All Categories > Integrations > How do I set up SSO access via Microsoft Entra ID as IdP?

How do I set up SSO access via Microsoft Entra ID as IdP?

This article shows you how to activate single sign-on via Entra ID in TimeTac.


An initial step in connecting Microsoft Azure with TimeTac is creating and configuring enterprise applications within your Microsoft Entra ID, which will be ‘in charge’ of communicating with our TimeTac system.

Prerequisites

To set up SSO for an application that you will add to your Entra ID tenant you need:

  • An Entra ID account with an active subscription.
  • One of the following roles: Global Administrator, Cloud Application Administrator, Application Administrator, or service principal owner.
  • Your admin user needs an Entra ID Premium license to configure SAML single sign-on for a non-gallery application.


Configure SAML-based Single Sign-On


1Sign in to the Entra ID portal https://portal.azure.com as a cloud application admin or an application admin for your Entra ID tenant.
2Navigate to Microsoft Entra ID and select Enterprise applications from the menu on the left.
3Create a New application and click on Create your own application.
<p>Create a <em>New application</em> and click on<em> Create your own application.</em></p><p><br></p>
4Type in the Name for your new application, and select Integrate any other application you don’t find in the gallery. (Non-gallery) and create it.
<p>Type in the Name for your new application, and select <em>Integrate any other application you don’t find in the gallery. (Non-gallery) </em>and create it.</p><p><br></p>
5Once you create your new Enterprise Application you will be presented with a welcome screen. Click on Set up single sign-on.<p>Once you create your new Enterprise Application you will be presented with a welcome screen. Click on <em>Set up single sign-on.</em></p>
6Select Single Sign-on method as SAML.<p>Select <em>Single Sign-on method as SAML.</em></p>
7In the section Basic SAML Configuration you need to define the Entity ID and the Reply URL:
  • Set the Identifier field: The identifier field is a predefined link that points out to a part of the TimeTac system which handles SAML communication. Please use https://go.timetac.com/{{accountName}}/modules/saml/consume.php. The {{accountName}} is a variable and should be replaced with your TimeTac company account name.
  • Reply URL: Please use https://go.timetac.com/{{accountName}}/modules/saml/consume.php. The {{accountName}} is a variable and should be replaced with your TimeTac company account name.
<p>In the section Basic SAML Configuration you need to define the Entity ID and the Reply URL:</p><ul><li>Set the Identifier field: The identifier field is a predefined link that points out to a part of the TimeTac system which handles SAML communication. Please use <em>https://go.timetac.com/{{accountName}}/modules/saml/consume.php.</em> The {{accountName}} is a variable and should be replaced with your TimeTac company account name.</li><li>Reply URL: Please use <em>https://go.timetac.com/{{accountName}}/modules/saml/consume.php.</em> The {{accountName}} is a variable and should be replaced with your TimeTac company account name.</li></ul>
8In the User Attributes & Claims section, set the email address as the Unique User Identifier and save.<p>In the User Attributes &amp; Claims section, set the email address as the <em>Unique User Identifier</em> and save.</p>
9In sections SAML Signing Certificate and Set up ‘Your Application Name‘ you will find information needed to configure SSO in your TimeTac account:
  • Signing Certificate (x.509 certificate): Download by selecting Certificate (Base64). If there isn’t a certificate, you can generate one by clicking on the pencil symbol. A new page for certificate creation will open; click Save. Check the certificate's status; if it is not active, please activate the new certificate by clicking on the three dots and using the Make new certificate active option. Afterwards, download the certificate in Base64 form.
  • Entity ID: you find it in the section Set up ‘Your Application Name‘ with Entra ID Identifier.
  • Login URL: Can be found in the section Set up ‘Your Application Name‘.
  • Logout URL: Can be found in the section Set up ‘Your Application Name‘.
<p>In sections<em> SAML Signing Certificat</em>e and<em> Set up ‘Your Application Name‘ </em>you will find information needed to configure SSO in your TimeTac account:</p><ul><li><strong>Signing Certificate (x.509 certificate): </strong>Download by selecting Certificate (Base64). If there isn’t a certificate, you can generate one by clicking on the pencil symbol. A new page for certificate creation will open; click Save. Check the certificate's status; if it is not active, please activate the new certificate by clicking on the three dots and using the <em>Make new certificate active</em> option. Afterwards, download the certificate in Base64 form.</li><li><strong>Entity ID:</strong> you find it in the section Set up ‘Your Application Name‘ with Entra ID Identifier.</li><li><strong>Login URL:</strong> Can be found in the section <em>Set up ‘Your Application Name‘.</em></li><li><strong>Logout URL:</strong> Can be found in the section <em>Set up ‘Your Application Name‘.</em></li></ul>
10To make SSO work for a user, the user has been granted access to the SSO application in Entra ID, by assigning the user or a group to the application.
  • Select the option Users and groups from the left menu
  • Click on Add user/group
  • In the new window, Add Assignment, select the user or group you want to assign to the application.
  • When finished, click Select and then Assign.
<p>To make SSO work for a user, the user has been granted access to the SSO application in Entra ID, by assigning the user or a group to the application.</p><ul><li>Select the option&nbsp;<em>Users and groups</em><strong>&nbsp;</strong>from the left menu</li><li>Click on&nbsp;<em>Add user/group</em></li><li>In the new window,&nbsp;<em>Add Assignment, </em>select the user or group you want to assign to the application.</li><li>When finished, click&nbsp;<em>Select</em>&nbsp;and then&nbsp;<em>Assign</em>.</li></ul>

That's how you set up SSO access via Microsoft Entra ID.

Was this Article useful for you?

Yes, this was useful

No, this was not useful