MVP One SAML SSO – Microsoft Azure AD   

 App Registration for Azure AD SAML 

Step 1: Create an Enterprise Application in Azure AD 

1. Navigate to Azure AD Enterprise Applications. 

2. Click Create your own application from the top menu. 

3. Enter a name for your application. In this case, we use "MVP Plant (SAML SSO)". 

4. Select Non-gallery application and create the app. 

5. Once the application is created, go to Properties and note the link to the corresponding App Registration (which has been automatically generated). Click this link to access the App Registration. 
    
    
    

6. Copy the Application ID and save it as the Enterprise Application App ID for later use. 
    
   
   

Step 2: Configure the App Registration 

Since the App Registration has been automatically created, proceed to configure it: 

1. Go to the App Registration section in the Azure AD portal. 

2. Select the App Registration associated with your Enterprise Application. 

3. Under Authentication, set the Redirect URI to the Assertion Consumer Service (ACS) URL: 

• Ensure the Redirect URI is a Web URI, as other types may cause authentication issues. 

• Format: https://YourSite.mvpplant.com/v2/Login/SamlConsume 

• Replace YourSite.mvpplant.com with your actual MVP One site URL. 

4. Under Token Configuration, add an optional claim: 

• Click + Add optional claim. 

• Set Token type to "SAML". 

• Add a claim (e.g., email). 

• Ensure that you accept any API permissions that are prompted during this step.
   

5. Under Expose an API, set the App ID URI and save it as the App Registration App ID for later. 
    

6. Add a scope for permission delegation: 

• Scope name: Files.Read 

• Who can consent?: Admins and Users 

• Admin consent display name: Read User File 

• Admin Consent description: Allow 

• State: Enabled 
   

Step 3: Configure SAML-based SSO in the Enterprise Application 

1. In the Enterprise Application, navigate to Users and Groups. 

2. Assign users or groups that should have access to single sign-on. 
    

3. Go to the Single Sign-On page and select SAML. 
    

4. Click Edit under Basic SAML Configuration. 

• Set Identifier (Entity ID): api://Enterprise_Application_App_ID 

• Set Reply URL: https://YourSite.mvpplant.com/v2/Login/SamlConsume 

• Click Save. 
   

5. Under SAML Signing Certificate, download the Base64 Certificate. 
    

6. Under the Set up section, copy the Login URL and save it. 
    

Step 4: Configure SSO in MVP One

1. Navigate to Administration -> Settings -> Company -> SAML. 

2. Set the following values: 

• Provider Login URL: Paste the Login URL copied from the Enterprise Application setup. 

• Issuer ID: Paste the App Registration App ID, prefixed with api://. 

• If login issues occur, try using the Enterprise Application App ID instead. 

• Username Claim Attribute: Use emailaddress (or match your provider's username attribute). 

3. Upload the Base64 Certificate. 
    

4. Click Save. 
   
   

Step 5: Configure Multiple Sites with Azure SAML SSO 

To add multiple MVP One sites under the same Enterprise Application: 

1. In the Enterprise Application, navigate to Basic SAML Configuration. 

2. Click Edit next to Reply URL. 

3. Click Add Reply URL and enter additional ACS URLs in the format: 

• https://YourOtherSite.mvpplant.com/v2/Login/SamlConsume 

4. Save changes. 

5. Each site must have its exact Assertion Consumer Service URL, as wildcard characters are not allowed.