Enabling The Addigy Log-In Experience With Microsoft Entra SSO (SAML)

The Microsoft Entra single sign-on (SSO) integration lets your team sign in to the Addigy portal with their managed Microsoft Entra ID credentials. Instead of maintaining a separate set of Addigy passwords, you control access from one identity provider, so onboarding, offboarding, and password policy are handled in the same place as the rest of your Microsoft estate.

Note: Microsoft renamed Azure Active Directory to Microsoft Entra ID. The steps and screenshots below use the earlier Azure naming, and the integration tile inside the Addigy console is still labeled Azure SSO. If your Entra admin center looks different from a screenshot, the underlying setting is the same.

Overview

This integration connects Addigy to Microsoft Entra ID as a SAML 2.0 service provider.

• What it does: Creates a SAML trust between a custom enterprise application in Entra and your Addigy tenant, so authentication happens in Entra and Addigy accepts the resulting assertion.
• Who it's for: Addigy administrators who already use Microsoft Entra ID as their identity provider and want to consolidate portal access there.
• Key benefits: One set of credentials for your admins, centralized control over who can reach the Addigy console, and the ability to revoke Addigy access by removing a user's application assignment in Entra.

Setting this up takes four stages:

1. Create an enterprise app in your Entra (Azure) portal.
2. Set up single sign-on in that app.
3. Update the SAML information in Addigy.
4. Assign users and test signing in.

Prerequisites

Before you begin, confirm you have the following:

• A Microsoft Entra ID (Azure) tenant.
• Entra (Azure) admin access to create and configure an enterprise application.
• The Create and Edit Integrations privileges in Addigy.
• Matching email addresses. Your Entra sign-in address must be the same address associated with your Addigy account.

Note: If you are editing an existing SSO configuration in Addigy rather than creating a new one, you must disable the integration before the fields become editable.

How to Create an Enterprise App in Your Azure Portal

The enterprise app is the object in Entra that represents Addigy. You create it once.

1. Select Enterprise Applications. The fastest way is to type Enterprise Applications in the portal search bar.
   
2. Select New Application.
   
3. Select Create your own application, then select Integrate any other application you don't find in the gallery.
    
   

Your new application opens to its overview page, where you configure single sign-on next.

How to Set Up Single Sign-On

Azure presents a five-step SAML setup panel. You will work through steps 1, 2, and 3 of that panel, then return to Addigy.

1. Select Set up single sign on.
   
2. Select SAML as the sign-on method.
   

3. For Step 1: Basic SAML Configuration, select the Edit icon. Azure requires the Entity ID and the ACS URL.
   

   Both values are generated for your tenant in the Addigy console. Open a second tab and navigate to Account > Integrations > Addigy Add-Ons, then under Log In Options select the Azure SSO tile. Copy the Entity ID and Assertion Consumer Service (ACS) URL values shown there. 

   

4. In the Basic SAML Configuration form, paste the Addigy values and confirm that the Default checkboxes next to Identifier (Entity ID) and Reply URL (Assertion Consumer Service URL) are checked.
   

   Note: To test the SAML application from Azure, add your tenant's Addigy login URL to the Sign on URL field, prefixed with https://. Your login URL is in the Addigy console under Account > Settings.

   

5. For Step 2: Attributes & Claims, select Edit. You'll see the default claim set.
   

   Delete every existing claim except the Required Claim.

6. Select Add new claim to create the claims Addigy expects. When filling out each new claim, leave the Namespace field completely empty.
   

   Name	Source Attribute
   email	user.userprincipalname
   given_name	user.givenname
   family_name	user.surname
   Unique User Identifier	user.userprincipalname

   When the claims are configured correctly, Step 2 looks like this:

   

7. For Step 3: SAML Certificates, select Edit.
   

   Select the three dots at the end of your certificate row and download the PEM certificate. You'll upload this to Addigy in the next section.

   

How to Assign Users to the SAML Application

Only users assigned to the application in Entra can sign in to Addigy through it. Repeat these steps for each user or group that needs console access.

1. Browse to Identity > Applications > Enterprise applications > All applications, then open your Addigy application.
2. In the left pane, select Users and groups, then select Add user/group.
3. On the Add Assignment pane, select None Selected under Users and groups.
4. Search for and select the user you want to assign. For example, contosouser1@contoso.com.
5. Select Select.
6. Select None Selected under Select a role, choose the role you want to assign to the user (for example, Standard User), and select Select.
7. Select Assign at the bottom of the pane.

How to Update SAML Information in Addigy

With the Entra side configured, finish the trust by giving Addigy the certificate and sign-on URL.

1. In the Addigy console, navigate to Account > Integrations > Addigy Add-Ons and open the Azure SSO tile under Log In Options.

2. Upload the PEM certificate you downloaded from Azure.

   Note: If you later make changes in Azure, you must download and upload a new .pem file.

3. Back in Azure, scroll to Step 4 and copy the Login URL. Paste it into the SSO URL field in Addigy.
4. If you want users to be able to launch Addigy directly from their Azure dashboard, check Allow IdP-Initiated SSO.
5. Confirm that everyone who needs to sign in to the Addigy console is assigned to the application in Azure.
6. Enable the integration using the toggle at the top right of the panel.

Important: Test your configuration in a separate browser or a private window. Testing in the same browser can reuse your existing authenticated session and mask a misconfiguration.

Signing In

Once the integration is enabled, users sign in to Addigy with their Microsoft credentials.

• From the Addigy login page: Share your organization's unique login URL, found under Account > Settings. Users select the Microsoft sign-in option and authenticate with Entra.
• From the Azure portal: If Allow IdP-Initiated SSO is enabled, users can open Addigy directly from their Azure dashboard after signing in to Azure.

Frequently Asked Questions

I already use Azure SSO with Addigy. Do I need to do anything?

If your configuration predates this integration, you may still be on Legacy SSO, which has been replaced. Follow the Azure Legacy SSO Migration Guide to move over. That guide has you set up the integration described in this article first, then disable the old one under Legacy Login Options.

Why can't I edit my existing SSO settings?

Disable the integration using the toggle, make your changes, then re-enable it. 

Do I need to re-upload the certificate after changing settings in Azure?

Yes. Any change made within Azure requires downloading a fresh PEM certificate and uploading it to the Addigy integration.

A user can authenticate with Microsoft but still can't get into Addigy. What should I check?

Confirm two things: that the user is assigned to the Addigy enterprise application in Entra, and that the email address on their Entra account exactly matches the email address on their Addigy account.

Related Articles

• Enabling The Addigy Log-In Experience With Okta SSO (SAML)
• Enabling The Addigy Log-In Experience With Google SSO (SAML)