SAML with Microsoft Entra ID

This page shows how to create an enterprise application in Microsoft Entra ID (formerly Azure AD) for the mxHERO Admin Dashboard and copy its values into mxHERO. For background and the full list of SAML values, see Single sign-on with SAML.

Note: If you only want Microsoft 365 accounts to sign in, without SAML, you can turn on Office 365 in Settings › Security instead. Use SAML when you need Entra ID policies such as Conditional Access or assignment-based access.

Before you begin

• You need an Entra ID role that can create enterprise applications (for example Cloud Application Administrator or Application Administrator), and an Owner or Administrator user in mxHERO.
• Copy your mxHERO organization ID from Settings › Organization and domains › Organization (ID). Below it is shown as {organizationId}.
• Each person who will sign in must exist on Settings › Users in mxHERO with the same email address that Entra ID sends.

Step 1: Create the enterprise application

1. In the Microsoft Entra admin center, go to Identity › Applications › Enterprise applications.
2. Click New application, then Create your own application.
3. Enter a name, for example mxHERO Dashboard, select Integrate any other application you don't find in the gallery (Non-gallery), and click Create.

Step 2: Configure SAML

1. In the new application, open Single sign-on and select SAML.

2. In Basic SAML Configuration, click Edit and enter:

   Entra ID field	Value
   Identifier (Entity ID)	https://dashboard-v3.mxhero.com/sp
   Reply URL (Assertion Consumer Service URL)	https://dashboard-api.mxhero.com/auth/saml/{organizationId}/sso
   Sign on URL	Optional: https://dashboard-v3.mxhero.com
   Relay State	Leave empty
   Logout Url	Leave empty

   Click Save.

3. In Attributes & Claims, click Edit, then open Unique User Identifier (Name ID):

   • Name identifier format: Email address
   • Source attribute: the attribute that holds each user's email address as it appears in mxHERO, usually user.mail. Use user.userprincipalname only if your users' UPNs are the same as their email addresses.

   Save. mxHERO reads only the Name ID; you can leave the other claims as they are.

Step 3: Assign users

1. Open Users and groups and click Add user/group.
2. Select the people (or groups) who manage mxHERO and click Assign.

Step 4: Copy Entra ID's values

In Single sign-on:

Step 5: Turn on SAML in mxHERO

1. In the Admin Dashboard, open Settings › Security.

2. On the mxHERO Dashboard card, turn on SAML and click Edit.

3. Paste the Entity ID, Single Sign In URL and the certificate. Click Save.

   

4. Click Save Settings. Authenticate again if asked.

Verify

1. In a private browser window, go to https://dashboard-v3.mxhero.com.
2. Enter an assigned user's email and choose Use your own domain (SAML).
3. Sign in with Microsoft. The dashboard opens.

You can also use Test on the Entra ID Single sign-on page, or the app tile in My Apps.

Troubleshooting

Related pages

• Single sign-on with SAML
• Security settings
• Users and roles
• Microsoft Learn: Enable SAML single sign-on for an enterprise application