--- title: "Set Up SSO with Microsoft Entra ID" slug: "set-up-single-sign-on-to-microsoft-entra-id" updated: 2026-09-30T15:00:01Z published: 2026-09-30T15:00:01Z canonical: "docs.redcanary.com/set-up-single-sign-on-to-microsoft-entra-id" --- > ## Documentation Index > Fetch the complete documentation index at: https://docs.redcanary.com/llms.txt > Use this file to discover all available pages before exploring further. # Set Up SSO with Microsoft Entra ID Enhance your organization's security and streamline user access by enabling single sign-on (SSO) with Microsoft Entra ID. This article will walk you through the complete setup process, where you’ll configure settings in both Entra ID and Zscaler MDR. If you have questions or are new to SSO, see our [Overview of Single Sign-On](/doc/docs/overview-single-sign-on). ## 1 Zscaler MDR | Configure SSO Settings 1. In the Zscaler MDR portal, click your user profile in the top right corner. 2. Click **Single Sign-On**. ![](https://cdn.document360.io/75147bee-bf0d-444c-8afb-6e83b11ec0ef/Images/Documentation/useradminsso-1_01.png?sv=2026-02-06&spr=https&st=2026-11-03T13%3A35%3A55Z&se=2026-11-03T14%3A35%3A55Z&sr=c&sp=r&sig=WwXRbgvTPS7p1aRCOk4nPF5mCRnnZZ73Hpz9F2HocVU%3D) 3. Enable the following settings: - **This SSO configuration should be active** This setting activates the SSO setup, after you complete the configuration and click **Save** at the bottom. - **Automatically create a Zscaler MDR user the first time a user is authenticated** This setting automatically provisions a Zscaler MDR account when a new user logs in with SSO. As an optional configuration, you can assign default roles to new users. Select one of the following roles to apply automatically: For a full description of each role's permissions, see [Understand and Assign Roles](/doc/docs/understand-and-assign-roles). To reset a user's permissions to the selected default every time they sign in, check the **Grant these roles on EVERY sign in** box. This will override any manual role changes made previously. This is useful for enforcing a "least privilege" baseline, where you can manually grant temporary high-level access that will be automatically revoked on the next login. ![](https://cdn.document360.io/75147bee-bf0d-444c-8afb-6e83b11ec0ef/Images/Documentation/useradminsso-1_02.png?sv=2026-02-06&spr=https&st=2026-11-03T13%3A35%3A55Z&se=2026-11-03T14%3A35%3A55Z&sr=c&sp=r&sig=WwXRbgvTPS7p1aRCOk4nPF5mCRnnZZ73Hpz9F2HocVU%3D) - Admin - Workflow User - Analyst - Analyst Viewer - Applications Manager - EDR User - Responder You’ll finish configuring these settings in a later step. ## 2 Microsoft Entra ID | Create a Zscaler MDR App 1. Log in to your [Microsoft Entra ID admin center](https://entra.microsoft.com/). 2. Go to **Entra ID > Enterprise apps**. 3. Click **New Application** **> Create your own application**. 4. In the **What's the name of your app?** field, enter “Zscaler MDR”. 