Resource Access Management:Configure user-based SSO with Microsoft Entra ID

Prerequisites

• You have a RAM administrator with the AliyunRAMFullAccess permission for operations in the RAM console. For information about how to create a RAM user and grant permissions, see Create a RAM user and Manage RAM user permissions.

• You have a Microsoft Entra ID administrator with the Global Administrator role for operations in Microsoft Entra ID. For information about how to create a user and grant permissions in Microsoft Entra ID, see the Microsoft Entra ID documentation.

Step 1: Get SAML metadata from Alibaba Cloud

1. Sign in to the RAM console as a RAM administrator.

2. In the left-side navigation pane, choose Integrations > SSO.

3. On the SSO page, click the User-based SSO tab.

4. In the SAML Service Provider Metadata URL section, copy the URL.

5. Open the copied URL in a new browser window and save the metadata XML file locally.

   Note

   The metadata XML file contains information about Alibaba Cloud as a SAML service provider. Record the values of entityID and Location from this file. These values are required for the configuration in Microsoft Entra ID.

Step 2: Create an app in Microsoft Entra ID

1. Sign in to the Azure portal as a Microsoft Entra ID administrator.

2. In the upper-left corner of the home page, click the icon.

3. In the left-side navigation pane, choose Microsoft Entra ID > Manage > Enterprise applications > All applications.

4. Click New application.

5. On the Browse Microsoft Entra Gallery page, click Create your own application.

6. On the Create your own application pane, enter an application name, for example, AliyunSSODemo. Select Integrate any other application you don't find in the gallery (Non-gallery), and then click Create.

Step 3: Configure SAML in Microsoft Entra ID

1. On the AliyunSSODemo page, in the left-side navigation pane, go to Manage > Single sign-on.

2. On the Select a single sign-on method page, click SAML.

3. On the Set up Single Sign-On with SAML page, perform the following steps:

   1. In the upper-left corner, click Upload metadata file, select the file, and then click Add.

      Note

      Upload the XML file that you downloaded in Step 1: Get SAML metadata from Alibaba Cloud.

   2. In the Basic SAML Configuration section, configure the following settings, and then click Save.

      • Identifier (Entity ID): The value of entityID is automatically read from the metadata file.

      • Reply URL (Assertion Consumer Service URL): The value of Location is automatically read from the metadata file.

      • Relay State: The Alibaba Cloud page to which users are redirected after a successful SSO sign-in.

        Note

        For security reasons, you can only set the Relay State to a URL under an Alibaba-owned domain, such as *.aliyun.com, *.hichina.com, *.yunos.com, *.taobao.com, *.tmall.com, *.alibabacloud.com, or *.alipay.com. Otherwise, the configuration is invalid. If you leave this field empty, users are redirected to the Alibaba Cloud console homepage by default.

   3. In the SAML Certificates section, find Federation Metadata XML and click Download.

Step 4: Assign users in Microsoft Entra ID

1. On the AliyunSSODemo page, in the left-side navigation pane, go to Manage > Users and groups.

2. In the upper-left corner, click Add user/group.

3. On the Add Assignment page, select the target user (user u2 in this example), and then click Assignments.

Step 5: Create a RAM user

1. In the left-side navigation pane of the RAM console, choose Identities > Users.

2. On the Users page, click Create User.

3. On the Create User page, in the User Account Information section, enter a Logon Name and a Display Name.

   Ensure that the prefix of the logon name for the RAM user is the same as the username prefix in Microsoft Entra ID. In this example, the prefix is u2.

4. In the Access Mode section, select an access mode.

5. Click OK.

Step 6: Enable user SSO in Alibaba Cloud

1. In the left-side navigation pane of the RAM console, choose Integrations > SSO.

2. On the SSO page, click the User-based SSO tab.

3. In the SSO Status section, click Enabled.

   Note

   User-based SSO is a global setting. After it is enabled, all RAM users must use SSO to log on to the console. If you are currently logged on as a RAM user, do not enable this setting until you have fully configured and tested SSO to avoid being locked out of your account. As a best practice, perform this configuration while signed in to your Alibaba Cloud account.

4. In the Metadata File section, click Upload Metadata File and upload the XML file that you obtained in Step 3: Configure SAML in Microsoft Entra ID.

5. In the Auxiliary Domain Name section, click Edit. Enable the auxiliary domain name and configure it with the email suffix of the username in Microsoft Entra ID.

   For example, if the full username of the Microsoft Entra ID user (u2) is u2@example.onmicrosoft.com, enter example.onmicrosoft.com.

Verify the result

After completing the SSO configuration, you can initiate an SSO sign-in from either Alibaba Cloud (SP-initiated) or Microsoft Entra ID (IdP-initiated).