Skip to main content

Setting up SAML Authentication with Microsoft Entra

Updated

Read supports single sign-on (SSO) with several SAML identity providers. This article explains how to set up SAML with Microsoft Entra. For other providers, see How to: Setup SAML Authentication with Read AI.

Prerequisites

You’ll need:

Step 1: Copy your ACS URL and Entity ID from Read

  1. A Read Workspace admin opens Workspace Settings from the menu in the bottom left, goes to Settings, and expands the Advanced (Enterprise+ Required) section.
  2. Scroll to the SAML section.
  3. Copy the ACS URL and Entity ID. You’ll need them in Step 3.
Screenshot 2024-11-22 at 7.50.28 PM.png

Step 2: Create an enterprise application in Microsoft Entra

  1. Sign in to the Microsoft Entra admin center as at least a Cloud Application Administrator.
  2. Go to Identity > Applications > Enterprise applications.
  3. Select New application, then Create your own application.
  4. Name the app. For example, “Read AI SAML.”
  5. Select Integrate any other application you don’t find in the gallery (Non-gallery).
  6. Select Create.

Step 3: Enter Read’s details in Microsoft Entra

  1. Open the enterprise application you just created and select Single sign-on in the left menu.
  2. Select SAML.
  3. Under Basic SAML Configuration, enter:
    • Identifier (Entity ID): The Entity ID you copied in Step 1 (https://api.read.ai)
    • Reply URL (Assertion Consumer Service URL): The ACS URL you copied in Step 1

  4. Under Attributes & Claims, make sure the claims are set up like this: 

    Claim name Value
    Unique User Identifier (Name ID), email address format user.mail
    email user.mail
    first_name user.givenname
    last_name user.surname
  5. Under Users and groups, assign the users or groups who should be able to sign in to Read.

Screen Shot 2023-10-30 at 2.58.21 PM-20231030-185826.png

Step 4: Enter Microsoft Entra’s details in Read

  1. In Microsoft Entra, on the Single sign-on page, copy:
    • Login URL
    • Microsoft Entra Identifier

    • Certificate (Base64). Download it. Screen Shot 2023-10-30 at 3.03.33 PM-20231030-190336.png

  2. In Read, go back to Workspace Settings > Settings > Advanced > SAML and enter:
    • Microsoft Entra’s Login URL → SSO URL
    • Microsoft Entra Identifier → IdP Entity ID
    • The contents of the downloaded certificate → Certificate

  3. Click Save.

     Screenshot 2024-11-22 at 8.16.07 PM.png

Step 5: Test sign-in

  • Use Entra’s Test button: On the Single sign-on page in Microsoft Entra, click Test to sign in to Read and confirm it works.
  • Use your SSO URL: Go to your SSO URL. You should be sent to the Microsoft sign-in page and then into Read once you’ve signed in.

Changes to your SAML application can take up to several hours to take effect, but usually apply much sooner. Once it’s working, everyone you’ve assigned can sign in to Read with the SSO URL.

If you need help, please contact Read Support.

Step 6 (optional): Require SAML sign-in

To make your users sign in only through SAML, see Enforcing SAML for users in your domain. When this is on, anyone who signs in from Read’s sign-in page is sent to your Microsoft sign-in automatically.

Related articles