Set Up SAML SSO for Microsoft Entra ID

Copy Eon's service provider details

In Eon, go to the SAML SSO global management page. Click Add Identity Provider. Once you have at least one identity provider, this button is a icon in the header of the Identity providers panel.

The Add identity provider dialog lists Eon’s service provider details, which you’ll paste into Microsoft Entra ID, each with a copy button. Keep the dialog open because you’ll need these values in the next steps.

Create the SAML application in Microsoft Entra ID

In a new tab, open the Microsoft Entra admin center, navigate to Manage > Enterprise applications and do these steps:

1. Click New application. The Microsoft Entra gallery opens.

2. Click Create your own application. The Create your own application dialog opens.

3. In the Create your own application dialog:

   1. Give a meaningful app name, such as Eon.

   2. Select Integrate any other application you don’t find in the gallery (Non-gallery).

   Click Create. The new application takes a few moments to be created. When it’s done, the application’s overview page opens.

Set the basic SAML configuration

Configure the Entra SAML app’s settings to connect Microsoft Entra ID with Eon.

In the new application’s settings:

1. Select Manage > Single sign-on from the left menu.

2. Choose SAML as the sign-on method. The application’s SAML configuration page opens.

3. In Basic SAML Configuration, click Edit. Paste Eon’s service provider details from the Add identity provider dialog you left open in Eon. Leave all other settings as their default values:

   

   Microsoft Entra ID field	Eon field
   Identifier (Entity ID)	Service provider entity ID
   Reply URL (Assertion Consumer Service URL)	SSO URL
   Sign on URL	SSO URL

4. Save.

Set the SAML claims

Configure the claims to send the user’s email address and group memberships to Eon.

In Attributes & Claims, click Edit. Set the details as follows:

1. In Required claim, set a single claim using the Email address format and the user.userprincipalname source attribute.

2. In Additional claims, delete all the default claims.

3. Click Add a group claim. You’ll see a list of options for which groups to return in the claim.

   1. Choose All groups.

   2. Set Source attribute to Group ID.

   3. In Advanced options, select Customize the name of the group claim, and set Name to groups.

   If a user belongs to more than 150 groups, Microsoft Entra ID omits sending the group claims with their SAML assertion, effectively preventing them from logging in to Eon. You’ll need to work around this limitation by limiting the number of groups sent with the SAML assertion. You can do this in a number of ways, including filtering groups or allowing only groups assigned to the application.

   See Configure group claims for applications in the Microsoft Learn docs for more information.

4. Save.

Return to the app’s SAML configuration page.

Assign groups to the application

Assign user groups to the Eon application to control which users can access Eon through SAML SSO.

1. In the Manage > Users and groups page, click Add user/group.

2. On the Add assignment page, click None selected under Users and groups.

3. Choose the groups you want to be able to access Eon.

4. Click Select to return to the Add assignment page, then click Assign.

Download the SAML certificate

In SAML Certificates, find the Certificate (Base64) entry and click Download. Open the certificate file in a text editor to confirm you downloaded the correct file. The certificate’s first and last lines are -----BEGIN CERTIFICATE----- and -----END CERTIFICATE-----, respectively.

Have the certificate contents ready to copy to Eon in the next step.

Copy the SAML settings to Eon

Return to the Add identity provider dialog in Eon. Enter the provider details from Microsoft Entra ID. You’ll find them in the SAML configuration page in Set up:

1. Give a meaningful Display name, such as Microsoft Entra ID. You can’t change it later, so pick a name you’ll recognize.

2. Paste the corresponding information from Microsoft Entra ID:

   

   Eon field	Microsoft Entra ID field
   SSO URL	Login URL
   Issuer URL	Microsoft Entra Identifier
   SLO URL	Logout URL
   Public certificate	Certificate contents from the previous step

3. Click Add Identity Provider.

Map SAML groups in Eon

Although SAML SSO is now enabled on your Eon account, SAML users can’t log in yet because they have no Eon access by default. To grant access, you need to map your SAML groups in Eon.

Click Add Group Mapping. The New group mapping dialog opens.

Set these options:

• SAML identity provider: Choose the Microsoft Entra ID identity provider you just added.

• Group ID: Enter the group’s ID your identity provider passes in the SAML assertion. This must be an exact match with the assertion. This is case-sensitive, so eon viewers and Eon viewers are different groups.

  Microsoft Entra ID uses the group’s GUID as the group ID. You can find the GUID in the group’s properties in the Microsoft Entra admin center.

• Label: Optionally, give the group a display name so it’s more recognizable in Eon.

Then choose the roles you want to assign to the group. You can assign multiple roles.

Click Create.