Entra SSO

SureMDM offers seamless integration with Microsoft Entra ID (formerly Azure Active Directory) Single Sign-On (SSO) using SAML 2.0, streamlining user access and strengthening security across your organization's device management environment. Users sign in to SureMDM with their existing Microsoft Entra credentials, which eliminates the need for separate login details and simplifies the sign-in experience.

When a user signs in through Microsoft Entra SSO for the first time, SureMDM automatically creates the user in User Management with the permissions configured for the SSO setup under Dynamic Permission Assignment.

Prerequisites

• A Microsoft Entra account with the Application Administrator or Cloud Application Administrator role (or higher).
• A SureMDM account with permission to change Account Settings. Only Account Administrators can configure SSO permissions that grant Super User privileges.
• Your SureMDM server path.

The configuration is done in three steps:

1. Create the enterprise application in Microsoft Entra
2. Configure SAML Single Sign-On in the SureMDM console
3. Update Microsoft Entra with the SureMDM Assertion URL

Step 1: Create the enterprise application in Microsoft Entra

Create the application

1. Sign in to the Microsoft Entra admin center (entra.microsoft.com).
2. Navigate to Entra ID > Enterprise apps and click + New application.
3. On the Browse Microsoft Entra Gallery page, click + Create your own application.
4. Enter a friendly name for the application (for example, SureMDM SSO), select Integrate any other application you don't find in the gallery (Non-gallery), and click Create.
5. When the application's Overview page opens, either select Manage > Single sign-on from the left menu, or click Get started on the Set up single sign on card. Then select SAML.

Configure Basic SAML Configuration

6. On the SAML-based Sign-on page, click Edit on the Basic SAML Configuration box and enter the following values:

Field	Value
Identifier (Entity ID)	urn:42gears:suremdm:SAML2ServiceProvider
Reply URL (Assertion Consumer Service URL)	https://<SureMDM Server Path>/console/ssoconsumer/<Encrypted Account ID>

7. Leave Sign on URL, Relay State, and Logout URL empty.
8. Click Save.

note

In the Reply URL, <SureMDM Server Path> is the SureMDM console URL and <Encrypted Account ID> is the encrypted Account ID.

The Encrypted Account ID is generated by SureMDM only after the SAML Single Sign-On settings are saved (Step 2). Microsoft Entra requires a Reply URL before Basic SAML Configuration can be saved, so for now enter a placeholder value in place of the Encrypted Account ID (for example, your Account ID). You will replace it with the actual URL in Step 3.

Copy the Microsoft Entra values and download the certificate

8. On the same page, scroll down to the Set up \<application name> box and copy the following values. You will paste them into SureMDM in Step 2.
   • Login URL
   • Microsoft Entra Identifier
   • Logout URL
9. In the SAML Certificates box, download Certificate (Base64).

note

The certificate download links become available only after Basic SAML Configuration has been saved.

Assign users and groups

Only users and groups assigned to the application can sign in to SureMDM through Microsoft Entra. Unassigned users receive error AADSTS50105.

10. Select Manage > Users and groups from the left menu (or click Assign users and groups on the application's Overview page), then click + Add user/group.
11. Under Users and groups, click None Selected, select the users and/or groups who should sign in to SureMDM, and click Select.
12. Click Assign.

Verification: The application is saved in Microsoft Entra, you have copied the Login URL, Microsoft Entra Identifier, and Logout URL, you have downloaded the Certificate (Base64), and users or groups are assigned.

Step 2: Configure SAML Single Sign-On in the SureMDM console

1. Log in to the SureMDM Web Console.

2. Navigate to Settings (gear icon at the top right) > Account Settings > Enterprise Integrations > SAML Single Sign-On.

3. Click Add.

4. In Select Identity Provider (IdP), select Microsoft Entra (fka. AzureAD).

5. On the SSO Configuration tab, configure the following settings:

Setting	Description
Service Identifier	Paste the Microsoft Entra Identifier copied from Microsoft Entra. Example: https://sts.windows.net/<Tenant ID>/
Sign-on Service URL	Paste the Login URL copied from Microsoft Entra. Example: https://login.microsoftonline.com/<Tenant ID>/saml2
Logout Service URL	Paste the Logout URL copied from Microsoft Entra. This is generally the same as the Sign On Service URL.
SSO Service Provider Name	Enter urn:42gears:suremdm:SAML2ServiceProvider
Display Name	(Optional) A name that identifies this configuration in the SAML Single Sign-On list.
Auto-remove Deleted/Disabled IdP Users from User Management	(Optional) Automatically removes users from SureMDM User Management when their Microsoft Entra account remains deleted or disabled. The selected interval sets the number of days after the account is deleted or disabled before the user is removed.

6. Click Upload Certificate, select the Certificate (Base64) file downloaded from Microsoft Entra, and click OK.

7. Open the Dynamic Permission Assignment tab and configure the Default Permission: select the Roles, Device Group Set, Jobs/Profiles Folder Set, and Remote File Manager Access Control to assign to users who sign in through Microsoft Entra. To assign permissions based on SAML attributes, see Dynamic Permission Assignment.

   :::warning Important The Default Permission applies to every user who has access to the application in Microsoft Entra and does not match a Dynamic Permission Assignment rule. If Assignment required? is set to No in the application's properties, any Microsoft Entra user in your organization can sign in to SureMDM with these permissions.

