Entra ID Configuration for Acubiz SSO

This guide describes the setup of Single Sign-On (SSO) with SAML 2.0 between Microsoft Entra ID and Acubiz.

Contents of this article:

• 1. Prerequisites
• 2. Step-by-step configuration
• 3. Submitting metadata to Acubiz
• 4. Testing the SSO connection

1. Prerequisites

To complete the setup, you need the following:

• License: Microsoft Entra ID P1 or P2.
• Permissions: One of the following roles in Entra ID:
  • Global Administrator
  • Cloud Application Administrator
  • Application Administrator
  • Ownership of the relevant Service Principal.

2. Step-by-step configuration

Step 1: Create application in Entra ID

1. Log in to the Microsoft Entra admin center.
2. Navigate to Enterprise Applications > New application > Create your own application (Non-gallery).
3. Name the application Acubiz.

Step 2: Configure SAML-based SSO

1. Open the created Acubiz application and select Single sign-on > SAML.
2. Import metadata (optional): Use the following URL for automatic filling: https://auth.acubiz.com/federationmetadata/2007-06/federationmetadata.xml 
3. Basic SAML Configuration (Fill in manually if metadata is not imported):
   • Identifier (Entity ID): https://auth.acubiz.com 
   • Reply URL (Assertion Consumer Service URL): https://auth.acubiz.com/adfs/ls/ 
   • Sign on URL: https://[COMPANYID].acubiz.com
     (Note: The exact Sign-on URL must be confirmed by Acubiz).
4. User Attributes & Claims:
   • Unique User Identifier (Name ID): user.mail (or user.userprincipalname, if this contains the user's email address).
   • Other fields can generally be left with default values.

Step 3: User and group assignment

Remember to assign relevant users or groups access to the application under Users and groups. Most organizations select the group "All Users".

3. Submitting metadata to Acubiz

Once the configuration in Entra ID is complete, the following information must be sent to your Acubiz consultant:

1. App Federation Metadata URL: Copy the link from the SAML Certificates section in Entra ID.
   
2. Domain list: A complete overview of all email domains used by users in Acubiz.

⚠️ Important: Wait for written confirmation from Acubiz that the configuration has been completed on their IdP platform before starting testing.

4. Testing the SSO connection

When confirmation from Acubiz is received, the SSO connection should be tested:

1. Go to the Single sign-on section under the Acubiz application in Entra ID.

2. Proceed to Test of SSO connection to Acubiz.