This guide is written by the team that builds Casdoor and describes the standards as published (listed under Sources), with notes on how Casdoor implements them as of November 7, 2026. Spotted a mistake? Tell us.
Microsoft Entra ID SSO (formerly Azure Active Directory) lets users sign in once with their work account and open assigned applications without a separate password. Entra ID is the identity provider; each application is an enterprise application in the tenant; the connection uses SAML 2.0 or OpenID Connect.
It is the default identity provider in most Microsoft shops, and for B2B software it is one of the two IdPs customers ask about first (the other is Okta).
The SSO options Entra ID offers
Microsoft documents several modes, and they are not interchangeable:
| Mode | How it works | When it fits |
|---|---|---|
| SAML 2.0 | Federation: Entra ID sends a signed XML assertion to the app | Enterprise SaaS, older apps, apps that only support SAML |
| OpenID Connect | Federation: the app gets an ID token and access token over OAuth 2.0 | Modern web, mobile and API-backed apps |
| Password-based | Entra ID stores the app password and replays it | Apps with no federation support, often on-premises via Application Proxy |
| Linked | Only adds a tile in the My Apps portal, no real SSO | Migration periods |
| Disabled | No SSO | Testing, or apps that should stay separate |
If a vendor says "we support Entra ID SSO", ask which mode. Password-based is not federation and gives a very different security and user experience.
SAML setup in the admin center
The path is Microsoft Entra admin center → Entra ID → Enterprise apps → All applications → (choose the app) → Single sign-on → SAML.
The Basic SAML Configuration section is where most integrations succeed or fail:
- Identifier (Entity ID): how the application identifies itself to Entra ID. It must match exactly what the app expects.
- Reply URL (Assertion Consumer Service URL): where Entra ID posts the assertion. This is the field behind the classic AADSTS50011 error.
- Sign on URL: where users start a service-provider-initiated login.
- Relay State and Logout URL: optional; the logout URL is used for single logout.
- SAML Certificates: download Certificate (Raw) for the app, or use Federation Metadata XML if the app can import metadata.
- Attributes & Claims: the NameID and claims the app reads. Entra ID has default claims; add group claims if the app does authorization from groups.
Then assign users or groups to the enterprise application. A user who is not assigned cannot sign in, even if the SAML configuration is perfect.
One limitation worth knowing: Microsoft documents that SAML SSO is configurable on single-tenant applications or gallery applications. Multi-tenant applications show the SAML configuration greyed out.
OIDC setup
OIDC uses an app registration rather than the SAML pane:
- Register the application in Entra ID and add a redirect URI (web, SPA or public client, depending on the app type).
- Create a client secret or certificate.
- Grant API permissions, and admin consent if the tenant requires it.
- Read the endpoints from the OpenID Connect metadata document at https://login.microsoftonline.com/
/v2.0/.well-known/openid-configuration. - For enterprise controls such as assignment and conditional access, the app also appears as an enterprise application (the service principal).
The app registration is the definition; the enterprise application is the tenant-local instance. Confusing the two is common when you switch tenants.
Common errors
| Error | Cause |
|---|---|
| AADSTS50011: reply URL does not match | Reply URL in Entra ID differs from the app's ACS URL, including trailing slash or scheme |
| AADSTS700016: application not found in the directory | Wrong tenant, or the app was never consented in this tenant |
| AADSTS65001: consent required | User or admin consent has not been granted for the requested scopes |
| Signature validation failed | App has an old certificate, or expects the assertion signed instead of the response |
| Missing claims or wrong NameID | Attributes and claims not configured, or the app requires a specific NameID format |
| User can sign in but has no access | The user is not assigned to the enterprise application |
Certificate expiry is the quiet one: login works for a year and then fails for everyone at once. Put the expiry date in the calendar and overlap the old and new certificates.
Entra ID and multi-tenant SaaS
If you sell software, you usually need your app to accept customers' Entra ID tenants. That means a multi-tenant app registration in your own tenant, OIDC or SAML per customer, and somewhere to store each tenant's metadata: tenant ID, entity ID, certificate and attribute mapping. This is multi-tenant SSO, a product feature rather than a one-time configuration. See multi-tenant authentication and adding SSO to your app.
Casdoor can serve as that broker: it accepts SAML or OIDC from each customer's Entra ID tenant and gives your application one OIDC connection. It also runs as a standalone identity provider for apps that do not use Microsoft accounts. See Casdoor vs Auth0 or the managed cloud from $9 per month.
FAQ
Is Entra ID the same as Azure AD? Yes. Microsoft renamed Azure Active Directory to Microsoft Entra ID in 2023. The protocol behavior did not change.
Does Entra ID support SAML and OIDC? Yes. SAML 2.0 is configured on the enterprise application's single sign-on page; OIDC uses an app registration with redirect URIs and a client secret or certificate.
Why do I get AADSTS50011? The reply URL configured in Entra ID does not exactly match the application's assertion consumer service URL. Check scheme, host, port, path and trailing slash.
Do users need to be assigned to the app? Usually yes. If the enterprise application requires assignment, a user without an assignment cannot sign in regardless of the SAML or OIDC configuration.
Can I use Entra ID as the identity provider for my own app? Yes. Register your app as a multi-tenant application, support OIDC or SAML per customer tenant, and store each tenant's configuration. Or put a broker such as Casdoor in front and keep one OIDC integration in your app.
Related reading: SAML SSO, SAML vs OIDC and migrating from Azure AD B2C.
Sources
- Microsoft Learn: What is single sign-on in Microsoft Entra ID?
- Microsoft Learn: Enable SAML single sign-on for an enterprise application
Product names are trademarks of their respective owners.