• Keep the Default Permission at the lowest level of access.
• Enable Deny Access to allow only users who match a configured rule to sign in. Users who do not match any rule are blocked instead of receiving the default permissions. :::

8. Click Save.
9. On the SAML Single Sign-On screen, locate the saved configuration and copy the full URL from the Assertion Url column. It contains your Encrypted Account ID and has this format:
   https://<SureMDM Server Path>/console/ssoconsumer/<Encrypted Account ID>

note

Use Modify to edit a saved configuration, and Enable/Disable to turn SSO on or off without deleting the configuration.

Step 3: Update Microsoft Entra with the Assertion URL

1. In the Microsoft Entra admin center, navigate to Entra ID > Enterprise apps and open the application created in Step 1.
2. Select Manage > Single sign-on.
3. Click Edit on the Basic SAML Configuration box.
4. In Reply URL (Assertion Consumer Service URL), replace the placeholder with the exact Assertion URL copied from SureMDM.
5. Click Save.

Sign in to SureMDM using Microsoft Entra SSO

1. Open the SureMDM login page and click Sign In using SSO.
2. Click the Microsoft Entra icon and sign in with your Microsoft Entra credentials.

Alternatively, use the URL shown in the Login URLs column of the SAML Single Sign-On screen, in this format:
https://<SureMDM Server Path>/console/ssologin/<Encrypted Account ID>

Dynamic Permission Assignment

Dynamic Permission Assignment assigns different SureMDM permissions to users based on any attribute (claim) Microsoft Entra sends in the SAML assertion, for example, the user's group, name, department, job title, or email. When a user signs in, SureMDM compares the claim values against your rules and assigns the permissions of the matching rule.

How SureMDM evaluates a sign-in

Situation	Result
An attribute matches a rule (Attribute + Condition + Value)	The user is allowed to sign in and is assigned the Role, Device Group Set, Jobs/Profiles Folder Set and Remote File Manager Access Control configured for that rule.
No rule matches	The user gets the Default Permission.
No rule matches, and Deny Access is enabled in Default Permission	The user is not allowed to sign in to SureMDM.

Default Permission is the fallback entry. Its Attribute, Condition and Value fields are disabled because it applies to every user who does not match another rule. Set it to the lowest level of access you are comfortable giving any Microsoft Entra user assigned to the application.

Deny Access is available only in Default Permission. Enable it when only users who match a rule should be able to sign in (for example, only members of a SureMDM-Admins group). Users who do not match any rule are then denied access instead of receiving default permissions.

Configure Microsoft Entra

The attribute you want to use in a SureMDM rule must be sent as a claim in the SAML assertion.

Claims sent by default

A new non-gallery SAML application in Microsoft Entra sends the following claims by default:

Claim	Source attribute
Unique User Identifier (Name ID)	user.userprincipalname
givenname	user.givenname
surname	user.surname
emailaddress	user.mail
name	user.userprincipalname

Any other attribute, such as groups, department, job title or display name, must be added as a claim before it can be used in SureMDM. To view or edit claims, open the application > Single sign-on > Attributes & Claims > Edit.

To add a user attribute (for example, department, job title, or display name):

1. Click + Add new claim.
2. Enter a Name for the claim, for example, department.
3. Select the Source attribute, for example, user.department.
4. Click Save.

To add a group claim:

1. Click + Add a group claim.
2. Select Groups assigned to the application (recommended).
3. Select the Source attribute, for example, sAMAccountName, to send the group name.
4. (Optional) Under Advanced options, customize the name of the group claim, for example, Groups.
5. Click Save, and make sure the groups are assigned to the application under Users and groups.

note

The Attribute name entered in SureMDM must exactly match the claim name in the SAML assertion. Attributes such as department and job title are sent only if they are populated on the user's profile in Microsoft Entra.

Sample attributes

Claim names are examples; you can use any name, as long as the same name is entered in SureMDM.

Use case	Example claim name	Source attribute (Microsoft Entra)	Example Value in SureMDM
Group	Groups	Group Name	SureMDM-Admins
Display name	displayname	user.displayname	John Smith
Department	department	user.department	IT
Job title	jobtitle	user.jobtitle	Manager

For details on configuring claims, see Microsoft's documentation on customizing SAML token claims and configuring group claims.

Configure SureMDM

1. Navigate to Settings (gear icon) > Account Settings > Enterprise Integrations > SAML Single Sign-On.

2. Select the Microsoft Entra configuration and click Modify (or click Add and complete Step 2 for a new configuration).

3. Open the Dynamic Permission Assignment tab.

4. Configure the Default Permission, and enable Deny Access if users who do not match any rule should be blocked.

5. Click Add to create a rule and configure the following settings:

Setting	Description
Attribute	Name of any claim present in the SAML assertion, for example, Groups, displayname, or department.
Condition	How SureMDM matches the claim value with the rule value: Contains: the claim value includes the specified value. Equals: the claim value exactly matches the specified value. In: the claim value matches one of the specified values.
Value	The value to match for the attribute, for example, a group name or a department name.
Roles	Role to assign when the rule matches. See Configure Permissions for Role-Based Admin.
Device Group Set	Device group set to assign when the rule matches. See Configure Permissions for Device Group Set Based Admin.
Jobs/Profiles Folder Set	Jobs/profiles folder set to assign when the rule matches See Configure Permissions for Job Folder Set Based Admin.
Remote File Manager Access Control	Remote File Manager access control to assign when the rule matches. See Configure Permissions for Remote File Manager Based Admin.

6. Click Save.

For more information on configuring SAML-based single sign-on for enterprise applications, see Microsoft's documentation: Enable single sign-on for an enterprise application.

Disclaimer

The third-party configuration steps in this article are based on Microsoft's documentation available at the time of publication and may change. Always refer to the official Microsoft documentation for the latest instructions.