. Under **SAML 2.0 Single Sign On**, click `Manage Domains`.
    

> Please Note:
> 
> Only **admins** are able to access the **Authentication** tab on Mosaic settings.

![](https://staticfiles.gleap.io/p635040750025c60054dcae10/20261105154824_3564.png)

2.  Select `+ Domain` on the Verified Domains Modal.
    

![](https://staticfiles.gleap.io/p635040750025c60054dcae10/20261105154825_2668.png)

3.  Enter a your email domain in the host name field. Click `Add Domain`.
    

![](https://staticfiles.gleap.io/p635040750025c60054dcae10/20261105154826_1750.png)

4.  Newly added domain will appear on the modal with status **Not Verified**.
    

![](https://staticfiles.gleap.io/p635040750025c60054dcae10/20261105154827_6436.png)

5.  Share the Hostname, Record Type (TXT), and Record Value with your DevOps team to update the domain’s DNS settings. Click `Verify Ownership` after completing the DNS configuration.
    

![](https://staticfiles.gleap.io/p635040750025c60054dcae10/20261105154828_3619.png)

6.  The domain’s status will update to Verified.
    

> Domains with status Not Verified display a Delete option and can be removed. Once a domain is marked as Verified, the Delete option is no longer available.

![](https://staticfiles.gleap.io/p635040750025c60054dcae10/20261105154829_8958.png)

## Setup SAML

1.  Click `Enable` **SAML 2.0 Single Sign On** on Authentication page.
    

![](https://staticfiles.gleap.io/p635040750025c60054dcae10/20261105155038_8880.png)

2.  On Mosaic’s **SAML 2.0 Single Sign On** menu, fill in:
    

-   **SSO URL**:
    
-   Copy the **Login URL** under **Set up\[name of the application\] App** from Step #4 of the **Azure Single sign-on** menu.
    
-   **Certificate**:
    
-   Download **Certificate (Base64)** under **SAML Signing Certificate** in Step #3 of the **Azure Single sign-on** menu.
    
-   Open downloaded certificate with a text editor of choice.
    
-   Copy the full content of the certificate.
    

![](https://staticfiles.gleap.io/p635040750025c60054dcae10/20261105155039_7791.png)

![](https://staticfiles.gleap.io/p635040750025c60054dcae10/20261105155041_5714.png)

3.  Copy and paste **ACS URL** and **Entity ID** from Mosaic’s **SAML 2.0 Single Sign On** menu to Microsoft Azure’s **Basic SAML Configuration** section; all other fields can remain untouched.
    

![](https://staticfiles.gleap.io/p635040750025c60054dcae10/20261105155042_0662.png)

4.  Add a group to the SAML app through the **Users and groups** menu.
    

-   Create a group on Azure
    
-   Search for Groups
    

![](https://staticfiles.gleap.io/p635040750025c60054dcae10/20261105155044_9099.png)

-   Create a new Group
    

![](https://staticfiles.gleap.io/p635040750025c60054dcae10/20261105155045_6608.png)

-   Ensure the Group Type is `Security` , then fill out the `Group Name`
    

![](https://staticfiles.gleap.io/p635040750025c60054dcae10/20261105155047_4308.png)

-   Assign `Members` you want to be authorized for the Mosaic Team
    
-   Note down the `Object ID` of the new `Group` you just created. This will be entered into Mosaic in a new field for `Security Group ID` in the **Add Domain and Security Group on Mosaic page** section below.
    

Then go back to the SAML app and add the Group through the `Users and Groups` Menu.

![](https://staticfiles.gleap.io/p635040750025c60054dcae10/20261105155049_0681.png)

-   You no longer need to add `Users`, instead you should add a `Group` , and the `Users` to the `Group` you added in the SAML app.
    

