Cloud · Single sign-on · 02
Set up single sign-on with Microsoft Entra ID
Connect Microsoft Entra ID to Zym Labs over SAML, test it and turn it on.
This guide connects Microsoft Entra ID (formerly Azure AD) to your organization, so your team signs in to Zym Labs with their Microsoft work account. You'll register Zym Labs as an enterprise app in Entra, give Cloud its metadata URL, test a sign-in and turn the connection on. It takes about 20 minutes.
You need to be an organization owner or admin in Cloud; an admin can set up and test the connection, and an owner turns it on. In Entra you need to be able to create enterprise applications, such as a Cloud Application Administrator.
Before you start
- A verified domain in your organization. See Verify a domain.
- Your own Microsoft account on that domain, to test with.
- How single sign-on works, if you haven't read it: it explains what turning the connection on changes for your team.
Steps
Start the connection in Cloud
In your organization, open Single sign-on and choose Set up SSO (or New connection). Choose Microsoft Entra ID, and under Domain this connection signs in, choose your domain. Keep this page open: you'll copy values from it into Entra.
Create the enterprise app in Entra
In the Microsoft Entra admin center, open Enterprise applications, then New application and Create your own application. Name it Zym Labs, choose Integrate any other application and choose Create.
Paste Zym Labs' values
In the new app, open Single sign-on and choose SAML. In Basic SAML Configuration, paste the 2 values Cloud shows:
- Identifier (Entity ID):
https://idp.zymlabs.cloud/realms/zymlabs-cloud - Reply URL (Assertion Consumer Service URL): the URL Cloud shows for your connection. It's unique to it.
Save, then assign the people or groups who should sign in to Zym Labs under Users and groups. People who aren't assigned can't sign in through the connection.
Give Cloud the metadata URL
In Entra, under SAML Certificates, copy the App Federation Metadata Url. In Cloud, choose I've done this, paste it into Metadata URL and continue.
With a URL, Cloud picks up Entra's new signing certificate whenever it rotates. Uploading the metadata XML works too, but then you upload a new file each time the certificate changes.
Check the attributes
Cloud fills in Entra's attribute names for Email, First name and Last name. Change them only if your directory sends something different, then continue.
Test a sign-in
Choose Start test sign-in and sign in with your own Microsoft work account in the window Cloud opens. When it works, Cloud shows Passed and what Entra sent for each attribute.
To test with someone else's account, choose Get a test link and open it in a private window, or send it to them. It works once, within 15 minutes.
Turn it on
An owner chooses Activate connection. If you're an admin, choose Save as draft, and an owner can activate it later from Single sign-on.
From then on, new colleagues on your domain sign in with Entra ID. Passwords keep working until you require single sign-on.
Troubleshooting
The email Entra sent isn't on your domain
The connection only accepts people with an address on its domain. In Entra, make the email claim carry the person's address on your domain, often user.mail rather than user.userprincipalname, or change the Email attribute in Cloud to one that does. Then choose Test again.
The test sign-in didn't finish
You may have signed in with a different account, or closed the window. Choose Test again and sign in with your own Microsoft work account. To test another person's account, use Get a test link in a private window instead.
People can't sign in after it's active
Check that they're assigned to the Zym Labs app in Entra, under Users and groups.
What's next
- How single sign-on works: requiring single sign-on, and keeping a way in.
- Invite and manage members: managed accounts, and disabling them.