Agent Identity:Configure Microsoft Entra ID as a SAML identity provider for a user pool

Prerequisites

• You have a Microsoft Entra ID tenant with permissions to create enterprise applications (Global Administrator or Application Administrator role).

• You have created a user pool in the Agent Identity console. For more information, see User pool management.

Step 1: Download federation metadata from Agent Identity

1. Log on to the Agent Identity console.

2. In the left-side navigation pane, choose Identity > User Pools.

3. Click the name of the target user pool to go to the user pool details page.

4. In the left-side navigation pane of the user pool details page, click General Configuration.

5. In the SAML Identity Provider section, next to Service Provider Information, click Download Metadata to save the service provider Federation Metadata XML file to your local computer.

Step 2: Create an enterprise application in Microsoft Entra ID

1. Sign in to the Microsoft Entra admin center.

2. In the left-side navigation pane, choose Entra ID > Enterprise applications.

3. Click New application.

4. Click Create your own application.

5. Enter an application name (for example, Aliyun-AgentIdentity-UserPool), select Integrate any other application you don't find in the gallery (Non-gallery), and then click Create.

Step 3: Configure SAML single sign-on in Microsoft Entra ID

1. On the enterprise application page, in the left-side navigation pane, click Single sign-on.

2. Select SAML as the single sign-on method.

3. On the single sign-on configuration page, click Upload metadata file at the top of the page and upload the XML file downloaded in Step 1. The following required settings in the Basic SAML Configuration are automatically populated:

   • Identifier (Entity ID)

   • Reply URL (Assertion Consumer Service URL)

4. Click Save.

Step 4: Download federation metadata from Microsoft Entra ID

1. On the SAML single sign-on configuration page, find the SAML Certificates section.

2. Click the Download link next to Federation Metadata XML to save the identity provider Federation Metadata XML file to your local computer.

Step 5: Assign users to the enterprise application in Microsoft Entra ID

Assign the users who need to sign in to the Agent Identity user pool through SSO to this enterprise application.

1. On the enterprise application page, in the left-side navigation pane, click Users and groups.

2. Click Add user/group.

3. Select the users or groups that you want to assign, and then click Assign.

Step 6: Import Federation Metadata into the Agent Identity user pool

1. Log on to the Agent Identity console.

2. In the left-side navigation pane, choose Identity > User Pools.

3. Click the name of the target user pool to go to the user pool details page.

4. In the left-side navigation pane of the user pool details page, click General Configuration.

5. In the SAML Identity Provider section, click Configure Identity Provider.

6. Configure the following parameters:

   • SSO Status: Enable.

   • Auto-create users on sync: Enable (default).

   • Auto-update user information: Enable (default).

   • Identity Provider Information: Click Upload and parse metadata file, and upload the XML file downloaded in Step 4. The Entity ID and Login URL fields are automatically populated.

7. Click OK.

Step 7: Verify SSO sign-in

1. In the left-side navigation pane of the user pool details page, click General Configuration.

2. In the Basic Information section, click Copy next to Login URL.

3. Open the login URL in a browser. On the Agent Identity login page, click Sign in with SSO.

4. The browser redirects you to the Microsoft Entra ID login page. Sign in with the Entra ID user credentials assigned in Step 5.

5. After you sign in successfully, the browser redirects you back to the Agent Identity login page and displays a welcome message indicating that you have signed in successfully.

Related documentation

• SAML identity provider management

• User pool management

• User management