5.  Next, click on **Attributes & Claims** and then **Add new claim**.
    

![](https://staticfiles.gleap.io/p635040750025c60054dcae10/20261105155051_1754.png)

-   Add the following additional attributes:
    

a. email

### Mapping Source Attributes

> Configuring Source Attribute Mapping for Email Aliases
> 
> To ensure seamless integration with Single Sign-On (SSO) systems, it's crucial to correctly configure the mapping of source attributes. This configuration allows the use of an email alias instead of the actual mailbox address for SSO authentication.
> 
> For instance, consider you're employing Bob@example.com as the alias and 123@example.com as the primary mailbox address. In this scenario, the configuration on the Azure platform should map the source attribute to the alias (Bob@example.com), not to the mailbox (123@example.com).
> 
> For a full list of user profile attributes in Azure Active Directory B2C, refer to the Microsoft documentation [here](https://learn.microsoft.com/en-us/azure/active-directory-b2c/user-profile-attributes#microsoft-entra-user-resource-type).
> 
> This setup is vital for aligning with Azure's user profile configuration requirements for aliases and mailbox addresses.

![](https://staticfiles.gleap.io/p635040750025c60054dcae10/20261105155052_9336.png)

b. first\_name

![](https://staticfiles.gleap.io/p635040750025c60054dcae10/20261105155053_7431.png)

c. last\_name

![](https://staticfiles.gleap.io/p635040750025c60054dcae10/20261105155054_4885.png)

-   Go back to **Attributes & Claims** and also **Add a group claim**.
    
-   Select `Groups assigned to the application` and enter a Custom Name like `security_group`.
    

![](https://staticfiles.gleap.io/p635040750025c60054dcae10/20261105155051_1754.png)

![](https://staticfiles.gleap.io/p635040750025c60054dcae10/20261105155056_5066.png)

-   Hit save and then SAML will be all set.
    

> Setting up Multiple Teams with SAML:
> 
> To set up multiple teams with SAML simply create another group and add users to that group. **(Users can only be in 1 group!)**
> 
> When setting up SAML on the new Mosaic team. **Skip the step to copy the`ACS URL` and the `Entity ID`.**
> 
> Then copy the new `Object ID` of the new `Group` and paste it into the `Security Group ID` box when setting up SAML on the new Mosaic team.

## Add Domain and Security Group on Mosaic page

1.  Click `+Add Domain` to select Domain for SAML set up. This will be the Domain associated with Microsoft Entra ID. For example, `account1@thisisdomain.com` has a domain of `thisisdomain.com`.
    

> Please Note:
> 
> The email associated with the admin (who is setting up the SAML) must have the same domain as the one being inputted.
> 
> For example, if the admin uses an email `account1@thisisdomain.com`, the only domain the admin could input is `thisisdomain.com`.

![](https://staticfiles.gleap.io/p635040750025c60054dcae10/20261105155022_3661.png)

> Both Verified and Unverified domains are displayed in the list. However, only Verified domains can be selected. Domains that are already added will appear greyed out.

![](https://staticfiles.gleap.io/p635040750025c60054dcae10/20261105155023_4836.png)

2.  Configure the Security Group under the domain. Enter the security group ID. Choose the desired access level from the dropdown menu. Optional: Select `Include accounts without a security group` to allow accounts not assigned to any Security Group to log in while retaining their current access level.
    

![](https://staticfiles.gleap.io/p635040750025c60054dcae10/20261105155024_7521.png)

3.  Click **Done** on the top once all configuration is completed.
    

![](https://staticfiles.gleap.io/p635040750025c60054dcae10/20261105155025_5947.png)

-   Upon successful activation, **SAML 2.0 Single Sign On** will have the following options:
    

![](https://staticfiles.gleap.io/p635040750025c60054dcae10/20261105155026_1313.png)

Next time a user with an email address belonging to the specified domain logs into Mosaic, they will be redirected to authenticate with Microsoft Azure the moment they click **Next** after inputting their email.

![](https://staticfiles.gleap.io/p635040750025c60054dcae10/20261105155057_7942.png)

![](https://staticfiles.gleap.io/p635040750025c60054dcae10/20261105155058_5064.png)

![](https://staticfiles.gleap.io/p635040750025c60054dcae10/20261105155059_6931.png)

> Ensure Azure User Activation Before Creating Mosaic Account
> 
> It is recommended to ensure that a new Azure user is fully active (or wait a few days) before creating a new user on Mosaic. If the Azure account is not fully active, the Welcome Email may hard bounce with the 550 5.4.1 error code (The recipient's address doesn't exist). Unfortunately, AWS, which sends the invitation email, places the email address on a blacklist if the email hard bounces, and no further emails will be sent out.