5. Select the **Integrate any other application you don't find in the gallery (Non-gallery)** option and click **Create**. ![](https://cdn.document360.io/75147bee-bf0d-444c-8afb-6e83b11ec0ef/Images/Documentation/useradminssoentra-2_01.png?sv=2026-02-06&spr=https&st=2026-11-03T13%3A35%3A55Z&se=2026-11-03T14%3A35%3A55Z&sr=c&sp=r&sig=WwXRbgvTPS7p1aRCOk4nPF5mCRnnZZ73Hpz9F2HocVU%3D) 6. Go to **All applications** and click the newly created Zscaler MDR app. ![](https://cdn.document360.io/75147bee-bf0d-444c-8afb-6e83b11ec0ef/Images/Documentation/useradminssoentra-2_02.png?sv=2026-02-06&spr=https&st=2026-11-03T13%3A35%3A55Z&se=2026-11-03T14%3A35%3A55Z&sr=c&sp=r&sig=WwXRbgvTPS7p1aRCOk4nPF5mCRnnZZ73Hpz9F2HocVU%3D) 7. In the left-hand menu, click **Single sign-on** and select the **SAML** method. ![](https://cdn.document360.io/75147bee-bf0d-444c-8afb-6e83b11ec0ef/Images/Documentation/useradminssoentra-2_03.png?sv=2026-02-06&spr=https&st=2026-11-03T13%3A35%3A55Z&se=2026-11-03T14%3A35%3A55Z&sr=c&sp=r&sig=WwXRbgvTPS7p1aRCOk4nPF5mCRnnZZ73Hpz9F2HocVU%3D) ## 3 Microsoft Entra ID / Zscaler MDR | Configure SSO Properties 1. In the **Basic SAML Configuration** section, click **Edit**. ![](https://cdn.document360.io/75147bee-bf0d-444c-8afb-6e83b11ec0ef/Images/Documentation/useradminssoentra-3_01.png?sv=2026-02-06&spr=https&st=2026-11-03T13%3A35%3A55Z&se=2026-11-03T14%3A35%3A55Z&sr=c&sp=r&sig=WwXRbgvTPS7p1aRCOk4nPF5mCRnnZZ73Hpz9F2HocVU%3D) 2. Click **Add Identifier.** 3. Return to the Zscaler MDR SSO settings page, then copy the URL from the **Entity / Issuer** field and paste it into the Entra Identifier field. ![](https://cdn.document360.io/75147bee-bf0d-444c-8afb-6e83b11ec0ef/Images/Documentation/useradminssoentra-3_02.png?sv=2026-02-06&spr=https&st=2026-11-03T13%3A35%3A55Z&se=2026-11-03T14%3A35%3A55Z&sr=c&sp=r&sig=WwXRbgvTPS7p1aRCOk4nPF5mCRnnZZ73Hpz9F2HocVU%3D) 4. In the Entra **Reply URL** field, enter the following URL, replacing `mysubdomain` with your actual subdomain: `https://mysubdomain.my.redcanary.co/saml_sp/consume` ![](https://cdn.document360.io/75147bee-bf0d-444c-8afb-6e83b11ec0ef/Images/Documentation/useradminssoentra-3_03.png?sv=2026-02-06&spr=https&st=2026-11-03T13%3A35%3A55Z&se=2026-11-03T14%3A35%3A55Z&sr=c&sp=r&sig=WwXRbgvTPS7p1aRCOk4nPF5mCRnnZZ73Hpz9F2HocVU%3D) 5. On the Entra SSO settings page, click **Save** and close out of the SAML configuration popover. 6. In the **Attributes & Claims** section, click **Edit**. ![](https://cdn.document360.io/75147bee-bf0d-444c-8afb-6e83b11ec0ef/Images/Documentation/useradminssoentra-3_04.png?sv=2026-02-06&spr=https&st=2026-11-03T13%3A35%3A55Z&se=2026-11-03T14%3A35%3A55Z&sr=c&sp=r&sig=WwXRbgvTPS7p1aRCOk4nPF5mCRnnZZ73Hpz9F2HocVU%3D) 7. In the **Additional claims** section, click each additional claim. ![](https://cdn.document360.io/75147bee-bf0d-444c-8afb-6e83b11ec0ef/Images/Documentation/useradminssoentra-3_05.png?sv=2026-02-06&spr=https&st=2026-11-03T13%3A35%3A55Z&se=2026-11-03T14%3A35%3A55Z&sr=c&sp=r&sig=WwXRbgvTPS7p1aRCOk4nPF5mCRnnZZ73Hpz9F2HocVU%3D) 8. Delete the namespace URI `http://schemas.xmlsoap.org/ws/2005/05/identity/claims`. ![](https://cdn.document360.io/75147bee-bf0d-444c-8afb-6e83b11ec0ef/Images/Documentation/useradminssoentra-3_06.png?sv=2026-02-06&spr=https&st=2026-11-03T13%3A35%3A55Z&se=2026-11-03T14%3A35%3A55Z&sr=c&sp=r&sig=WwXRbgvTPS7p1aRCOk4nPF5mCRnnZZ73Hpz9F2HocVU%3D) 9. Confirm that the claim names and values look like this: ![](https://cdn.document360.io/75147bee-bf0d-444c-8afb-6e83b11ec0ef/Images/Documentation/useradminssoentra-3_07.png?sv=2026-02-06&spr=https&st=2026-11-03T13%3A35%3A55Z&se=2026-11-03T14%3A35%3A55Z&sr=c&sp=r&sig=WwXRbgvTPS7p1aRCOk4nPF5mCRnnZZ73Hpz9F2HocVU%3D) 10. Confirm that your user email address