Microsoft Entra ID

This walkthrough registers CyberGuard as a SAML 2.0 enterprise application in Microsoft Entra ID and collects the three values the CyberGuard SSO form needs: the IdP Entity ID, the Metadata URL, and a matching SP Entity ID.

Before you start

Open Extra → Settings → SSO in CyberGuard in a second tab and note the SP Entity ID shown there — you will type the same string into Entra ID. You also need your CyberGuard base URL, because the reply URL is derived from it:

<base_url>/api/accounts/saml/0/acs/

For example, https://cyberguard.guardiangrid.ai/api/accounts/saml/0/acs/.

Create the enterprise application

1. Sign in to the Azure portal and open Microsoft Entra ID from the sidebar menu.

2. Go to Enterprise applications, then New application.

3. Choose Create your own application.

4. Enter a name (for example, CyberGuard) and select Integrate any other application you don’t find in the gallery (Non-gallery). Confirm with Create.

5. In the new application, open Single sign-on from the sidebar menu — or use the Set up single sign on tile — and choose SAML as the method.

Fill the SAML configuration

1. In the first box, Basic SAML Configuration, select Edit.

2. Set Identifier (Entity ID) to exactly the SP Entity ID from the CyberGuard SSO form.

3. Set Reply URL (Assertion Consumer Service URL) to <base_url>/api/accounts/saml/0/acs/.

4. Save and close the panel.

5. In the third box, SAML Certificates, copy the App Federation Metadata Url. This is the Metadata URL in CyberGuard.

6. In the fourth box, Set up <App name>, copy the Microsoft Entra Identifier. This is the IdP Entity ID in CyberGuard.

Grant access

1. Open Users and groups in the application’s sidebar menu.

2. Select Add user/group and assign the people or groups who should be able to sign in to CyberGuard.

Note

Assigning someone to the application in Entra ID does not create their CyberGuard account. Either create the user under Organization → Users first, or turn on auto-provisioning as described in the SSO overview.

Finish in CyberGuard

1. Go to Extra → Settings → SSO and tick Enable SSO.

2. Set Provider to SAML.

3. Paste the IdP Entity ID and the Metadata URL you copied from Entra ID.

4. Check that the SP Entity ID still matches the Identifier you registered in Entra ID.

5. Save. The login page now shows a Login with SSO button.

Tip

Test the round trip in a private browser window before you consider enabling Force SSO login. Keep one administrator account with Exclude from forced SSO ticked as a way back in.

Related

• SSO overview — the full field reference and the auto-provisioning options.
• Okta — the equivalent walkthrough for Okta.
• Users — creating the accounts SSO will sign in.