# Set up single sign-on with Microsoft Entra ID

> Microsoft Entra ID: Set up SAML single sign-on between Talon.One and Microsoft Entra ID.

> For the complete documentation index, see [llms.txt](https://docs.talon.one/llms.txt).

This tutorial describes how to connect Talon.One to Microsoft Entra ID to allow users to sign in to Talon.One directly from their Microsoft Entra user account using single sign-on (SSO).

Single sign-on allows users to access many service providers using a single username and
password by relying on a single identity provider.

In this tutorial, the service provider is Talon.One, and the supported identity provider
is [Microsoft Entra ID][microsoftentraid] (formerly known as Azure AD). For more
information about Microsoft Entra ID, see the Microsoft Entra [integration documentation][entraidsso].

:::important
Before you start, ensure you have read [Set up single sign-on](/docs/product/account/account-settings/set-up-sso)
to understand how it impacts your organization.
:::

## Prerequisites

- You have a Microsoft Entra user account for your organization.
- You have admin rights in Microsoft Entra ID.
- You have [admin rights](/docs/product/account/account-settings/manage-roles.md#admin-role)
  in Talon.One.

## Configure Microsoft Entra ID as an identity provider

To connect Microsoft Entra ID to Talon.One, create an enterprise application in Microsoft
Entra ID and set up single sign-on for the application using some information from
Talon.One.

### Get the Assertion Consumer Service (ACS) URL in Talon.One {#acs-url}

1. Sign in to Talon.One and click <Account className="icon"/> **Account** > <Organization className="icon"/> **Organization** > **Single Sign-On**.
1. Next to the **Assertion Consumer Service (ACS) URL** value, click **Copy**.

### Create a Talon.One application in Microsoft Entra ID

1. In a separate browser tab, sign in to the Microsoft Entra admin center with your
   Microsoft account.
1. Go to **Identity** > **Applications** > **Enterprise applications** > **All applications**.
1. Click **New application** > **Create your own application**.
1. Choose a name for the application, for example `Talon.One`.
1. Ensure **Integrate any other application you don't find in the gallery (Non-gallery)**
   is selected, and click **Create**. The application's overview page opens.

### Set up single sign-on for the Talon.One application

1. In Microsoft Entra, in the **Manage** section of the left menu, select **Single sign-on**.
1. To set up single sign-on with SAML, click **SAML**.
1. Edit the **Basic SAML Configuration** section:
   1. Paste the **Assertion Consumer Service (ACS) URL** value you [copied from Talon.One](#acs-url)
      in the following fields:
      - **Identifier (Entity ID)**
      - **Reply URL (Assertion Consumer Service URL)**
   1. Click **Save**.
1. Edit the **Attributes & Claims** section:
   1. In **Claim name**, click **Unique User Identifier (User ID)**.
   1. In **Source attribute**, from the dropdown, select `user.mail`.
   1. Click **Save**.
1. From the **SAML Certificates** section, download the **Certificate (Base64)** and the
   **Federation Metadata XML** files to have them on hand for the next step.

Keep this page open in your browser. The application is ready in Microsoft Entra ID.

## Configure Talon.One for single sign-on

Let's use some of the information provided by Microsoft Entra ID to configure Talon.One.
On the **Single Sign-On** page in Talon.One:

1. Type a name in the **Connection name** field, for example, `Microsoft Entra ID`.
1. Select either **Use a URL and a certificate** or **Use an identity provider (IdP) file**.
1. If you selected **Use a URL and a certificate**:
   - Copy the value of the **Login URL** field provided by Microsoft Entra ID and paste it
     into the **Sign-on URL** field.
   - Copy the value of the **Microsoft Entra Identifier** field provided by Microsoft
     Entra ID and paste it into the **Issuer URL** field.
   - Open the downloaded certificate in a text editor and paste its content into the
     **SSO certificate** field.
1. If you selected **Use an identity provider (IdP) file**, click **Choose XML** and select
   the XML file you downloaded.
1. (Optional) Select the **Enforce single sign-on** checkbox to [enforce single sign-on](/docs/product/account/account-settings/set-up-sso.md#enforce-single-sign-on)
   for all users of your organization.

   :::important
Enforcing single sign-on is a permanent action. When single sign-on is enforced, users of
your organization can sign in to Talon.One only with the domains specified in the setup.

Enforce single sign-on only when you are sure that the setup is correct and signing in
works as expected.
:::

1. Click **Enable Single Sign-On**.

You can now assign the Talon.One application to users in Microsoft Entra ID to allow them
to connect to Talon.One with their Microsoft Entra user account.

## Use single sign-on with Talon.One

To sign in to Talon.One directly from your Microsoft Entra user account:

1. Open your Talon.One deployment.
1. At the bottom of the Talon.One sign-in page, click `Microsoft Entra ID`.

   :::note
The single sign-on button name on the Talon.One sign-in page matches the
**Connection name** that was entered while [configuring Talon.One for single sign-on](#configure-talonone-for-single-sign-on).
:::

1. On the Microsoft Entra ID page you are redirected to, sign in to your Microsoft Entra
   account.

After you sign in to your Microsoft Entra account, you are redirected back to Talon.One.

## Related pages

- [Set up single sign-on](/docs/product/account/account-settings/set-up-sso.md)

[microsoftentraid]: https://www.microsoft.com/en-us/security/business/identity-access/microsoft-entra-verified-id
[entraidsso]: https://learn.microsoft.com/en-us/entra/identity/enterprise-apps/add-application-portal-setup-sso