is connected to the `user.userprincipalname` attribute: - In the left nav, click **Users**. - Select your user name. - In the **Properties** tab, confirm that the **User principal name** contains your email address. ![](https://cdn.document360.io/75147bee-bf0d-444c-8afb-6e83b11ec0ef/Images/Documentation/useradminssoentra-3_08.png?sv=2026-02-06&spr=https&st=2026-11-03T13%3A35%3A55Z&se=2026-11-03T14%3A35%3A55Z&sr=c&sp=r&sig=WwXRbgvTPS7p1aRCOk4nPF5mCRnnZZ73Hpz9F2HocVU%3D) 11. Return to the SSO enterprise app SSO settings. 12. In the **SAML Certificates** section, click **Download** next to **Certificate (Base64)**. ![](https://cdn.document360.io/75147bee-bf0d-444c-8afb-6e83b11ec0ef/Images/Documentation/useradminssoentra-3_09.png?sv=2026-02-06&spr=https&st=2026-11-03T13%3A35%3A55Z&se=2026-11-03T14%3A35%3A55Z&sr=c&sp=r&sig=WwXRbgvTPS7p1aRCOk4nPF5mCRnnZZ73Hpz9F2HocVU%3D) 13. In a text editor, open the downloaded certificate and copy it. 14. On the Zscaler MDR SSO settings page, paste the downloaded certificate into the **Identity Provider X509 Cert** field. ![](https://cdn.document360.io/75147bee-bf0d-444c-8afb-6e83b11ec0ef/Images/Documentation/useradminssoentra-3_10.png?sv=2026-02-06&spr=https&st=2026-11-03T13%3A35%3A55Z&se=2026-11-03T14%3A35%3A55Z&sr=c&sp=r&sig=WwXRbgvTPS7p1aRCOk4nPF5mCRnnZZ73Hpz9F2HocVU%3D) 15. On the Microsoft Entra SSO settings page, scroll down to the **Set up Zscaler MDR** section, where you’ll copy each field and paste it into the Zscaler MDR SSO settings page: ![](https://cdn.document360.io/75147bee-bf0d-444c-8afb-6e83b11ec0ef/Images/Documentation/useradminssoentra-3_11.png?sv=2026-02-06&spr=https&st=2026-11-03T13%3A35%3A55Z&se=2026-11-03T14%3A35%3A55Z&sr=c&sp=r&sig=WwXRbgvTPS7p1aRCOk4nPF5mCRnnZZ73Hpz9F2HocVU%3D)![](https://cdn.document360.io/75147bee-bf0d-444c-8afb-6e83b11ec0ef/Images/Documentation/useradminssoentra-3_12.png?sv=2026-02-06&spr=https&st=2026-11-03T13%3A35%3A55Z&se=2026-11-03T14%3A35%3A55Z&sr=c&sp=r&sig=WwXRbgvTPS7p1aRCOk4nPF5mCRnnZZ73Hpz9F2HocVU%3D) - Copy **Login URL** and paste it into the **Identity Provider SSO Target URL** field. - Copy **Microsoft Entra Identifier** and paste it into the **Identity Provider Entity ID** field. - Copy **Logout URL** and paste it into the **Identity Provider SLO Target URL** field. 16. On the Zscaler MDR SSO settings page, in the **Email Attribute** field, type “Email.” Make sure it is title cased. ![](https://cdn.document360.io/75147bee-bf0d-444c-8afb-6e83b11ec0ef/Images/Documentation/useradminssoentra-3_13.png?sv=2026-02-06&spr=https&st=2026-11-03T13%3A35%3A55Z&se=2026-11-03T14%3A35%3A55Z&sr=c&sp=r&sig=WwXRbgvTPS7p1aRCOk4nPF5mCRnnZZ73Hpz9F2HocVU%3D) 17. Click **Save**. 18. Return to the Entra SSO settings page and click **Test this application**. ## 4 Zscaler MDR | Require SSO for User Login Once you’ve successfully tested your setup, go to the Zscaler MDR SSO settings page and check the box **Disable user / password login and require login via Single Sign On**. This requires SSO login for all user logins. Make sure to click **Save** to apply the change. ![](https://cdn.document360.io/75147bee-bf0d-444c-8afb-6e83b11ec0ef/Images/Documentation/useradminssoentra-4_01.png?sv=2026-02-06&spr=https&st=2026-11-03T13%3A35%3A55Z&se=2026-11-03T14%3A35%3A55Z&sr=c&sp=r&sig=WwXRbgvTPS7p1aRCOk4nPF5mCRnnZZ73Hpz9F2HocVU%3D)