Set Up Single Sign-on with Microsoft Entra ID

1. Login to your Microsoft Entra ID administration portal.

2. Click the Enterprise Applications section.

3. Click + New Application on the top menu bar.

4. Click + Create your own application on the top menu bar.

5. In the What's the name of your app? field, enter Red Canary, and then select the Integrate any other application you don't find in the gallery (Non-gallery) radio button.
   

6. Once the new “Non-gallery” app has been created, you should be redirected to the application’s configuration overview page.

7. Click Single sign-On, and then select the SAML tile.
   
   You will now be in the application’s Set up Single Sign-On with SAML configuration page.

1. Open the Entra ID SSO configuration page.

2. In the Basic SAML Configuration section, click Edit.
   

3. Set Identifier to the value listed in the Red Canary SSO configuration's Entity / Issuer value. To find this value you will need to login to your Red Canary and navigate to the Single Sign-On configuration page. You can get there by clicking on your User Icon (top right of page) and selecting Single Sign-On. 

4. Set Reply URL to https://.my.redcanary.co/saml_sp/consume. The Basic SAML Configuration should look similar to this:

   

1. In the Attributes & Claims section, click Edit.

Note: You must provide the LastName, FirstName, and Email claims without any Namespace specified. You will need to delete all of the default Claim entries under the Additional Claims section. Then you must create the FirstName, LastName, and Email Claims.  

• Set LastName = user.surname

• Set FirstName = user.givenname

• Set Email = user.mail

• Set Unique User Identifier = user.mail

  

  The finalized Attribute & Claims section should look like this:

  

  Note: Ensure that the email value is populated to the user.mail attribute in your User Profile located in Entra. If not, you will need to map to the correct attribute containing the user's email address. 

Note: The values for these attributes are specific to your ID configuration and may not match those pictured below.

1. Download the Certificate (Base64) from SAML Signing Certificate section and convert it to Base64-encoded text. (You will need this text for entry into Red Canary's Single Sign-On configuration in the next section of this procedure.) 
   

Pro Tip: It's usually a good idea to first paste the line into a text editor (like Notepad on Windows or TextEdit on Mac) and then copy and paste the clean, unformatted text into the configuration settings.

1. Click your user icon at the top right of your Red Canary, and then click Single Sign-On.

2. Paste the Base64-encoded signing certificate information you downloaded from SAML Signing Certificate section into the Identity Provider x509 Cert (Base64 encoded) field.

3. Paste the Login URL from Microsoft Entra into the Identity Provider SSO Target URL field.

4. Paste the Azure AD Identifier from Microsoft Entra into the Identity Provider Entity ID field.

5. Paste the Logout URL from Microsoft Entra into the Identity Provider SLO Target URL field.

   

   
   

   Note: Be sure to keep the trailing forward slash at the end of the URL and make sure there is no extra whitespace at the end of the line. 

6. Set Email Attribute to Email.

   Note: Make sure there are no periods (".") or whitespaces at the end of the text.

   

7. Check This SSO configuration should be active (at the top of the page).

8. Click Save.