Set up single sign-on with Microsoft Entra ID

This article is for administrators who may change settings, such as the Tenant administrator. In Microsoft Entra ID you need a role that can manage enterprise applications, such as Application Administrator or Cloud Application Administrator.

Before you start

1. In FairPro, open Security and choose Add an identity provider.
2. Keep that page open. The panel What your identity provider needs shows the values you copy into Entra: Entity ID (audience), Reply URL (ACS) and Email attribute.

If the page says single sign-on is not switched on for this site yet, FairPro support can tell you when it is.

Make the application in Entra

1. Sign in to the Microsoft Entra admin center and open Enterprise applications.
2. Choose New application, then Create your own application.
3. Name it FairPro, choose Integrate any other application you don’t find in the gallery (Non-gallery) and choose Create.
4. In the new application, open Single sign-on and choose SAML.
5. In Basic SAML Configuration, choose Edit. Paste FairPro’s Entity ID (audience) into Identifier (Entity ID) and FairPro’s Reply URL (ACS) into Reply URL (Assertion Consumer Service URL).
6. In Sign on URL, type the address you use for FairPro followed by /sign-in, then choose Save.

FairPro accepts only sign-ins that start on its own sign-in page. The sign on URL makes the FairPro tile in My Apps start there too.

Send the right claims

FairPro needs the person’s email address and an identifier that never changes. In the box for attributes and claims, choose Edit.

1. Check that the claim named http://schemas.xmlsoap.org/ws/2005/05/identity/claims/emailaddress is there, with the source attribute user.mail. Entra adds it on its own. It is FairPro’s Email attribute, and people whose mail attribute is empty cannot sign in.
2. Choose Unique User Identifier (Name ID). Set Choose name identifier format to Persistent and Source attribute to user.objectid, then choose Save. A person’s object ID never changes, unlike their email address or user principal name.
3. If you will let FairPro add people on their first sign-in, open the claim named http://schemas.xmlsoap.org/ws/2005/05/identity/claims/name and set its source attribute to user.displayname. Entra sends the user principal name there unless you change it, and FairPro uses it as a new person’s name.

If FairPro’s page asks you to send the email address as the NameID instead, do what the page says.

Give FairPro the metadata

1. In Entra, in the box for SAML certificates, copy App Federation Metadata Url.
2. Back in FairPro, fill in Name, such as Microsoft Entra ID, and your Email domains, such as example.com.au.
3. Paste the address into Metadata address and choose Add identity provider.

The address is better than the XML file: it stays current when Entra renews its signing certificate.

Prove your domains and connect

1. FairPro shows a TXT record. Add it to the DNS of each email domain.
2. Choose Check DNS records. A new record can take a while to show up.
3. When the domains are proved, choose Connect. Where there is no Connect, FairPro connects it within a few minutes; refresh the page to see.

Let people in and test it

1. In Entra, open Users and groups in the FairPro application and choose Add user/group. Only people assigned there can sign in through it.
2. In FairPro, invite the same people under People with the same email address, or choose Add people on first sign-in on the identity provider’s page. They start with no role and see nothing until you give them one. Entra can also add people for you; see the guide on SCIM.
3. Test it yourself: on FairPro’s sign-in page, type your work email and choose Sign in with single sign-on.
4. When it works, choose Require it on the identity provider’s page if everyone at those domains should sign in through Entra. Administrators can still sign in with their password by adding ?method=password to the sign-in page’s address, so a broken identity provider cannot lock you out.

People who sign in through Entra are not asked for a FairPro authenticator code or passkey. Ask for a second factor in Entra instead, for example with Conditional Access.